PRIVACY POLICY
SUTOSCIENCE PRIVACY POLICY
Effective Date: August 5, 2026
Last Updated: September 25, 2026
amysuto.com is a product of Sutoscience, LLC (“Sutoscience,” “we,” “our,” or “us”). This Privacy Policy explains how we collect, use, disclose, and protect personal information when you use:
the amysuto.com website at www.amysuto.com,
and all associated services, forms, and tools.
We are committed to being transparent about our data practices. This policy is written in plain language so you can understand what we do with your information.
1. Who We Are
Legal Entity: Sutoscience, LLC
Formed In: Texas (registered in California)
Mailing Address: 2443 Fillmore Street, #288, San Francisco, CA 94115
Website: www.amysuto.com
Privacy Contact: amy@amysuto.com
2. Scope of This Policy
This policy applies to personal information we process when you:
Submit a contact, inquiry, or booking form
Submit a preorder bonus claim and upload a receipt
Submit support requests, feedback, or bug reports
Opt in to optional marketing emails or our newsletters
Book a consultation, audit, or other service through our scheduling links
Visit our website and interact with our content
This policy does not apply to third-party websites or other services that you access through links on our Site. Those providers have their own privacy policies, and we encourage you to review them.
3. Information We Collect
3.1 Information You Provide Directly
Contact and Inquiry Information:
Name
Email address
Phone number (if provided)
Any details you choose to include in your message, such as links to your website, Substack, or project
Communications:
Support requests and messages
Feedback, bug reports, and feature suggestions
Survey responses
Newsletter sign-ups and email preferences
Preorder Bonus Claims:
Name and email address
The retailer, book format, number of copies, and order number you enter
A copy of your receipt or order confirmation, uploaded as an image or PDF. Depending on the retailer, it may show details such as a billing or shipping address or the last four digits of a payment card. You are welcome to crop or cover anything beyond the book, the retailer, and the order date before you upload it
Whether you asked to join our newsletter
3.2 Information Collected Automatically
Usage Data:
Pages and features accessed
Feature interaction patterns
Device and Network Data:
IP address
Browser type and version
Device type and operating system
Referring URL
Approximate location inferred from IP address
Cookies and Similar Technologies:
Essential cookies and browser local storage for site preferences, including your cookie choice and your choice to load embedded maps and players
Analytics cookies set by Google Analytics, only if you click Accept on our cookie banner (see Section 7)
3.3 Information from Third-Party Services
Scheduling (Calendly): When you book a call or service through one of our scheduling links, Calendly collects your name, email address, and any booking details you provide, and shares them with us so we can hold your appointment. If a booking requires payment, Calendly and its payment partners process it. We do not receive or store your full credit card number, CVV, or bank account details.
Reader programs and surveys (Typeform): When you apply to be a beta reader or an ARC reader, or answer one of our surveys, the form runs on Typeform. Typeform collects the answers you give, such as your name, email address, reading preferences, and where you post reviews, and shares them with us so we can run the program you asked to join. Typeform processes that information under its own privacy policy.
3.4 Sensitive Personal Information
Messages and forms you submit may contain information you choose to include that could be considered “sensitive personal information” under the CCPA/CPRA, GDPR, or other laws. We recommend including only information that is relevant to your inquiry.
We process this information only to provide the services you requested. We do not use sensitive personal information to infer characteristics about you, target advertising, or for any purpose other than providing and securing the Site. Under California law, this means we are not required to provide a separate “right to limit” mechanism, because our use of sensitive personal information falls within the CCPA’s “necessary to provide the service” exemption (Cal. Civ. Code § 1798.121(a) and 11 CCR § 7027). You may still delete this information at any time by contacting us at amy@amysuto.com.
4. How We Use Your Information
Providing the Site and Our Services: operating the website, responding to your inquiries, delivering services you request, scheduling consultations, and verifying preorders so we can send the bonuses that go with them
Billing and Payments: processing payments for services through our third-party payment processors, managing invoices, fraud prevention
Communications: responding to support requests, sending transactional emails (such as confirming we received your message), service announcements
Optional Marketing Email: if you opt in, we use your email to send occasional product announcements, tips, and updates, including our newsletters
Product Improvement: analyzing usage patterns to improve features, fix bugs, and develop new functionality (using aggregated or de-identified data where possible)
Safety and Security: detecting abuse, unauthorized access, fraud, and policy violations
Legal Compliance: complying with applicable laws, regulations, court orders, and legal processes
5. How We Share Your Information
We do not sell your personal information. We share information only in the following circumstances: with service providers and processors who act on our behalf, for legal compliance and protection, in connection with business transfers, and with your direction or consent.
