Privacy policy

Brixton Infrastructure is an independent energy advisory practice based in Los Angeles, California. This policy uses the practice to refer to that business and this site to refer to brixtoninfrastructure.com.

This policy covers the information the website collects. It does not cover information you give us in the course of an engagement, which is governed by the engagement documents; and it does not cover sites you reach by following a link from here, including our scheduling page, which is addressed in section 07.

Almost everything this site collects is business contact information, given voluntarily by someone asking about advisory services. We do not run consumer marketing, we do not build behavioral profiles, and we do not buy contact data from list brokers.

Three forms on this site collect personal information.

The organization type and service interest fields are fixed lists. The values you can choose are the ones shown on the form. The message field is the only place on this site where you can type something we have not asked for, so it is the only place where information beyond business contact details can reach us. Please do not put confidential or sensitive information in it.

The record we keep of an inquiry holds only what you typed. It has no field for an IP address and no field for a browser user agent, so neither is written to it. That is a deliberate design decision, taken when the database was specified: a record that never held your IP address cannot leak it.

Apart from the analytics cookies described in section 05, the pages of this site set no cookies. They write nothing to local storage or session storage in your browser, enforced by an automated test. The automated test loads every public page, watches for any storage access, and fails the release if it finds one.

We use no advertising pixels, no fingerprinting scripts, no session recording, and no cross-site trackers. There is no advertising on this site and no advertising network is given access to it.

This site is hosted on Cloudflare and every request to it passes through Cloudflare's network. In delivering and defending the site, Cloudflare processes technical data about each request, including the IP address it came from, the URL requested, and standard request headers. That processing happens whether or not you fill in a form, it is necessary for the site to work and to resist attack, and it is governed by Cloudflare's privacy policy.

Every public form on this site is protected by Cloudflare Turnstile, a bot check. When you submit a form, a token from that check and the IP address of your request are sent to Cloudflare for verification. What comes back to us is a pass or a fail; a failed check stops the submission before anything is stored. The IP address used for that verification is not written to our database. The Turnstile widget is served by Cloudflare and may set strictly necessary cookies or equivalent browser storage on the pages that carry a form, for security purposes only.

Our own store of inquiries therefore holds no IP addresses, while the infrastructure the site runs on necessarily processes them. Both of those are true at once.

This site uses Google Analytics 4 to measure how the site is used. Google Analytics sets cookies in your browser and collects usage data, including pages viewed, device and browser characteristics, and an approximate location derived from IP address. That collection is governed by Google's privacy policy.

Two events are instrumented, and no others will be added without revising this page. The first records a click on a link to our scheduling page. The second records a successful email submission for a gated asset. Neither event carries your name, your email address, or the contents of any form field; each records that the action happened and where on the site it happened.

You can stop Google Analytics from running in your browser, on this site and on every other site, by installing Google's opt-out browser add-on. Blocking it does not affect your use of this site; the forms and the scheduler work either way.

We use what the site collects for these purposes and no others:

• To respond to your inquiry and to have the conversation you asked for.
• To judge whether the practice is the right fit for what you are trying to do.
• To deliver the gated asset you requested.
• To send market notes and related correspondence to people who asked to receive them.
• To keep an internal record of who approached the practice, when, and about what.
• To protect the site and the inquiry channel from automated abuse.
• To meet our legal and record-keeping obligations.

We do not use your information for automated decision-making, we do not score or rank you, and we do not use the contents of a message for anything other than answering it and keeping the record of it.

We do not sell personal information and we do not share it for cross-context behavioral advertising. We disclose it only to the service providers that operate this site, and only so that they can perform the function listed against their name.

When you follow a scheduling link from this site, you leave it. Whatever you enter on the scheduling page is collected by Microsoft on Microsoft's systems under Microsoft's privacy statement, and reaches us as a calendar booking. We do not control that page's data practices, and this policy does not extend to them.

We may also disclose information where the law requires it, in response to a valid legal process, or where it is necessary to establish or defend a legal claim. If the practice is ever sold, merged, or reorganized, the inquiry records could transfer as part of the business; we would say so here before it took effect.

Brixton Infrastructure is a United States business and its service providers are United States companies; information submitted through this site is processed in the United States, and may pass through infrastructure those providers operate in other countries in the course of delivering the site.

We keep personal information for 48 months from the day we collect it, and then we delete it. That period runs from the date of your submission: an inquiry sent through the contact form is deleted 48 months after it arrives, and an address given through the subscribe form or a gated download is deleted 48 months after it is given. A submission we judge to be spam is marked as spam and deleted sooner: an inquiry 90 days after it arrives, and a subscription or download address on the next nightly run after it is flagged.

