JD Mitchell Privacy Policy

Our commitment to your privacy

JD Mitchell respects your privacy. We collect and use information for clear business purposes, protect it with appropriate safeguards, and explain how you can ask questions or exercise your rights.

We do not sell or rent your personal information, including to our service providers. We do use approved providers to help deliver our services. They may process information needed for their work, as explained below. Other limited disclosures, such as those required by law or directed by you, are also described in this policy.

This policy describes how JD Mitchell handles personal information across our websites, applications, products, services, and business communications. It applies whether you browse, contact us, use a service, make a purchase, or interact with us on behalf of an organization. Not every interaction involves every type of information described here.

If a particular activity requires additional privacy information, we provide it where relevant. A service agreement may explain commercial terms, but it does not silently authorize an unrelated use of personal information or remove your privacy rights.

1. Information we collect

Personal information is information that identifies you or can reasonably be linked to you. Depending on how you interact with us, it may include:

Category	Examples
Contact and communication information	Name, email address, telephone number, correspondence, inquiries, and communication preferences.
Account and access information	Profile details, organization relationships, permissions, verification records, sign-in activity, and acceptance of required policies.
Information supplied through our services	Records, files, messages, and other content you or an authorized person submits, including information needed to provide support.
Purchase and financial information	Billing contact and address, tax information, purchases, invoices, transaction references, payment results, credits, and refunds.
Technical and usage information	Pages or features accessed, timestamps, browser and device information, network information, errors, and security or diagnostic records.
Business records	Relevant support notes, agreement records, operational history, and reports derived from the activities above.

We obtain information directly from you, through your interactions with us, from people authorized to act for you or your organization, and from providers reporting relevant service outcomes. For example, an organization may supply your contact details to arrange access, or a payment provider may report that a transaction succeeded.

We do not assume that a summary or historical report is anonymous. Information that can still reasonably be linked to a person remains subject to this policy.

Please provide only information appropriate to your request or use of a service. Do not send passwords, payment security codes, full card numbers, or private access links in ordinary correspondence or support messages.

2. How we use information

We use information as appropriate to:

We limit collection and use to information appropriate for an identified purpose. We obtain consent where required. Where applicable law permits another basis for processing, we use an appropriate basis, such as providing a requested service, meeting a legal obligation, or protecting legitimate business and security interests.

Contacting us does not automatically authorize unrelated marketing. Accepting service terms is not blanket consent to every possible use of your information.

3. Analytics, cookies, and similar technologies

We use limited usage measurements to understand visits, page or feature use, and service performance. Our approach is to collect useful measurements while avoiding unnecessary information about individuals.

For basic website traffic measurement, we record page visits, timestamps, and selected non-identifying navigation or campaign values. We configure this measurement without analytics cookies or persistent visitor identifiers. We do not use session replay or capture form contents for this purpose. These measurements describe activity rather than an exact count of unique people.

Security and operational systems may separately process network, device, and diagnostic information needed to deliver and protect our services. Cookieless measurement does not mean that no personal information is processed.

Cookies or similar technologies may be needed for functions such as sign-in, maintaining a requested session, security, or remembering a preference. Where additional technologies require notice, consent, or an opt-out, we provide the applicable information and controls. We honor legally required preference signals where applicable. A future change in technology must remain consistent with this policy or be accompanied by the required notice and choices before use.

4. When we disclose information

Approved service providers

We use providers for hosting and storage, communications, technical monitoring, security, support, payment processing, and related business functions. We disclose information appropriate to the function and use contractual, access, and other safeguards suited to the provider's role.

For example:

Approval as a provider does not give permission to buy personal information from us or use it for an unrelated purpose. Some providers, banks, or payment networks also process information for their own legal, security, and other responsibilities. Where relevant, we identify the provider and make its information practices available through the applicable service notice, transaction interface, or agreement.

We remain responsible for our own provider choices and disclosures. A provider's independent policy does not replace our obligations.

Your organization and authorized recipients

If you use a service through an organization, its authorized administrators or collaborators may access information within their permissions. That organization may have its own privacy responsibilities and policies. We do not make unrelated customer records or private internal notes available merely because someone has an administrative role.

Where we process information on an organization's instructions, the organization may determine the purpose of that processing. We may need to coordinate a request with it while continuing to meet our own obligations.

Your instructions

We may disclose information when you or an authorized person directs us to do so. We verify authority as appropriate. Permission for one disclosure does not authorize unrelated disclosures.

