Bedrock Leverage
← Back to home

Bedrock Leverage

Privacy policy

Clear information about your data, your choices and how we handle privacy.

Last updated: 9 October 2026

1. Who is responsible

Bedrock Leverage is responsible for the personal data it processes for this consultancy website and its own business enquiries. This notice covers the website, the AI foundations check and business enquiries. It does not replace the privacy information provided by clients for their own services or systems.

Legal entity operating Bedrock Leverage
Bedrock Leverage
Registered or business address
High Tech Campus 5
Privacy contact email
info@bedrockleverage.com

For privacy questions or requests, email info@bedrockleverage.com.

2. Information we handle

When you browse

Your browser requests pages, images and fonts from the hosting service. Serving these requests exposes technical information such as your IP address and request details to that service. IP addresses can be personal data. The hosting service may also process information to secure access to this private preview; its precise logging and retention arrangements remain to be confirmed.

Language suggestions based on your country

When no saved language choice is available and you visit an English page, your browser contacts api.country.is to estimate your country from your IP address. The service receives your IP address and ordinary technical request information. We send no form entries, cookies or page referrer and request no precise location. The returned country is used only to suggest an available language; we do not store your IP address or country. IP-based location can be inaccurate, for example when using a VPN. You remain free to choose your language.

We use this limited country check to make the website easier to use, based on our legitimate interest in offering relevant language options. Your explicit language choice is remembered so we can respect it on later visits. You can change it in the header or remove the preference through your browser’s site-data settings. If the location service is unavailable, the website still works and the language menu remains available.

When you submit the contact form

The form collects your email address, required phone number, selected topic and message. When you submit it, our Vercel server validates the entries and sends them through Resend to our Google Workspace mailbox so we can respond. The form does not automatically book an appointment or subscribe you to marketing.

When you use the AI foundations check

The current check calculates its result in your browser. Your individual answers are not sent to an AI service, a CRM or Analytics, and are not stored in browser storage. With statistics consent, we record that the check was started, completed or restarted; the answers and result remain outside those events.

When you contact us directly

If you communicate with us by email, the correspondence may contain your contact details, organisation, role and information you choose to share. Please avoid sending passwords, sensitive personal information or identifiable client and employee records in an initial enquiry.

3. Purposes and legal grounds

Simply visiting this website is not consent to marketing or unrelated uses of your data.

  • Operating and protecting the website: where we process technical data for this purpose, the relevant interest is maintaining a reliable and secure service.
  • Responding to direct business enquiries: the relevant basis is our legitimate interest in answering business contacts, or taking steps you request before entering a contract with you personally, depending on the circumstances.
  • Meeting legal obligations: where a specific record must be kept or disclosed by law, that obligation is the basis.

The website does not add visitors to a mailing list. Optional statistics, visit recordings and ChatGPT advertising measurement rely on your consent, as explained below.

4. Cookies and analytics

Our cookie banner lets you accept or refuse optional measurement: visitor statistics, heatmaps, visit recordings and ChatGPT advertising results. These optional measurements stay off until you give permission. You can refuse optional tracking and still use the website, or change and withdraw your choice using Cookie settings in the footer.

Statistics: Google Analytics 4 and Tag Manager

With your permission, Google Analytics 4 receives page visits, the referring website, campaign information, device and approximate location information, clicks, separate contact-intent events for telephone and WhatsApp links, scroll milestones, visible time per section and completion events for the contact form and AI foundations check. Google Tag Manager manages the Google tags. Visible time indicates that content was on screen while the page was active; it does not measure eye movements or prove that text was read. We do not send names, email addresses, telephone numbers, messages or individual check answers to Analytics.

Heatmaps and visit recordings: Microsoft Clarity

With your permission, Microsoft Clarity collects page interactions such as clicks, scrolling and pointer movements to create heatmaps and reconstruct visits. Pages containing forms, including the contact form and AI foundations check, are excluded from recordings so that individual selections cannot be reconstructed. Private client portals and client presentations are also excluded. Ordinary playback data is retained by Clarity for 30 days; heatmap data and labeled or favorited recordings can be retained for 9 months.

ChatGPT advertising: OpenAI Measurement Pixel and Conversions API

With your permission, the OpenAI pixel measures page visits, successfully delivered contact-form enquiries and clicks on telephone and WhatsApp links so we can understand results from our ChatGPT ads. Link clicks are counted as contact requests and separately identified by channel; they do not confirm that a call connected or a WhatsApp message was sent. Automatic advanced matching is enabled for this pixel: the SDK can detect contact details entered in forms and hash them in your browser before using them for matching. Hashed identifiers can still be personal data. We do not manually add form contents to pixel events. The server integration, when configured, sends events only for successful contact-form delivery, available attribution/browser references and SHA-256 hashes of the submitted email address and valid telephone number for matching. It does not send message text or raw contact details. For contact-form enquiries, browser and server events share an identifier so the same enquiry can be deduplicated. Telephone and WhatsApp link clicks are measured only in the browser. We opt these events out of future user-level personalization.