The deletion is automatic and permanent. A scheduled task runs once every day, finds every record that has passed its retention period, and deletes it; nobody has to remember to run it, and there is no point at which someone decides to keep a record longer. The row itself is deleted; nothing is hidden, flagged, or moved to an archive in its place. Because the task runs on a daily cycle, a record is deleted within a day of passing the 48-month mark.

We keep a record of the deletions themselves. Each time the scheduled task runs it writes one line to a log: the date it ran, the cutoff date it used, and how many inquiry records and how many subscription records it removed. It writes that line whether it removed a hundred records or none. That log holds counts and dates and nothing else. It carries no name, no address, no organization, no message text, and no reference number that could lead back to a record or to a person, so there is nothing in it about you. We keep it because a promise to delete on a schedule is only as good as the evidence that the schedule is kept. For that reason the log is not itself deleted at 48 months along with the records it counts.

What that task reaches is the live database this site reads and writes. We also take backups of that database for recovery, and the task does not reach into them, so a backup taken before a record expired still contains it. We do not use a backup to bring back a record the retention period has removed.

Published market notes, case studies, and other writing on this site are not covered by any of the above. They are the practice's own business content, and no retention schedule applies to them.

48 months is an outer limit. If you want an inquiry record or a subscription record deleted sooner, ask us and we will delete it. Section 10 explains how to ask.

The California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives California residents the following rights. We extend them to everyone who contacts us through this site, wherever they live.

• To know. What personal information we have collected about you, where it came from, why we collected it, and who we disclosed it to.
• To delete. Deletion of the personal information we hold about you, subject to the narrow exceptions the statute allows.
• To correct. Correction of personal information about you that is inaccurate.
• To opt out of sale or sharing. The right to direct us not to sell your personal information or share it for cross-context behavioral advertising.
• To limit the use of sensitive personal information. The right to restrict use of the categories the statute defines as sensitive.
• To non-discrimination. The right not to be treated differently for exercising any of the above.

We do not sell personal information and never have. We do not share personal information for cross-context behavioral advertising. There is no Do Not Sell or Share My Personal Information link on this site, because there is nothing behind it to switch off. For the same reason, the site does not act on Global Privacy Control or Do Not Track signals; there is no sale or sharing for such a signal to stop. If that ever changes, this policy and the site will change with it, in that order.

We do not collect sensitive personal information as California law defines it. No field on this site asks for it, and we ask you not to volunteer it in the message box.

In the statutory categories, what this site collects is: identifiers, being your name, email address, and phone number; professional or employment-related information, being your organization's name and type; and, to the extent you choose to write it into the message box, commercial information about the arrangement you are asking about. When analytics is enabled, the site will also collect internet or network activity information. We collect none of the other categories.

Send any privacy request, and any question about this policy, through the contact form. That form is the practice's published channel for everything. This site renders no email address anywhere, by design: publishing one would feed it to the harvesters that scrape published pages, and a request sent through the form arrives in the same place as any other inquiry and is seen by the same person.

Say in the message what you want done: a copy of what we hold, a correction, or deletion. Give us enough detail to find the record; the email address or organization name you originally used is usually enough. We will confirm that the request comes from the person the record concerns, or from an authorized agent acting on their behalf, before acting on it, and we will use the information you give us for that confirmation and nothing else.

We respond within 45 days of receiving a verifiable request. If we need the extension California law permits, we will tell you within that period and explain why. Making a request costs nothing, and we will not treat you differently for having made one.

The practice serves the United States market and this site is directed at it. If you contact us from outside the United States, the information you send will be processed in the United States, where privacy law differs from the law where you live.

Where the General Data Protection Regulation or the UK GDPR applies to a submission, our basis for processing an inquiry is our legitimate interest in answering a message addressed to us, and our basis for a subscription is your consent, which you may withdraw at any time. Rights of access, rectification, erasure, restriction, objection, and portability can be exercised through the route described in section 10. You also retain the right to complain to your supervisory authority.

This site is not directed to children. The practice advises organizations on energy procurement and risk; nothing here is offered to individuals under 16, and we do not knowingly collect personal information from them. We do not sell or share the personal information of consumers under 16, and we do not have actual knowledge of ever having collected any.

If you believe someone under 16 has submitted information through this site, tell us through the contact form and we will delete it.

Every submission travels over an encrypted connection. Database writes use bound parameters, so the text of a message is stored as text and can never be executed as a database instruction. Every public form is verified on the server before anything is written, so a submission that fails the bot check leaves no record at all. The internal interface that reads inquiries is not reachable from this site. It sits behind identity-based access control.

No system is beyond compromise, and we will not claim otherwise. The protection we rely on most is the one described in section 03: information that was never collected cannot be exposed. The inquiry record is small on purpose.