Skip to content

Legal

Privacy notice

What we collect when you use this website, why we collect it, how long we keep it, and what you can tell us to do about it. Last updated 14 November 2026.

The short version

You can read this whole site without telling us anything about yourself. We ask for your details in exactly one place — the contact form — and we use them to reply to you.

We would also like to understand how the site gets used. That is the only thing we ask your permission for, you can say no, and saying no changes nothing about how the site works for you. If you say nothing at all, we treat that as no.

We do not sell your personal information and we do not share it for advertising. There are no advertising or social media trackers on this site. We do use Google Analytics — but only if you say yes, and it is not loaded at all until you do.

Who is responsible

SG Technology LLC, trading as LumberIQ, is the data controller for this website. That means we decide what is collected and why, and we are who you complain to.

If you are in the European Union or the United Kingdom: we do not currently offer analytics consent to visitors there, and we do not track your behaviour on this site. We are a United States company and have not appointed a representative in the EU under Article 27 of the GDPR, so we have chosen not to monitor EU visitors at all rather than do it without one. You can still use the whole site and the contact form, and everything in this notice about your rights still applies to you.

What we collect, and why

Each row says what the data is, the legal basis we rely on to process it, and how long we keep it.

Answering an enquiry you send through the contact form

  • What: Your name, email address, phone number if you give one, and what you wrote.
  • Why we are allowed to: Steps taken at your request before entering into a contract (Art. 6(1)(b)), and our legitimate interest in replying to people who contact us (Art. 6(1)(f)).
  • How long: Kept for as long as we are in contact about it and for 24 months afterwards, then deleted.

Keeping the site running and secure

  • What: Server request logs held by our hosting provider, including IP address, the page requested and the time.
  • Why we are allowed to: Our legitimate interest in operating a working, secure website (Art. 6(1)(f)). You cannot opt out of these, because without them the site cannot be served to you at all.
  • How long: Held by our hosting provider for a short rolling window and not copied into our own records.

Understanding how the site is used

  • What: Which page you were on, how long you spent, and how much data was returned. If — and only if — you accept analytics, also your IP address, the country your request came from, and your browser, operating system and device type. We do not collect your city or any finer location than country.
  • Why we are allowed to: Your consent (Art. 6(1)(a)), which you can withdraw at any time. Nothing identifying is recorded unless you have accepted, and Google Analytics is not loaded at all until then.
  • How long: Identifying details are deleted after 12 months. Anonymous usage counts may be kept longer.

Running the admin area

  • What: Your name, email address, a hashed password, and a record of your edits and sign-ins.
  • Why we are allowed to: Our legitimate interest in controlling who can change the site and in keeping an audit trail (Art. 6(1)(f)). This applies to staff accounts, not to visitors.
  • How long: For as long as the account exists, and 24 months afterwards for the audit trail.

Analytics, and your choice about it

We measure how the site is used so we can tell which of the calculators earn their place and which pages waste your time. The measurement itself — which page, how long, how much data came back — does not identify you.

If you accept analytics, two things happen. We additionally record your IP address, the country your request came from, and your browser, operating system and device type. And Google Analytics is loaded, which measures your visit for us and sets its own cookies — until you accept, that script is never fetched and Google is not told you were here. That combination can identify you, which is why we ask first rather than assume. We do not work out your city, and we do not send your IP address to any service whose job is to locate it — the country comes from a label our network provider has already attached by the time the request reaches us.

Declining is a single click and costs you nothing: no feature is withheld, no nagging, no difference in speed. If you ignore the request entirely, we take that as a decline. You can change your mind whenever you like using the link in the footer, and withdrawing is as easy as giving it was.

Cookies and anything else stored on your device

This is the complete list. There is nothing else.

iq_admin_session

  • What it does: Keeps a signed-in administrator signed in. Only ever set after someone signs in.
  • How long it lasts: 7 days
  • Do we need your permission: Strictly necessary — no consent required, and no visitor ever receives it.

iq_analytics_consent

  • What it does: Remembers whether you accepted or declined analytics, so you are not asked again.
  • How long it lasts: 6 months
  • Do we need your permission: Strictly necessary — it exists to record your choice.

iq_visit

  • What it does: A random identifier that groups the pages of a single visit. Not linked to you, not kept between visits, and only set if you accept analytics.
  • How long it lasts: Until you close the browser
  • Do we need your permission: Set only with your consent.