The pixel may set __oppref for 30 days and __obref for 365 days. These are attribution and browser references. Revoking permission stops measurement and removes the accessible pixel identifier cookies. See OpenAI’s measurement documentation and OpenAI’s privacy policy. Advertising measurement was added as a new purpose; earlier analytics-only consent does not enable it.

Aggregate arrival and consent counts

We also keep daily totals of incoming requests for public website pages and choices in the cookie banner. These counts use predefined campaign and ad labels and the states accepted, rejected or undecided. Our counters do not store IP addresses, browser fingerprints, visitor or click identifiers, full URLs, contact details or individual browsing histories. Private portals, presentations, known bots and marked internal or test visits are excluded. These totals are stored privately with Vercel and are separate from Google Analytics, Clarity and advertising attribution. They count requests and choices, not unique people or proof that a page was read.

While statistics permission is absent, campaign labels may remain in links to other public pages on this website. After permission for statistics, we can retain these labels in session storage under bedrock-campaign-v1 for up to 30 minutes of inactivity. We remove this storage when you refuse or withdraw permission. A first-party bedrock_internal preference can exclude staff and test browsers from measurement for up to 180 days; it contains only an exclusion flag.

Cookies, preferences and withdrawal

We remember your choice in local storage under bedrock-consent-v1 for up to 180 days. Google Analytics may set _ga and _ga_* cookies to distinguish visits; we configure them for a lifetime of up to 180 days. Clarity may set _clck and _clsk cookies to connect interactions and page views. See the providers’ current inventories for their other cookies: Google Analytics cookies and Microsoft Clarity cookies. When you withdraw permission, the page reloads without the affected trackers and removes their accessible first-party cookies. Data already received by providers is not deleted by withdrawing consent; you can contact us about deletion.

Google, Microsoft and OpenAI process this information under their service and privacy terms and may process it outside the European Economic Area. Read Google’s privacy policy and Microsoft’s privacy statement. Fonts and website images are served with the website.

5. Service providers and international transfers

Vercel hosts the website and processes contact submissions. Resend delivers the messages to our Google Workspace mailbox. The sending region configured in Resend is EU (Ireland); this does not mean all processing by every provider takes place exclusively in the EU. We do not connect form submissions to a CRM, booking system or AI service.

Country.is provides the country lookup. Its published documentation states that it does not log requests. This is the provider’s statement, not an independent verification of its infrastructure or processing locations. The legal provider details, processing locations and any applicable transfer safeguards still need to be confirmed before public launch. Country.is documentation

If personal data is transferred outside the European Economic Area, the applicable destination and transfer safeguards will be identified. We will not describe all processing as EU-only without verifying that this is the case. Depending on the destination, safeguards may involve an adequacy decision or standard contractual clauses and any necessary additional measures.

This preview does not sell visitor data or share it with advertising networks. Following an external link takes you to a service with its own privacy practices.

6. Retention and security

Contact submissions are retained as email correspondence in our mailbox and may also be processed in delivery records by our email provider. The website does not create a separate contact database. AI foundations check answers remain in your browser.

For direct correspondence, retention should be limited to the time needed to answer the enquiry, manage an ongoing relationship and meet applicable legal requirements. A confirmed schedule for enquiries, client records and hosting logs must be recorded before launch; no unverified fixed period is promised here.

Contact submissions use HTTPS, server-side validation and restricted mailbox access. No website or communication method can guarantee absolute security.

7. Your privacy rights

Depending on the processing and applicable conditions, you may request access, correction, deletion, restriction or a portable copy of your personal data. You may object to processing based on legitimate interests, and to direct marketing at any time. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing.

Requests normally receive a response within one month. A complex request may require up to two additional months; we must explain an extension within the first month. We may ask for proportionate information to verify identity, rather than an unnecessary copy of an identity document.

You may complain to the Dutch Autoriteit Persoonsgegevens or another competent supervisory authority. You do not have to contact us first.

8. AI and client projects

The website’s foundations check is a browser-based questionnaire, not a decision system that produces legal or similarly significant effects. It does not send your answers to a generative AI model.

Client implementation projects need separate privacy arrangements. Before personal data is used in a project, the parties must establish the purpose, legal basis, controller and processor roles, permitted access, providers and retention. This website policy does not itself authorise model training or reuse of client data.

9. Children and changes to this policy

Our services are aimed at business professionals. The website does not offer services specifically intended for children.

We will update this notice when the website or its processing changes. The date above identifies the latest revision.