Privacy Policy

Effective date: 9.8.2026

Who we are: Bull Moose Consulting, LLC, a California limited liability company (“Bull Moose”, “we”, “us”). 2108 N St., Suite # 5923, Sacramento CA 95816. Privacy questions: info@bullmoose.co.

This policy explains what we collect when you visit bullmoose.co (including www.bullmoose.co), use our contact and newsletter forms, or join our talent network, and what we do with it. If you are a candidate we represent or a client we work with, additional terms in our engagement agreements also apply.

1. What we collect

Information you give us

Contact form. Name, company, work email, the number of roles you are hiring for, funding stage, and anything you write in the message field.
Newsletter sign-up. Your email address.
Talent network and job applications. When you join our talent network or apply to a role through the jobs site at jobs.bullmoose.co/jobs, you provide your name, contact details, résumé or CV, work history, links (for example LinkedIn or GitHub), work-authorisation details, compensation expectations and any other information you choose to share. That site is operated on a third-party applicant-tracking platform (see section 4).
Correspondence. Anything you send us by email or through other channels.

Information collected automatically

Usage and device data. When the site loads, our hosting and content-delivery providers receive standard web-request data: IP address, browser type and version, operating system, referring page, pages viewed, approximate location derived from IP, and timestamps.
Analytics. We use Google Analytics 4 to understand how the site is used (pages visited, time on page, rough geography, device type). Google Analytics sets cookies (_ga, _ga_<id>) and processes IP addresses in truncated form. See section 5 on cookies and how to opt out.
Form and spam protection. Our forms record the time of submission to reject automated submissions; no other fingerprinting is used.

We do not collect payment card details on this site, and we do not knowingly collect information from anyone under 16.

2. How we use it

We use the information described above for the purposes below. Where the GDPR or UK GDPR applies, the legal basis for each purpose is given.

To respond to your enquiry and discuss a potential engagement, using contact-form data and correspondence. Legal basis: steps prior to a contract, and our legitimate interest in responding.
To send the newsletter you asked for, using your email address. Legal basis: consent, which you can withdraw at any time by unsubscribing.
To match candidates with roles at our clients and run search processes, using talent-network and application data. Legal basis: your consent when you join, our legitimate interest in providing recruiting services, and steps prior to a contract.
To operate, secure and improve the site, using usage and device data and analytics. Legal basis: legitimate interest, and consent for analytics cookies where required.
To comply with legal obligations and resolve disputes, using any of the above. Legal basis: legal obligation and legitimate interest.

We do not sell personal information and we do not use it for cross-context behavioural advertising.

3. Candidates: how recruiting data is handled

Sharing with clients. We share a candidate’s profile with a prospective employer only after discussing the specific opportunity with the candidate and with their agreement, unless the candidate applied directly to that employer’s role through our jobs site.
Sources. Besides what you give us, we may add publicly available professional information (for example from LinkedIn, GitHub or a personal site) to your profile, and notes from our conversations with you.
Retention. We keep candidate profiles for 24 months after our last meaningful contact so we can reach out about future roles, unless you ask us to delete them sooner or we are required to keep them longer (for example for legal claims). You can ask at any time to be removed.
Automated decisions. We do not make decisions about candidates solely by automated means.

4. Who we share it with (service providers)

We use a small number of providers to run the site. They act on our instructions and may only use the data to provide their service.

Webflow, Inc. (US) hosts the website and its content management system and receives and stores form submissions. It handles all request data and our contact and newsletter form submissions.
Cloudflare, Inc. (US) runs two small serverless functions for us: one fetches our public job listings for display, one forwards newsletter sign-ups to our email provider. It handles request metadata (IP, user agent) and newsletter email addresses in transit.
beehiiv, Inc. (US) provides newsletter delivery and subscriber management. It handles newsletter email addresses, subscription status, and open and click statistics for the emails it sends.
Google LLC (US) provides Google Analytics 4. It handles analytics cookies, truncated IP addresses and usage events.
Consider (US) operates the jobs site and talent network at jobs.bullmoose.co and stores applications and candidate profiles. It handles everything you submit there, and its own privacy policy also applies: https://consider.com/legal/privacy
Slater (script hosting) and content-delivery networks serve the site’s scripts and assets. They handle standard request data only.
Email and productivity tools [Google Workspace, Slack, Notion — confirm] hold our internal correspondence and notes, including candidate notes.

We may also disclose information if the law requires it, to protect our rights or safety, or as part of a merger, financing or sale of the business (with notice to you where required).

5. Cookies and analytics

The site sets very few cookies:

Google Analytics (_ga, _ga_<id>) measures site usage and expires after up to 2 years. You can opt out with the Google Analytics opt-out browser add-on at tools.google.com/dlpage/gaoptout, or by blocking cookies in your browser.
Webflow may set functional cookies needed to submit forms and protect them from abuse.
We honor the Global Privacy Control signal as an opt-out of any sale or sharing of personal information under California law.

We do not use advertising pixels or social-media trackers on bullmoose.co. Our fonts are self-hosted, so no font provider receives your data.

6. International transfers

We are based in the United States and our providers process data there. If you are in the EEA, UK or Switzerland, transfers rely on the providers’ Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.

7. How long we keep it

Contact-form enquiries: up to 24 months after our last correspondence, longer if we enter an engagement.
Newsletter data: until you unsubscribe, then removed from the active list within 30 days.
Candidate data: see section 3.
Analytics data: Google Analytics event data is retained for 14 months.
Server and security logs: typically 30-90 days.

8. Your rights

Depending on where you live you may have the right to access the personal information we hold about you, correct it, delete it, receive a copy, object to or restrict certain processing, and withdraw consent. California residents additionally have the right to know what categories we collect, disclose and (we do not) sell or share, to limit use of sensitive personal information, and not to be discriminated against for exercising these rights. We do not sell or share personal information as those terms are defined in the CCPA and CPRA.

To exercise any right, email jacob@bullmoose.co. We will verify your identity (usually by replying to the email address we hold for you) and respond within the time the law requires — 45 days in California, one month under the GDPR. You may use an authorised agent; we will ask the agent for proof of authority. If you are in the EEA or UK you can also complain to your local data-protection authority.

9. Security

We use reputable providers with encryption in transit (TLS) and at rest, limit access to people who need it, and keep API credentials outside the website itself. No system is perfectly secure; if we learn of a breach affecting your information we will notify you as the law requires.

10. Links and third-party sites

The site links to other sites (for example client websites, LinkedIn, X, and our jobs site). Their privacy practices are their own; read their policies.

11. Changes

We will post any changes here and update the effective date. If a change materially affects how we use information you have already given us, we will tell you by email where we can.

12. Contact

Bull Moose Consulting, LLC. 2108 N St., Suite # 5923, Sacramento CA 95816. info@bullmoose.co