Privacy Policy
This Privacy Policy describes how Liam J Penwell, Attorney at Law ("we," "us," or "our") collects, uses, and discloses personal information through our website located at www.penwell.law (the "Website").
Information We Collect
Information You Provide Directly
When you submit an inquiry through our contact form, we may collect the following categories of personally identifiable information ("PII"):
- Your name
- Your email address
- Your telephone number
- The content of your message
- The page of this Website you sent the inquiry from, the page you first arrived on, and the website that referred you, if your browser provides it
We strongly advise you not to include sensitive, privileged, or detailed confidential information in any contact form submission. As described in our Terms of Use, information submitted through the Website is not confidential and is not protected by the attorney-client privilege. Submitting information through the Website does not create an attorney-client relationship.
Newsletter Subscription
If you choose to subscribe to our blog newsletter, we collect the email address you provide, together with the date, time, and IP address of your subscription as a record of your consent. We use this information for the sole purpose of sending you notifications when new posts are published (typically about once per week). Every email we send includes a one-click link to unsubscribe, and you may withdraw your consent and stop receiving these emails at any time. We do not use the subscriber list for any other purpose. We do not sell or rent it, and we share it only with the service providers named below that send and store it for us.
Information Collected Automatically
When you visit the Website, certain information is collected automatically through standard server operations, our own Website analytics, and our third-party service providers:
- Server Logs: Cloudflare, which hosts the Website, processes each request (including your IP address, browser type and version, operating system, the page requested, the referring page, and the date and time) to deliver the page and protect the Website.
-
Cloudflare: Our Website uses Cloudflare, Inc. ("Cloudflare") for content delivery, performance optimization, and security services. In the course of providing these services, Cloudflare may process your IP address, HTTP request headers (including user agent and referrer), traffic routing data, and browser characteristics for bot detection and threat mitigation purposes. Cloudflare sets the following strictly necessary cookies on your device:
These cookies are classified as strictly necessary for Website operation, do not track you across other websites, and do not correspond to any user ID or profile. No opt-in consent is required for strictly necessary cookies under California law.
Cloudflare Turnstile: Pages with a contact form or newsletter sign-up form load Cloudflare Turnstile, a security check that confirms a submission comes from a person rather than a bot. Turnstile processes signals such as your IP address, your browser's user-agent string, technical details of your connection, and the website it runs on. Cloudflare uses these signals to run the check for us and, under its Turnstile Privacy Addendum, also to improve its bot detection, for which Cloudflare acts as an independent controller. Cloudflare states that it does not collect these signals to identify, profile, or target anyone.
For more information about how Cloudflare processes data, please review Cloudflare's Privacy Policy and its Turnstile Privacy Addendum.
- Website Analytics: We use Counterscale, open-source analytics software that we run on our own Cloudflare account at stats.penwell.law, to understand how visitors find the Website and which pages they read. It runs on the Website's public pages, not in the Client Portal. For each page view, it records the date and time, the page visited, the website that referred you, any campaign tags in the link you followed (such as "utm_source"), your approximate country, and your browser's user-agent string, from which it derives your browser, its version, and your device type and model. It also records whether the page view is your first, second, or a later page view on the Website that day, which tells us how many visits were new and how many ended after one page. To keep that count, your browser stores a date sent by our analytics server in its ordinary cache, and the count starts over at midnight Coordinated Universal Time. A click on our email address, copying our email address as text, a click on one of the practice cards on the home page, and a contact form message that was sent successfully are each recorded the same way, as a view of a placeholder page. None of these records includes anything you typed, copied or wrote. To count a practice-card click, your browser holds the name of the card in that tab's session storage until the next page loads, which reads and deletes it; the browser also clears it when the tab closes. Counterscale removes the part of a page address or referring address after a "?", keeping only those campaign tags and, when your browser does not report a referring website, a "ref" or "source" tag in the link, which it records as the referrer. It does not store your IP address, set cookies, use local storage (apart from the brief session-storage entry just described), combine browser details into an identifier for you, or track you across other websites. We use this information only to understand the Website's traffic as a whole, and we do not combine it with contact form submissions or any other information that identifies you. It does not include personally identifiable information. We do not sell it or share it with anyone other than Cloudflare, which stores it for us and deletes it automatically three months after it is recorded.
- Google Fonts (Client Portal pages): Pages in the Client Portal currently load typefaces from the servers of Google LLC, so your browser sends your IP address and user-agent string to Google when those pages load. Google's use of that information is governed by Google's Privacy Policy. The Website's public pages use typefaces we host ourselves and make no such request.
- Cloudflare Web Analytics: The Website also uses Cloudflare Web Analytics, which measures page views and page-load performance. Cloudflare states that, for analytics purposes, it does not use cookies or local storage and does not track visitors over time by IP address or user-agent string, that it does not track individual users across other websites, and that it does not log the query strings of page addresses. We receive only traffic totals from it.
Client Portal Activity and Communications
If we engage you as a client and provide you with access to our Client Portal, we maintain a record of your portal activity and our email correspondence with you, distinct from and in addition to the temporary server logs described above. This record includes:
- The date, time, IP address, and device/browser information associated with each portal sign-in and each page you view within the portal (for example, your dashboard, an invoice, or a statement of work)
- The full content, timestamps, and delivery status of transactional emails we send you in connection with your engagement, including invoice and payment reminder emails, statement-of-work and fee agreement notices, and account-related emails
Unlike the ephemeral server and edge logs described above, this record is retained as part of our client file and is not automatically deleted. We maintain it to document the course of an engagement, to confirm that required notices and disclosures were actually delivered and reviewed, and to have an accurate record available should a billing or engagement-related dispute ever arise.
