1. PURPOSE AND SCOPE
Leath Consulting Group, LLC (collectively, “LCG,” “we,” “us,” or “our”) respects the confidentiality, integrity, and availability of information entrusted to us. This Privacy Policy explains how LCG collects, receives, uses, discloses, retains, safeguards, and disposes of Personal Information in connection with our public websites, secure portals, commercial-operations workspace, advisory and professional services, software and intelligence products, assessments, events, communications, and related support activities (collectively, the “Services”).
This Policy applies to website visitors, prospective and current clients, partners, subscribers, suppliers, subcontractors, users, personnel applicants, event participants, and other individuals who interact with LCG. When LCG processes Personal Information solely on documented instructions from a client under an executed agreement, statement of work, data-processing addendum, or government contract, the controlling agreement governs that processing and LCG acts in the role assigned by that agreement. If this Policy conflicts with a legally binding customer agreement concerning customer-controlled data, the customer agreement controls to the extent of the conflict.
2. DEFINITIONS AND ACCOUNTABILITY
“Personal Information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked to an individual or household. “Customer Data” means information submitted to or processed through the Services by or for an authorized client, partner, or subscriber. “Government Contract Data” includes acquisition, proposal, pricing, contract, subcontract, performance, reporting, invoice, compliance, and supporting records associated with public-sector business. “Sensitive Information” includes credentials, financial-account information, precise identifiers, government identifiers, security information, and other information treated as sensitive under applicable law.
LCG is responsible for the Personal Information it controls. Questions, privacy requests, and complaints may be directed to the contact identified in Section 16. We assess applicable duties according to the nature of the relationship, the information, the jurisdiction, and any controlling contract.
3. INFORMATION WE COLLECT
Depending on the interaction, LCG may collect business and personal contact information; organization, ownership, registration, socioeconomic-status, capability, certification, insurance, bonding, past-performance, contract-vehicle, and geographic-coverage information; account credentials and multifactor-authentication status; service interests, subscriptions, entitlements, preferences, requests, assessments, scores, approvals, risks, corrective actions, tasks, and communications; meeting, calendar, message, file, and support records; and commercial records such as proposals, quotes, statements of work, service agreements, invoices, payment status, credits, discounts, renewals, and accounting references.
For acquisition, pricing, delivery, and compliance activities, we may process solicitations, proposals, labor and product catalogs, manufacturer or part numbers, cost and price information, market observations, source citations, contract clauses, modifications, deliverables, invoices, sales reports, SAM registration information, subcontracting records, representations, certifications, and audit evidence. We may also collect professional, employment, training, and access-control information from personnel and applicants.
Our systems may automatically record internet-protocol address, browser and device characteristics, operating system, language, referring page, pages or functions used, timestamps, session and authentication events, error records, connector events, audit trails, and security telemetry. We may use necessary cookies or comparable technologies to maintain sessions, preserve preferences, secure accounts, and operate the Services. We will describe and obtain consent for optional analytics or advertising technologies where required before activating them.
4. SOURCES OF INFORMATION
We collect information directly from individuals and authorized organization representatives; from uploaded files, forms, meetings, messages, and service activities; from clients, partners, suppliers, subcontractors, references, and team members; from connected services authorized by a user or organization; and from lawful public or commercial sources. Public-sector intelligence may include SAM.gov, USAspending.gov, acquisition forecasts, agency publications, GSA pricing resources, the Bureau of Labor Statistics, the Census Bureau, FRED, Data.gov, state and local procurement systems, and other authoritative sources. We preserve source attribution and retrieval metadata when information is used as decision evidence.
5. PURPOSES OF PROCESSING
LCG processes information to authenticate users and administer accounts; conduct intake, qualification, due diligence, assessments, and conflict or risk review; configure solutions and entitlements; prepare and administer proposals, quotes, agreements, projects, deliverables, invoices, receipts, payments, renewals, and support; perform market, demand, opportunity, capture, proposal, pricing, cost, financial, contract, compliance, and executive analysis; maintain auditability and source traceability; communicate with authorized parties; schedule meetings; prevent fraud and misuse; secure, troubleshoot, maintain, and improve the Services; comply with contracts and law; establish, exercise, or defend legal rights; and conduct responsible internal administration.