6. Data Retention
We retain your personal information only as long as reasonably necessary for the purposes described in this policy. Contact form submissions are delivered to us as email and kept for as long as we need them to respond to you and maintain records of our correspondence. Newsletter subscription data is managed by Substack and retained until you unsubscribe. Analytics and server log data are retained under the retention settings of the providers described in Section 14. Reader program applications and survey responses are kept for as long as the program or project they belong to is active and for a reasonable period afterward, unless you ask us to delete them sooner.
Preorder bonus claims are kept in private, access-controlled storage, and they also reach us as email. We delete the stored receipt file 90 days after the book’s release date, or 90 days after you send it if that is later. We keep the rest of the claim, meaning your name, email address, and order details, for up to 18 months after the release date so we can deliver and honor the bonuses that come with it, including memberships that run for a year. The copy that reaches our inbox is kept the same way as other correspondence, described above. You can ask us to delete your claim or your receipt sooner at any time by emailing amy@amysuto.com.
7. Cookies and Tracking Technologies
7.1 Essential Cookies and Storage
We use essential cookies and browser local storage to make the Site work and to remember your privacy choices. These are not used to track you. We set two items ourselves, both browser local storage entries that stay for 12 months. The first, as_cookie_consent, records whether you accepted or rejected analytics cookies, when you chose, and whether your browser sent a privacy signal. The second, as_embed_consent, is set only if you choose to load embedded content, and it records which providers you chose, such as Google Maps, and when (see Section 7.6).
7.2 Analytics Cookies Are Optional
Google Analytics helps us understand how visitors use the Site. It is optional and it is off by default. When you first visit, a banner asks whether you accept analytics cookies. Unless you click Accept, the Google Analytics script does not load, which means it sets no cookies and collects nothing. If you click Reject, it stays off. The banner works the same way for every visitor, wherever you are located.
If you click Accept, Google Analytics sets two first-party cookies, _ga and _ga_ followed by our property ID, each lasting up to 2 years, and collects usage information subject to Google’s privacy policy. We have configured it for measurement only. Advertising features, Google signals, and ad personalization are switched off, so your visit is not used to build advertising profiles or to target ads.
7.3 Changing Your Choice
You can change your choice at any time with the Cookie Settings link at the bottom of every page. If you switch to Reject, we stop Google Analytics and delete its cookies from your browser. We remember your choice for 12 months and then ask again. You can also use Google’s browser opt-out tool.
7.4 Global Privacy Control and Do Not Track
If your browser sends a Global Privacy Control (GPC) or Do Not Track signal, we treat it as a Reject. Google Analytics stays off and the banner does not appear. If you would still like to opt in, you can do so through the Cookie Settings link.
7.5 Cookieless Visitor Statistics
Our hosting provider, Vercel, gives us aggregate visitor statistics through Vercel Web Analytics. It uses no cookies, it does not follow you across websites or from one day to the next, and its data points are not tied to you as an individual. Because it does not rely on cookies or personal identifiers, it runs on every visit.
7.6 Embedded Content
Some pages include content served by other companies, such as YouTube videos, Google Maps, Spotify and Apple Podcasts players, Scribd documents, and Substack sign-up forms. When one of these loads, its provider receives your IP address and basic browser information, and it may set its own cookies under its own privacy policy, especially once you press play or interact with it. We load YouTube videos in YouTube’s privacy-enhanced mode. In that mode, YouTube says it does not store information about visitors unless they play the video.
Google Maps, Spotify, Apple Podcasts, and Scribd embeds stay off until you click to load one. That click loads every embed from the same provider on the page, and we remember your choice in the as_embed_consent entry described in Section 7.1, so that provider’s embeds load on their own on later pages for 12 months. To undo it at any time, use the button below or clear this site’s data in your browser.
7.7 No Advertising Cookies
We do not use advertising cookies, and we do not run third-party advertising on the Site. If you click an affiliate link (see Section 14), the website you visit may set its own cookies under its own policy.
