Privacy Policy

Mashman Consulting Group LLC, Little Rock, Arkansas, is the controller of personal information collected through this site. Contact: legal@personalbrandingagencies.com (opens in a new tab).

Agency applications. Business name, address, website, founding year, team size, clients served, specialties, AI disclosure, and the name, role, email, and phone of the person applying. We use this to conduct the vetting review and to build the listing.

Reviews. Your name, optional role or company, contact email, rating, and written review. The email is required so we can confirm you were genuinely a client and tell you the outcome. Your email address is never published, never shared with the agency you reviewed, and never used for marketing. Your name is published as a first name and last initial.

Reports. The agency named, the alleged violation, your account of what happened, any evidence you provide, and your email if you supply one. The email is optional: reports may be filed anonymously, though we then cannot tell you the outcome.

Practice alerts. If you ask to be told when a vetted practice that matches a search is listed, we keep your email address, the search's filters, and the day you confirmed. Nothing is kept until you confirm from the email we send you. We use them only to send those alerts, never share them with a practice, and every alert has a one-click unsubscribe link that deletes the record.

Requests sent through the Workspace. If you send a practice a brief through the directory, we keep your name, email address, your request and any file you attach, and pass them to that one practice only after you tick the consent box and confirm from the email we send you. Until you confirm, the request waits for 24 hours and is then discarded. The practice may download your request and file to keep with its own records, and uses them to reply to you; we never use them for marketing and never share them with any other practice. About 45 days after you confirm, we email you once to ask how it went, with a link to review the practice if you hired it. The review form then carries a reference to your brief, so we can match the review to the brief you sent.

Workspace tools, for listed practices. A listed practice signed in to its Workspace can keep, for its own use: a logo it uploads and the colors it chooses for its Brand Kit; notes and ticks on its discovery call plans for the briefs it received; and an inquiry tracker holding the inquiries it adds (a name, a contact, where the inquiry came from and notes), the stage of each, and private reminders. They are shown only to that practice: not to buyers, not to other practices, and not in an administrator's view of the Workspace. We do not use them for anything else, and we access them only to keep the service running or where the law requires it. The Brand Kit PDF is drawn in the practice's own browser from its published listing and is not stored by us.

Suggested practices. If you suggest a practice, we keep the practice's name, website, email and city, how you know it, and your note. Your own name and email are optional; if you give your email and tick the box, we use it once, to tell you when the practice is listed, and never share it with the practice or anyone else. We may email the practice one invitation to apply, which never says who suggested it and lets it ask never to be invited again.

Technical data. Our host records standard server logs including IP address, browser type, and pages requested. These are used for security and to keep the site running.

Across Mashman Consulting Group's own websites (identitypositioning.com, mashmancg.com, identityquest.press, mashmanpublishing.com, and personalbrandingagencies.com), a small script served from identitypositioning.com stores one random visitor code in your browser and adds it to links between those sites, so we can see which of our sites introduced you to another and whether you later applied for a listing, reviewed an agency, sent a press inquiry, requested a consultation, or completed an audit. The script reports visits, movement between our sites, and those outcomes to identitypositioning.com, MCG's technology hub.

The code is not linked to your name, email, or IP address and is never shared with third parties. It is kept in your browser's local storage, not a cookie, and clearing your browser's site data removes it. The same code is described in the identitypositioning.com privacy policy (opens in a new tab).

To learn how people use the directory, a small script on this site counts what happens on its pages and sends the counts to identitypositioning.com, MCG's technology hub, where they are kept as daily totals. It counts:

• the kind of page viewed (a listing, the directory, a ranking, an article);
• when you arrive, the kind of site that sent you (a search engine, a social network, an AI assistant, one of MCG's sites, or none) and whether you are on a phone, a tablet, or a computer;
• which listings are opened and from which page, and on a listing, clicks on Visit Website, email, phone, and social links;
• the words typed into the directory, editorial, and site searches and how many results came back, and the filters chosen;
• agencies saved to a shortlist, forms started and sent, videos played, and articles read to the end.

None of this identifies you. It uses no cookie, stores nothing in your browser, carries no visitor code, and is not combined with the cross-site visitor code above. Your IP address is not kept with it. Search words that look like an email address or a phone number are never sent. What is kept is totals for each day, such as how many people opened a listing, never a record of what one person did.