We do not sell Personal Information. We do not use Google user data, Customer Data, or Government Contract Data for targeted advertising, creditworthiness determinations, or unrelated data-broker activities.
6. ARTIFICIAL INTELLIGENCE AND AUTOMATED PROCESSING
Certain Services may use artificial intelligence, machine learning, rules, or analytical models to classify records, extract fields, identify anomalies, compare market evidence, calculate scores, draft narratives, recommend next actions, summarize materials, or assist with pricing, capture, proposal, contract, compliance, and delivery workflows. AI-assisted results are decision-support outputs; they are not legal opinions, audits, contracting-officer determinations, certified cost or pricing data determinations, final price-to-win opinions, or substitutes for authorized professional judgment.
LCG applies role-based access, source attribution, confidence indicators, exception routing, human review, and approval controls appropriate to the use case. Material commercial, legal, acquisition, pricing, compliance, employment, entitlement, or customer-impacting decisions remain subject to authorized human review. Users must validate AI-generated output and may not submit classified information, export-controlled technical data, protected health information, payment-card data, credentials, or controlled unclassified information to an AI-enabled feature unless LCG has expressly approved the feature and environment for that data.
We may transmit limited information to contracted AI service providers when necessary to provide an authorized feature. We configure and govern such use according to applicable agreements, security controls, retention settings, and data-use restrictions. LCG does not permit Google Workspace user data obtained through Google APIs to be used to develop, improve, or train generalized AI or machine-learning models.
7. GOOGLE WORKSPACE AND OTHER CONNECTED SERVICES
When an authorized LCG user connects Google Workspace, the Services may obtain permission to send approved messages, read calendar availability, create calendar events and Google Meet conferences, and create or manage files specifically used with the application. LCG’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements. We use such data only to provide or improve prominent user-facing features, do not sell it, do not use it for advertising or lending, and do not permit human access except with affirmative authorization, for security, to comply with law, or as otherwise permitted by that policy.
When a user authorizes QuickBooks Online, electronic-signature, CRM, accounting, budgeting, storage, identity, or other third-party services, LCG processes only the information reasonably necessary to perform the authorized connection, subject to the requested permissions and the provider’s terms. Users may revoke provider authorization through the provider or by contacting LCG. Revocation may disable connected functions but does not require deletion of records LCG must retain for contractual, accounting, security, evidentiary, or legal purposes.
8. DISCLOSURE OF INFORMATION
LCG may disclose information to authorized personnel and representatives; to a client or organization that administers the relevant account; to approved partners, subcontractors, advisers, and professional reviewers; and to service providers that support hosting, identity, communications, calendaring, storage, accounting, payment, signature, analytics, cybersecurity, support, and AI-assisted functions. Such recipients receive access only for legitimate purposes and are subject to contractual, professional, or legal duties appropriate to their role.
We may disclose information when reasonably necessary to comply with law, subpoena, court order, government request, audit, investigation, or contractual reporting duty; protect rights, safety, systems, or property; investigate fraud, abuse, or security incidents; enforce agreements; or support a merger, financing, reorganization, sale, or transfer of assets, subject to appropriate notice and safeguards where required. We do not disclose Customer Data to another customer except as authorized, aggregated or deidentified, or legally required.
9. GOVERNMENT, CONTRACT, AND CONTROLLED RECORDS
Government Contract Data may be subject to solicitation restrictions, nondisclosure agreements, procurement-integrity requirements, records schedules, audit rights, contract clauses, agency rules, export controls, or security-handling requirements. Users are responsible for classifying information before submission and for providing handling instructions required by the governing instrument. Unless an executed agreement expressly states otherwise, the Services are not authorized for classified information, covered defense information, controlled unclassified information requiring a specified federal security environment, export-controlled technical data, or information subject to agency-specific systems-of-record restrictions.