_ga and _ga_*

  • What it does: Set by Google Analytics to tell one visit from another and to measure how the site is used. Written only after you accept analytics; if you later decline, they are deleted and Google Analytics is switched off.
  • How long it lasts: Up to 2 years, or until you decline
  • Do we need your permission: Set only with your consent.

iq_geo

  • What it does: The two-letter country your request came from, as reported by Cloudflare, so we know whether we may ask you about analytics at all. It never contains your IP address and it is not linked to anything else.
  • How long it lasts: 24 hours
  • Do we need your permission: Strictly necessary — it is what lets us decide whether we are allowed to ask you the question.

__prerender_bypass / __next_preview_data

  • What it does: Lets a signed-in editor preview an unpublished page. Never set for visitors.
  • How long it lasts: Until you close the browser
  • Do we need your permission: Strictly necessary — no consent required.

Who else sees it

We use four service providers to run the site, named below. They process data on our instructions only, under a contract that requires it, and none of them may use it for their own purposes. There are no others: no advertising networks and no data brokers.

Render Services, Inc. — our website hosting provider

  • What they do: Runs the servers and the database this site is served from. Holds the contact-form messages, the admin accounts and the usage records described above.
  • Where they are: United States (Oregon)

Cloudflare, Inc. — our network and security provider

  • What they do: Routes traffic to the site, filters abusive requests, and tells us which country your request came from so we know whether we may ask you about analytics. Your IP address passes through them, as it must for any website to reach you.
  • Where they are: United States, and servers worldwide

Google — our analytics provider

  • What they do: Google Analytics measures how the site is used. It runs ONLY if you accept analytics: until then the script is never loaded and Google receives nothing at all, not even the fact that you visited. Google acts as our processor and we have not enabled advertising features, data sharing or Google Signals.
  • Where they are: United States and worldwide

SMTP2GO — our email delivery provider

  • What they do: Delivers the messages you send through the contact form to our inbox. They receive what you wrote and the address you gave.
  • Where they are: New Zealand and the United States

We may also disclose information where the law requires it, or to establish or defend a legal claim. If our business is sold, the buyer would receive this information and would remain bound by this notice.

Where your information goes

We are based in the United States and the site is served from there, so information about you is processed in the United States. If you are in the European Union, the United Kingdom or Switzerland, that is a transfer outside your home jurisdiction, and the law requires us to say so and to protect it.

Where such a transfer happens, we rely on the European Commission’s Standard Contractual Clauses, together with the UK Addendum where the United Kingdom is involved, and we assess whether anything in the destination country undermines them. You can ask us for a copy of those safeguards using the contact details above.

How long we keep things

The periods are in the table above, one for each purpose, because a single blanket period would be either too long for some of it or too short for the rest. When a period ends we delete the information or strip out the parts that identify you, and we do not keep a copy “just in case”.

Your rights

If you are in the European Union or the United Kingdom, the GDPR gives you the rights below. We extend them to everyone who asks, wherever you live, because operating two standards would be harder than operating one.

  • See it. Ask for a copy of what we hold about you.
  • Correct it. Have anything wrong put right.
  • Delete it. Ask us to erase it, where we have no overriding reason to keep it.
  • Limit it. Ask us to pause processing while a dispute is sorted out.
  • Take it. Receive what you gave us in a machine-readable form, or have us send it on.
  • Object. Tell us to stop, where we rely on legitimate interests. For direct marketing, your objection is absolute and we stop.
  • Withdraw consent. For analytics, at any time, without affecting anything that happened before you withdrew it.
  • Complain. To your national data protection authority. In the United Kingdom that is the Information Commissioner’s Office; in the EU it is the supervisory authority where you live, work, or where you think the problem happened. You do not have to come to us first, though we would rather you did so we can fix it.

If you are a California resident, you also have the rights to know, delete, correct and opt out of sale or sharing under the CCPA as amended. We do not sell or share personal information as those terms are defined, and we do not use it for cross-context behavioural advertising. We will not discriminate against you for exercising any of this.

Write to privacy@lumberiq.com and we will respond within one month. If your request is genuinely complicated we may take up to two further months, and we will tell you within the first month if that happens and why. We may need to check who you are first, and we will only ask for what we need to do that.

Decisions made about you by machine

There are none. Nothing on this site makes an automated decision that has a legal or similarly significant effect on you, and there is no profiling.

Children

This site is for people doing business in the lumber trade. It is not directed at children, and we do not knowingly collect information from anyone under 16. If you believe a child has sent us something, tell us and we will delete it.

If this notice changes

We will change the date at the top. If a change materially affects you — a new purpose, a new category of recipient, a longer retention period — we will say so prominently on the site, and where the change relies on your consent we will ask you again rather than assume the old answer still stands.

Getting in touch

Email privacy@lumberiq.com, call 503 473 2878, or use the contact form. A real person reads all three.