Your privacy matters.
Last updated: October 19, 2026
This Privacy Policy explains how Broadleaf Services uses information from visitors to this website, its contact form, downloads, and the protected website administration area. Client IT services are also governed by the relevant service agreements.
Information you choose to share
If you contact us, we receive your name, email address, optional company name, and the message you provide. We use that information to answer your request, discuss services, and manage the resulting business relationship. Please do not send passwords, payment card details, or sensitive client records through the website form. To request the security checklist, provide your name, email address, and company. A phone number is optional. We store these details in a protected portal to provide the checklist, manage download requests, and record any request for service follow-up. You can get the checklist without agreeing to a follow-up; the optional checkbox is selected by default, and you can uncheck it before requesting your download. No automatic marketing emails or newsletter subscriptions are created. The PDF downloads to your browser. Answers entered into the PDF remain in your saved file; the PDF does not send those answers to Broadleaf.
Website traffic and security information
Our web server receives technical information such as your network address, request time, requested URL, response status, browser information, and referring website when your browser provides it. Operational web-server logs may contain full network addresses and requested URLs. We use those logs to operate, troubleshoot, and protect the site. Our separate traffic dashboard stores reduced information: page paths without URL queries, referral domains, approximate countries, browser and device categories, request outcomes, and daily visitor estimates. It uses a protected daily hash of network address and browser information instead of storing the full address or browser string in the analytics database. These estimates are pseudonymous, not a way to learn an anonymous visitor's name or email. We keep public traffic and protected staging activity separate.
Cookies, sign-in, and spam protection
The website traffic dashboard does not set analytics cookies or use advertising pixels. The protected portal uses a session cookie to keep authorized users signed in through Microsoft 365. Ordinary public visitors do not need a portal account. The contact form uses Cloudflare Turnstile and server-side checks to reduce spam and abuse. Cloudflare processes technical browser and network information for that security check. Depending on the security configuration, Cloudflare may use a security or clearance cookie. Short-lived protected records also support rate limits and duplicate-message prevention. Cookie settings in your browser may affect sign-in or security features.
Service providers and other disclosures
Amazon Web Services hosts the website and portal. Microsoft 365 handles administrator sign-in and delivery of contact inquiries to the Broadleaf team. Cloudflare provides the contact form's spam protection. These providers process information needed to deliver their services. Fonts may be requested from Google Fonts, which receives the technical information required to deliver them. Approximate country lookup uses a locally held DB-IP dataset; we do not send individual visitor addresses to DB-IP for that lookup. We do not use this website to sell visitor information or provide it to advertising networks. Information may also be shared when reasonably necessary to comply with law, protect rights and security, or respond to a valid legal request.
How long information is kept
Reduced website analytics records are retained for 90 days. Operational web-server and security logs follow separate log-rotation and operational retention practices. Contact-form anti-abuse records are periodically cleaned as the form is used. We retain checklist requests, inquiry correspondence and related business records for as long as needed to answer the request, provide requested services, maintain the business relationship, resolve disputes, and meet applicable recordkeeping obligations. The appropriate period depends on the purpose and circumstances; contact us if you have a question about a particular record.
Protecting information and processing locations
We use HTTPS, administrator access controls, and restricted backend storage to protect website information. Authorized people and service providers may access information where needed for the purposes described here. No website or transmission method can be guaranteed completely secure. Broadleaf Services operates in the United States, and this website is hosted on AWS in the United States. Our service providers may process information in the United States and other countries under their applicable service and privacy terms.
Your choices and privacy requests
You can browse the public website without providing contact details. The checklist download requires contact information, but requesting a service follow-up is optional. If you contact us, provide only information relevant to your request. A contact inquiry or download does not automatically enroll you in a marketing sequence. Depending on the law that applies to you, you may have rights to request access, correction, or deletion of personal information, or to object to certain uses. Contact Broadleaf through the Let's talk form or call (978) 362-0500 and identify your request as a privacy matter. We may need to verify your identity before responding. Some records may need to be retained for legal, business, or security reasons. Where applicable, you may also raise concerns with your relevant privacy regulator.
Updates to this policy
We may update this policy as the website, services, or applicable requirements change. The date above identifies the latest version. If we introduce optional marketing or additional tracking features, we will explain them and provide any choices or consent controls required before using them.
Questions about privacy? Contact Broadleaf or call (978) 362-0500.
Service provider information: Cloudflare privacy, Microsoft privacy, AWS privacy, and Google privacy.