LCG may preserve source addresses, retrieval dates, hashes, versions, decision authorities, approvals, exception records, and processing logs to support auditability and defensible decision records. We will not knowingly alter an authoritative source record; derived analyses are identified as such and retained with appropriate provenance.
10. SECURITY
LCG maintains administrative, technical, and physical safeguards reasonably designed for the nature of the information and the Services. Measures may include least-privilege access, role and entitlement controls, multifactor authentication, encryption in transit and where appropriate at rest, separation of environments, secrets management, logging, monitoring, approval gates, backup, vulnerability management, incident response, provider due diligence, and workforce confidentiality obligations. No system is completely secure, and LCG cannot guarantee that unauthorized access, loss, or misuse will never occur.
Users must protect credentials, use approved devices and networks, promptly report suspected incidents, and comply with applicable security and acceptable-use requirements. If LCG determines that a security incident creates a legally reportable risk, LCG will provide notices as required by applicable law and contract.
11. RETENTION AND DISPOSAL
LCG retains information for the period reasonably necessary to provide the Services, administer the relationship, maintain source and decision traceability, satisfy accounting and tax requirements, resolve disputes, enforce agreements, comply with law and contract, support audits, and preserve legitimate business records. Retention varies by record class, contractual requirement, litigation hold, government requirement, and system capability. When retention is no longer justified, LCG will delete, deidentify, aggregate, archive, or securely dispose of information in accordance with applicable procedures. Backups and immutable audit records may persist until their scheduled expiration.
12. INDIVIDUAL RIGHTS AND REQUESTS
Subject to applicable law and verified identity, an individual may request confirmation of processing, access, correction, deletion, or a portable copy of Personal Information; may opt out of certain targeted advertising, sale, or profiling activities if conducted; and may withdraw consent where consent is the applicable basis. Because LCG does not sell Personal Information or use it for targeted advertising, those opt-outs generally do not apply to current Services. Authorized account administrators may control certain business-account records.
Requests may be submitted to info@leathconsulting.com. We may request information necessary to authenticate the requester and locate relevant records. An authorized agent must provide proof of authority. We will respond within the period required by applicable law and explain any denial or limitation. Requests may be limited by legal privileges, trade secrets, another person’s rights, contractual duties, security needs, record-retention obligations, or statutory exceptions. Where applicable, a requester may appeal by replying to the decision and stating “Privacy Appeal.” We will not unlawfully discriminate against an individual for exercising a privacy right.
13. CHILDREN, INTERNATIONAL USE, AND THIRD-PARTY LINKS
The Services are intended for businesses, professionals, and authorized organizational users and are not directed to children under thirteen. LCG does not knowingly collect Personal Information from children through the Services. Information may be processed in the United States and other locations where approved providers operate. When applicable law requires a transfer mechanism or additional safeguard, LCG will use an appropriate contractual or legal mechanism.
The Services may link to third-party websites or services. Their privacy practices are governed by their own notices, and LCG is not responsible for their independent practices.
14. STATE-SPECIFIC DISCLOSURES
During the preceding twelve months, LCG may have collected the categories described in Section 3 for the purposes described in Section 5 and disclosed them to the categories of recipients described in Section 8. LCG does not sell Personal Information and does not knowingly use Sensitive Information for purposes beyond providing requested services, security, legal compliance, and other permitted business purposes. Residents of states with comprehensive privacy laws may exercise applicable rights through the process in Section 12. Rights and exceptions vary by jurisdiction.
15. CHANGES TO THIS POLICY
LCG may revise this Policy to reflect changes in law, technology, providers, or Services. The “Effective” date and version identify the current policy. If a change materially affects how previously collected Personal Information is used, LCG will provide notice and obtain consent where required. Archived versions may be requested from LCG.
16. CONTACT
Privacy inquiries and requests may be directed to: Leath Consulting Group, LLC, Attn: Privacy and Data Governance, 5000 El Dorado Pkwy, Suite 203, Frisco, Texas 75033; 945-276-1253; info@leathconsulting.com.