How We Use Your Information
We use the information we collect for the following purposes:
- To respond to your inquiries submitted through the contact form
- To send new-post notifications to subscribers who have opted in to our newsletter, until they unsubscribe
- To evaluate potential conflicts of interest in connection with prospective legal engagements
- To maintain internal records for conflict-checking and business administration
- To operate, maintain, and secure the Website
- To understand, in aggregate, how visitors find the Website and which pages they read
- To comply with applicable legal and ethical obligations
- For clients with Client Portal access, to maintain a record of portal activity and email correspondence documenting the course of the engagement, confirm delivery of required notices, and support billing or engagement-related recordkeeping
We do not use your information for behavioral advertising, user profiling, or automated decision-making.
How We Share Your Information
We do not sell, rent, or trade your personally identifiable information to third parties for their marketing purposes. We may share your information with the following categories of third parties, solely as necessary to operate the Website and our law practice:
- Cloudflare, Inc.: As described above, for content delivery, security, and Website performance services, for Cloudflare Web Analytics, and to store our Website analytics records, and for Cloudflare Turnstile. Cloudflare processes this information on our behalf, except that it also uses security signals, such as IP addresses, user-agent strings and connection details, to improve its bot and threat detection, as described in Cloudflare's own privacy terms.
- Google LLC: For Client Portal typefaces, as described above.
- Email Service Provider (Resend): Messages you send through the contact form, the newsletter emails we send to subscribers, and, for clients, Client Portal transactional emails (invoice and payment reminders, statement-of-work and fee agreement notices, sign-in codes, and other account-related emails) are transmitted through our email delivery provider, Resend (resend.com). Newsletter subscriber email addresses, and client transactional email records, are stored in a database hosted by Cloudflare on our behalf.
- Legal and Regulatory Authorities: We may disclose information if required to do so by law, subpoena, court order, or other legal process, or if we believe in good faith that such disclosure is necessary to comply with applicable law, protect our rights, or respond to a government request.
Cookies and Tracking Technologies
The Website uses only strictly necessary cookies set by Cloudflare, as described above. Our Website analytics set no cookies; they rely only on the browser-cache date and the brief session-storage entry described above. We do not use advertising cookies, cookies that track individual behavior, social media pixels, or any other cross-site tracking technologies.
Do Not Track Signals
Your browser may offer a "Do Not Track" ("DNT") setting. Because the Website does not engage in cross-site tracking of individual users, the Website's behavior does not change in response to DNT signals. We do not allow any third party to collect information about your activity on this Website for advertising, or to build a profile of you across websites. Cloudflare processes security data, such as IP addresses, across its network to detect bots and attacks, as described above.
Data Retention
We retain contact form submissions and related correspondence for as long as necessary to fulfill the purposes for which the information was collected, including to satisfy conflict-checking obligations under the California Rules of Professional Conduct and applicable legal retention requirements. Request data processed by Cloudflare is retained under Cloudflare's own retention practices. Cloudflare deletes Website analytics records automatically three months after they are recorded. Newsletter subscription information is retained until you unsubscribe; upon unsubscribing, your email address is marked as unsubscribed and no further newsletter emails are sent. Client Portal activity records and transactional email records described above are retained as part of the client file for the same period as other client file records (generally five years following the conclusion of the engagement, consistent with our file retention practices under the California Rules of Professional Conduct) and are not deleted on request during that period, as they may be needed to document the engagement or resolve a billing dispute.
Data Security
We implement and maintain reasonable administrative, technical, and physical security measures designed to protect the personally identifiable information we collect from unauthorized access, disclosure, alteration, and destruction, in compliance with California Civil Code § 1798.81.5. However, no method of electronic transmission or storage is completely secure, and we cannot guarantee absolute security.
Your Rights and Choices
Reviewing or Requesting Changes to Your Information
If you have contacted us, subscribed to our newsletter, or are a client, you may ask to see, correct, or delete your information by emailing liam@penwell.law. We will make reasonable efforts to respond to your request in a timely manner, subject to our legal and ethical obligations to retain certain records for conflict-checking and other professional responsibility purposes.
California Consumer Privacy Act (CCPA/CPRA)
The CCPA/CPRA applies to for-profit businesses meeting specific revenue and data-processing thresholds set forth in Cal. Civ. Code § 1798.140(d). We do not currently meet these thresholds. However, we respect your privacy rights. If you have questions about your personal information or wish to submit a request regarding your data, please contact us using the information provided below.
Children's Privacy
The Website is not directed to children under the age of 13, and we do not knowingly collect personally identifiable information from children under 13. If we become aware that we have inadvertently collected personal information from a child under 13, we will take steps to delete that information promptly.
Third-Party Websites
The Website may contain links to third-party websites or resources. We are not responsible for the privacy practices, content, or security of any third-party websites. We encourage you to review the privacy policies of any third-party websites you visit. The inclusion of a link on the Website does not imply endorsement of the linked site or its content.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes, we will update the "Last Updated" date at the top of this page and post the revised Privacy Policy on the Website. We encourage you to review this Privacy Policy periodically. If a change would let us use information we already hold in a materially different way, we will ask for your consent first.
Contact Information
If you have questions about this Privacy Policy or our data practices, you may contact us at:
1401 21st St #15596
Sacramento, CA 95811
Email: liam@penwell.law
Telephone: (650) 227-9152
State Bar of California No. 339157