Privacy policy

Who this is

VulcanAX is the trading name of Ceiling Search LLC, an Ohio limited liability company based in Columbus, Ohio, United States. Ceiling Search LLC is the party responsible for the personal information described here. Throughout this page, "VulcanAX", "we", and "us" mean Ceiling Search LLC.

Questions, requests, and complaints about privacy go to one place: matthew@vulcanax.com. The practice is run by one person, so that address reaches the operator directly rather than a support queue.

What this policy covers

This policy covers vulcanax.com and the enquiries that arrive through it. It also describes, in general terms, how client data is handled during a paid engagement. It does not override any signed agreement: where a master service agreement or statement of work sets different terms for a specific client, that contract governs the work it describes.

Information you give us

There are three ways to volunteer information on this site, and all three are things you actively choose to do:

• The contact form. It asks for your name, your email address, and your message. Nothing else is required, and there are no hidden fields collecting anything beyond a spam honeypot and a label identifying which form was used.
• Email. Writing to matthew@vulcanax.com directly gives us whatever you put in the message, including your address and any signature or attachments.
• The booking calendar. Scheduling a call goes through an embedded third-party scheduler and typically involves your name, email address, and chosen time.

If you are enquiring on behalf of a dealership or agency, most of what you send is business contact information rather than personal information about you as an individual. We treat it carefully either way.

Information collected automatically

This site runs two analytics tools: Vercel Web Analytics, which measures without cookies, and Google Analytics, which sets first-party cookies so that a returning browser can be counted once rather than as a new visitor every time. Google's advertising features (Google signals and ad personalization) are switched off in the tag itself. There is no advertising pixel or remarketing tag, and no cross-site tracker or third-party cookie anywhere on vulcanax.com. What is collected is:

• Page analytics. Page views, referring source, approximate location, and general device and browser type. Google Analytics discards IP addresses at collection rather than storing them, and none of this is tied to a named individual.
• Interaction events. Anonymous counters recording that a call-to-action was clicked, a table of contents link was used, how far down a page a visit scrolled, and that a contact form was submitted. These record the event and the page path only. They do not include your name, your email address, or your message.
• Server logs. Our host records ordinary request data such as IP address, timestamp, and user agent, as any web server does, for delivery, security, and abuse prevention.

Cookies and local storage

Google Analytics sets two first-party cookies on vulcanax.com, _ga and _ga_P2C5Z2PKLK. They hold a random identifier, not your name or email, so that Google Analytics can tell a returning browser from a new one. They are set by this domain only, are not shared across other sites, expire after two years, and are removed when you clear your browser's cookies. Beyond those, the only thing this site stores in your browser is a single local-storage entry named vx-theme, which remembers whether you chose the light or dark version of the page; it holds one word and is never transmitted to us. There is no consent banner because we run no advertising trackers and do not sell or share personal information. If your browser sends the Global Privacy Control signal, Google Analytics is not loaded and no cookie is set.

Who else receives information

We do not sell personal information, we have never sold personal information, and we do not share it with advertisers or data brokers. A small number of service providers process data on our behalf so the site can function:

Provider	Purpose	What it receives
Vercel	Hosting and cookieless analytics	Request logs, aggregate visit data
Google (Google Analytics)	Traffic and referral analytics	Page views, referring source, device and browser type, and a random cookie identifier; IP addresses are not stored
Web3Forms	Delivering contact form submissions to our inbox	Name, email, message
Reclaim.ai	Embedded call booking	Name, email, chosen time
Email provider	Receiving and storing correspondence	Message contents

The booking calendar is loaded inside a frame from the scheduling provider and only after you scroll to it or interact with the page. Anything you enter into that frame is handled under that provider's own privacy policy. Beyond the providers above, we disclose personal information only where the law requires it, or where it is necessary to establish or defend a legal claim.

How the information is used

• To answer your enquiry and, where relevant, to scope and quote work.
• To schedule and hold calls you asked for.
• To carry out and improve engagements already under contract.
• To understand which pages and topics are useful, in aggregate.
• To keep the site secure and to prevent spam and abuse.

We do not run marketing email campaigns from this site. Submitting the contact form does not subscribe you to anything. If you get a reply, it is a person replying to your message.

Client data during an engagement

Paid work usually means being granted access to systems a client already owns: analytics properties, Google Search Console, a content management system, a dealer platform, or a business profile. In those systems VulcanAX acts on the client's instructions, and the client remains responsible for the underlying data.

Access is requested at the lowest level that lets the work get done, is used only for that work, and is handed back or revoked at the end of the engagement on request. Client materials, performance figures, and audit findings are treated as confidential and are not published, resold, or used as public case studies without written permission.

How long information is kept

Enquiries and correspondence are retained while a conversation is live and for a reasonable period afterwards, so that context is not lost if you come back later. Records connected to a paid engagement are kept for as long as the business relationship lasts and afterwards where tax, accounting, or legal obligations require it. Analytics data carries no name or contact detail. Google Analytics holds event-level data for a limited retention window set on the property, and only aggregate reporting survives beyond it. If you want your enquiry deleted sooner, ask and it will be.

Security

The site is served over HTTPS with HSTS, a strict content security policy, and standard protective response headers. The content security policy restricts the site to loading resources from its own origin plus the named providers above, which is why there is no room for a stray tracker to appear. Fonts are self-hosted rather than pulled from a third party. No method of transmission or storage is perfectly secure, so please do not send sensitive personal data, credentials, or payment details through the contact form.

Your choices and rights

Depending on where you live, you may have the right to request a copy of the personal information we hold about you, to have it corrected, to have it deleted, to object to or restrict how it is used, and to be free from discrimination for exercising any of those rights. Since we do not sell personal information, there is nothing to opt out of on that front.

To exercise any of these, email matthew@vulcanax.com and describe what you want. We will need enough information to find your records and to be reasonably confident you are who you say you are. There is no charge, and we aim to respond within thirty days.

Global Privacy Control is honoured: if your browser sends it, Google Analytics is not loaded and no analytics cookie is set. Cookieless Vercel measurement, which stores nothing in your browser, still runs. The older Do Not Track header is not treated as an opt-out, because most browsers have dropped it; GPC is the signal that works here, and blocking cookies in your browser works too.

International visitors

VulcanAX is based in the United States and serves clients in the United States. The site is hosted on infrastructure in the United States, so information collected here is processed there. If you are visiting from outside the United States, you are sending your information to a jurisdiction whose data protection laws may differ from your own.

Children

This is a business-to-business site with no audience among children. We do not knowingly collect personal information from anyone under 16. If you believe a child has sent us information, email us and it will be deleted.

Changes to this policy

If this policy changes, the updated version is posted here and the "last updated" date at the top changes with it. Material changes will be described plainly rather than buried. Continuing to use the site after an update means the revised policy applies.

Contact

Ceiling Search LLC, doing business as VulcanAX
Columbus, Ohio, United States
matthew@vulcanax.com

See also the terms of use.