8. Your Privacy Rights
8.1 Rights for All Users
Regardless of where you live, you can access, update, correct, delete, and export your information, and withdraw consent for optional processing.
8.2 California Residents — CCPA/CPRA Rights
Right to Know/Access, Right to Delete, Right to Correct, Right to Opt Out of Sale/Sharing (see Sections 5 and 9), Right to Limit Use of Sensitive Personal Information, and Right to Non-Discrimination.
8.3 EEA, UK, and Swiss Residents — GDPR/UK GDPR Rights
Access, rectification, erasure, portability, restriction, objection, withdrawal of consent, and the right to lodge a complaint with a supervisory authority. Legal bases: contract performance, legitimate interests, consent, and legal obligation. International transfers rely on Standard Contractual Clauses (and the UK Addendum where applicable), or on a provider’s certification under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions where one exists. We do not make decisions about you by automated means, including profiling, that produce legal or similarly significant effects.
8.4 How to Exercise Your Rights
Submit requests via email at amy@amysuto.com or by mail to Sutoscience, LLC, 2443 Fillmore Street, #288, San Francisco, CA 94115. We will respond within 45 days (CCPA) or 30 days (GDPR/UK GDPR), extendable to 90 days with notice.
9. Do Not Sell or Share My Personal Information
Sutoscience does not sell your personal information for monetary consideration and does not share it for cross-context behavioral advertising purposes. Because of that, there is no sale or sharing for you to opt out of. We still honor Global Privacy Control signals as described in Section 7.4.
10. Email Communications
We send transactional/service email (for example, a confirmation that your message reached us) and optional marketing email (opt-in, or opt-out where permitted, with an unsubscribe link in every message).
11. Children’s Privacy
amysuto.com is intended for users who are at least 18 years old (or the age of majority in their jurisdiction). We do not knowingly collect personal information from anyone under 16 years of age.
12. Data Security
We implement administrative, technical, and organizational safeguards, including encryption in transit and at rest, access controls, authentication, vendor security review, and monitoring, and we provide data breach notification as required by law, including GDPR/UK GDPR’s 72-hour window where applicable.
13. International Users
amysuto.com is operated from the United States. Personal information from users outside the U.S. is transferred to, stored, and processed in the United States, subject to the safeguards described in Section 8.3.
14. Third-Party Services
Key third-party services integrated with amysuto.com:
Vercel: hosts the Site, processes standard server logs (such as IP addresses) in order to serve it, provides cookieless aggregate visitor statistics (see Section 7.5), and stores preorder bonus claims and uploaded receipts in private file storage that only we can read
Resend: delivers the messages you submit through our contact forms, and your preorder bonus claim with its receipt, to us by email. It also sends the confirmation or bonus email you receive
Google Workspace: our business email. Messages, claims, and receipts that reach us as email are received and stored there
FormSubmit: backup delivery for contact form messages if our primary email delivery is unavailable
Substack: hosts our newsletters. If you check the box to join a newsletter, your email address is shared with Substack
Google Analytics: helps us understand how visitors use the Site, and loads only if you accept analytics cookies (see Section 7.2)
Embedded content providers: YouTube, Google Maps, Spotify, Apple Podcasts, Scribd, and Substack serve the players, maps, documents, and sign-up forms embedded on some pages (see Section 7.6)
Calendly: handles scheduling and payment when you book a consultation or service (see Section 3.3)
Typeform: runs the application forms and surveys for our beta reader and ARC reader programs (see Section 3.3)
Some posts on this Site contain affiliate links, including Amazon and Bookshop.org affiliate links and referral links for travel, software, and business tools. As an Amazon Associate, Sutoscience earns from qualifying purchases. A post that contains affiliate links says so at the top of the post. If you click an affiliate link, the website you visit may set cookies or collect information under its own privacy policy.
15. CCPA Category Disclosure
Categories collected/disclosed in the preceding 12 months: identifiers, customer records, commercial information, internet/network activity, geolocation data, inferences, and sensitive personal information voluntarily provided. Not sold or shared for cross-context behavioral advertising.
16. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be preceded by at least 30 days’ notice via email and/or a prominent notice on the Site.
17. Contact Us
Sutoscience, LLC
2443 Fillmore Street, #288
San Francisco, CA 94115
Privacy, support, and legal inquiries: amy@amysuto.com