An editorial piece, or a listing's introduction, may include a YouTube or Vimeo video. Until you press play, the page shows its own panel and nothing is requested from YouTube or Vimeo. Pressing play loads the video from youtube-nocookie.com, YouTube's privacy-enhanced player, or from Vimeo's player with Do Not Track on, and from that point the video host's own privacy policy applies to the video, including any cookies it sets. If you prefer, the panel also links to the video on its host.

We do not sell personal information or leads, and we never share a lead unsolicited. A request you send through the Workspace goes only to the one practice you select, as set out under When information is shared. We do not share personal information with advertisers. We do not use third-party advertising, and we do not run analytics that build a profile of you across other companies' websites. The only cross-site measurement is the visitor code described above, which works only between Mashman Consulting Group's own sites.

Fonts are served from this site rather than a third party, so simply reading a page does not disclose your visit to another company. The visitor-code script is served by identitypositioning.com, which Mashman Consulting Group also operates.

We share personal information only in these circumstances:

• With our hosting and form-processing provider, Netlify, which stores form submissions on our behalf.
• With our email provider, Resend, which delivers the email you asked for, and the links and notices we send a listed practice about its own listing. Every list email carries a link to unsubscribe or choose what you receive, and every listing notice a link to stop them, honored at once.
• With identitypositioning.com, MCG's technology hub, which receives only the anonymous visit and outcome counts described under Cross-site visitor code and the anonymous daily totals described under How the directory is used.
• With the one practice you choose, when you send it a request through the Workspace and confirm it: your name, email address, request and file. The practice can read them in its Workspace and download the request and the file to keep.
• With an agency, where you have submitted a review or report about it and we need to put the substance to them for response. We share the substance of the complaint, not your email address.
• Where required by law, or to establish, exercise, or defend a legal claim.

Applications are kept for the life of the listing, and for two years after a listing ends or an application is declined. Reviews and their verification records are kept for as long as the review is published, and for two years after removal. Reports are kept for three years, because a pattern of reports about one agency is itself relevant to a later decision. A practice alert is kept until you unsubscribe. A request sent through the Workspace, and its file, is kept for 90 days and then deleted, and the record of its one follow-up email for 120 days after that email is sent. A suggested practice is kept until it is listed or removed in our console, and a practice's request never to be invited again is kept for good, so it is honored. Workspace tool data is kept until the practice deletes it, and each tool has its own Delete All; discovery call notes are deleted with their brief, after 90 days; a practice that leaves the directory has its tool data deleted 30 days later. The tracker shows a buyer's name and email only while the brief itself is kept. Deleted information can remain in our encrypted backups until those copies expire: 35 days for the nightly copies, and longer for the monthly and yearly copies kept to recover from a disaster. What the practice keeps after it replies is its own record, including any copy of the request or file it downloads. Server logs are kept according to our host's standard retention.

You can ask us to give you a copy of the personal information we hold about you, correct it if it is wrong, delete it, or stop using it in a particular way. Email us and we will respond within thirty days.

Some requests have limits. We may keep a record of a confirmed Code of Ethics report where deleting it would prevent us from operating the directory honestly, and we may need to retain information to defend a legal claim.

Depending on where you live, you may have additional rights under laws such as the California Consumer Privacy Act or the UK and EU General Data Protection Regulation, including the right to complain to a supervisory authority.

This site sets no advertising or analytics cookies. A cookie is set when an administrator signs in to the restricted admin area, and when a listed practice opens its brand kit, change request form or Workspace from the link we emailed it; each exists only to keep that session open, for up to 30 days for a practice. Neither is used to track visitors. The cross-site visitor code is held in local storage rather than a cookie, and the directory usage counts use neither. A few conveniences are kept only in your own browser's local storage and are never sent to us: your shortlist, the agencies you viewed recently, whether you follow the editorial, along with which new pieces you have already seen, and a draft of the listing application while you fill it in, cleared once it is sent. Saving an agency is counted anonymously, as described under How the directory is used, but the list itself stays in your browser.

The site is served over HTTPS. The administrator area is protected by authentication enforced before any page is served, and administrative credentials are stored as environment variables rather than in the site code.

No system is perfectly secure. If we discover a breach affecting your personal information, we will notify you and any regulator as required by law.

This site is intended for business use by adults. We do not knowingly collect personal information from anyone under sixteen. If you believe we have, contact us and we will delete it.

We may update this policy. The date at the top reflects the most recent change. Material changes affecting how we use information already collected will be notified to affected people where we hold contact details.