Legal requirements and protection

We may disclose relevant information to comply with law or valid legal process, or where reasonably necessary to protect people, address fraud or security incidents, or establish or defend legal rights. We assess the circumstances and limit disclosure as appropriate.

A business transfer

If our business or a relevant part of it is sold, merged, or reorganized, necessary information may be transferred with appropriate confidentiality protections. A business transfer does not itself authorize an unrelated use of information. We provide notice and obtain consent where required if its handling materially changes.

5. AI and information use

Our use of AI follows this policy and our AI Policy. Before introducing an AI use involving personal information or customer content, we define its purpose, consider the information and provider involved, apply appropriate safeguards, and provide compatible disclosures and any required consent or choices.

Giving us information for service delivery or support does not grant unrestricted permission to send it to an AI provider or train a general-purpose model on it. Provider use of automated technology must be assessed in the context of its actual purpose, data handling, and responsibilities. Specific AI uses and decision-making safeguards are explained in our AI Policy and any relevant additional notice.

6. How long we retain information

We retain information for identified service, support, financial, security, reporting, and legal purposes. The appropriate period depends on the information, why it is held, applicable agreements, and legal requirements.

We use category-specific retention schedules where appropriate. Factors include whether a relationship or request remains active, whether financial records or disputes remain unresolved, whether information is needed for security or accountability, and whether a legal hold applies. A retention period for one category does not automatically apply to every inquiry, message, or technical event.

Closing an account, ending a subscription, or archiving a record does not immediately delete all related information. Conversely, keeping a historical record does not create an unlimited exemption from privacy obligations. We evaluate deletion requests against the information involved and explain relevant limits.

When information is no longer needed and no applicable obligation requires retention, we arrange appropriate deletion or de-identification through controlled processes. We consider copies held in reports, exports, provider systems, and backups. Backup cycles or other legitimate constraints may affect timing; restoration processes must account for previously approved deletion so that it is not silently undone.

Information we retain remains subject to purpose and access restrictions. We review documented holds rather than treating them as a blanket reason to keep everything indefinitely.

7. Security

We use safeguards appropriate to the information and activity, including limiting access by role, need, and sensitivity. Authorized personnel and providers receive the access needed for their work.

No system can guarantee absolute security. We investigate suspected incidents and provide notices required by law. Contact us promptly if you suspect unauthorized access or disclosure, without including passwords or full payment credentials in your report.

8. Your choices and privacy requests

You may unsubscribe from promotional emails using the option provided or by contacting us. Necessary service, account, security, or financial communications may continue while relevant. Where a communication channel requires additional consent or opt-out instructions, we provide them before or when that channel is used as required.

Depending on applicable law and our role, you may have rights to access, correct, delete, or obtain a portable copy of your information; withdraw consent; or object to or restrict certain processing. Other applicable rights may include opting out of certain profiling or advertising uses, using a recognized preference signal, acting through an authorized agent, or appealing a decision. This description does not mean we conduct every activity for which the law provides an opt-out.

To make a request, email support@jdmitchell.com with “Privacy request” in the subject line. Describe your interaction with JD Mitchell and what you are requesting. Do not include a password or full payment credentials.

We may verify identity and authority using information appropriate to the request and risk. Where necessary, we coordinate with the organization responsible for the information. We respond within applicable legal deadlines and explain a denial or limitation where required. To request review of our decision, reply to our response or contact the same address with “Privacy appeal.” You may also contact the appropriate regulator.

We do not unlawfully discriminate against someone for exercising a privacy right. A request may affect our ability to provide a function that requires the information, which we explain where relevant. Exercising a privacy right does not waive another legal right or resolve an unrelated payment obligation.

9. Location and other services

JD Mitchell is based in Montana, United States. Information may be processed where we and our providers operate. We apply safeguards and transfer requirements appropriate to the information and applicable law. A customer's location or our current sales territory does not establish that every copy of information remains in that location.

Independent websites and services may have their own privacy practices. We explain relevant disclosures we make to them, but this policy does not replace their independent notices or remove our own responsibilities.

10. Changes and contact

We provide notice of material changes to this policy as appropriate. Where a new purpose requires consent or another specific step, updating this page alone is not a substitute. A policy update does not provide retroactive permission for an incompatible use of information already collected.

Questions and requests can be sent to support@jdmitchell.com.