Website providers and data handling.

Processor register

The providers used for website hosting, source, email, booking, Google Analytics, and LinkedIn ad measurement, and what each handles:

• Vercel, Inc. — hosting, page-view analytics, and page-speed measurement. Serves the published static pages, and records standard technical request data such as an IP address in the ordinary course of serving a website. Vercel Web Analytics and Vercel Speed Insights are both enabled on each page, including the page-not-found notice. Web Analytics counts page views and clicks on links and buttons. Speed Insights records how quickly pages load. They set no cookie, and they receive their measurement on this domain rather than an outside one.
• Google LLC — Google Analytics, loaded on each page of the site, including the page-not-found notice. A script from www.googletagmanager.com sends the page address, the interactions turned on for this stream, including scrolls and outbound clicks, and clicks on the booking and email links, to Google. The script can write a cookie on this site.
• LinkedIn Corporation (Microsoft) — the Insight Tag, loaded on each page of the site, including the page-not-found notice. A script from snap.licdn.com sends the page address, and an ad-click identifier when one is present, to px.ads.linkedin.com or px4.ads.linkedin.com. It also requests an image from www.linkedin.com so LinkedIn can check a cookie. If JavaScript is off, the page instead requests a small image from px.ads.linkedin.com, which tells LinkedIn the site was visited. The script can write a cookie on this site. LinkedIn uses the visit for advertising measurement and for website audiences.
• GitHub, Inc. (Microsoft) — the site source and its full content history. The published pages are built from this repository. An operator can also manually run the search-engine notification command described below through GitHub Actions.
• Microsoft 365 — email you send to the address on the contact page, and our reply.
• Microsoft Bookings — only if you book a call: your name, your email address, the slot you chose, and anything you type into the booking form. The booking link tells Bookings that the booking came from this website. Booking is a link out, not an embed, so browsing this site sends nothing to it.

Vercel analytics and speed measurement are the host's own products and stay on this domain. Google Analytics and the LinkedIn Insight Tag are the off-site tags: the Content-Security-Policy allows www.googletagmanager.com, www.google-analytics.com and *.google-analytics.com, analytics.google.com and *.analytics.google.com, www.google.com, snap.licdn.com, px.ads.linkedin.com, px4.ads.linkedin.com, and www.linkedin.com, and denies every other third party. There is no forms processor, no email marketing platform, no separate CDN or proxy in front of the host, no Google Tag Manager container (the Google Analytics script itself is served from Google's googletagmanager.com address), no embedded video, and no fonts loaded from a third party. Operator-run search-engine notifications are described separately below.

Search-engine notifications

An operator can manually notify participating search engines about changes to published pages through IndexNow. The command runs from the operator's command line or a manually started GitHub Actions job. It sends a payload containing the public site address, canonical page URLs, and a public ownership-verification key and its URL to api.indexnow.org. IndexNow shares the notifications with participating search engines.

The notification payload contains no visitor, email, booking, or analytics data. Browsing this website does not run the command or contact IndexNow, and no IndexNow script is loaded in your browser. A notification does not establish that a page has been indexed or ranked.

What the site collects

No forms, no accounts. Page views and clicks on links and buttons are counted by Vercel Web Analytics and load times by Vercel Speed Insights, including on the page-not-found notice; both are cookieless and both report to this domain. Google Analytics and the LinkedIn Insight Tag also load on each page, including the page-not-found notice, and each can write a cookie on this site. The detail is on the privacy page.

How changes are controlled

Every word on this site is version-controlled text. Each change is a commit carrying an author, a timestamp, and a message, so what was published and when is a matter of record rather than recollection.

The published HTML is generated from that content by a build script in the same repository, so a page cannot say something the source does not.

Continuity

The website content and build source are kept in version control, allowing the static site to be rebuilt and deployed to a suitable host. The website has no content database. Email and booking are separate services with their own account and recovery arrangements.

Reporting a problem

If you find a security issue or an inaccuracy on this site, write to inquiries@cryobrothers.com and we will look at it.