Privacy Policy

01 Overview

TIMBUKTU LLC ("TIMBUKTU," "we," "us," or "our") is a Virginia limited liability company and holding company headquartered in Woodbridge, Virginia. This Privacy Policy describes how we collect, use, store, and protect information when you visit this website (the "Site").

We are committed to transparent data practices. Our founding principle is that technology should empower people and that includes how we handle the personal information you entrust to us.

02 Scope of This Policy

This policy applies only to the TIMBUKTU LLC holding company website. TIMBUKTU LLC is the parent company of six operating divisions. Each division maintains its own privacy policy governing its specific services and data practices:

When you engage with a division's website or services, that division's privacy policy governs. Links to each division's privacy policy are available on their respective pages within this site.

03 Information We Collect

Information You Provide Directly

• Contact form submissions your full name, email address, selected subject, and message content when you submit an inquiry through this site.
• Direct correspondence information you voluntarily share when contacting us by email or phone.

Information Collected Automatically

• Server access logs IP address, browser type and version, operating system, pages visited, referring URL, and request timestamps. This is standard for any web server and is used for security monitoring, performance analysis, and abuse prevention.
• No behavioral tracking cookies this site does not deploy advertising cookies, retargeting pixels, or third-party behavioral analytics scripts.

What We Do Not Collect

• Social Security Numbers or government-issued identification numbers
• Payment card or banking information (this site has no e-commerce or payment processing functionality)
• Biometric data
• Precise geolocation data
• Sensitive personal categories such as health information, religious beliefs, racial or ethnic origin, or sexual orientation

04 How We Use Information

We use the information we collect only for the following purposes:

• Responding to your contact form submissions and direct inquiries
• Routing your inquiry to the appropriate TIMBUKTU division when relevant
• Internal business operations and record-keeping
• Detecting, investigating, and preventing fraud, abuse, unauthorized access, and security threats
• Complying with applicable legal obligations
• Improving this website's content, accessibility, and functionality

We do not use your information for automated decision-making or profiling that produces legal or similarly significant effects on you.

05 Sharing and Disclosure

We do not sell your personal information. We do not share it with advertisers, data brokers, or any party for their own marketing purposes.

We may share information in the following limited circumstances:

• Within the TIMBUKTU corporate family with operating divisions when your inquiry is relevant to their services, subject to this policy and the applicable division-level privacy policy.
• Service providers with third-party vendors who assist our operations (see Section 6 for named processors). These parties are contractually obligated to protect your information and may not use it for their own independent purposes.
• Legal compliance when required by applicable law, regulation, subpoena, court order, or government request; or to protect the rights, safety, or property of TIMBUKTU LLC, our clients, or the public.
• Business transfers in connection with a merger, acquisition, reorganization, or sale of assets, subject to standard confidentiality obligations. We will notify you of any material change in ownership or data control.

06 Third-Party Data Processors

The following third-party services process personal information on our behalf when you use this site. Each is governed by its own privacy policy, linked below.

• EmailJS (emailjs.com) processes contact form submissions to deliver your message to us. When you submit the contact form, your name, email address, subject, and message are transmitted through EmailJS infrastructure. EmailJS does not use this data for any purpose other than message delivery. EmailJS Privacy Policy
• Web hosting provider our hosting provider may process server access log data as part of normal web infrastructure operations. We will name the specific provider here upon deployment.

We do not use Google Analytics, Meta Pixel, or any behavioral advertising or analytics scripts on this site. If this changes, this section will be updated before any such scripts are deployed.

07 Data Retention

• Contact form submissions retained until the inquiry is resolved, plus two years, or as required by applicable law, whichever is longer.
• Server access logs retained for 90 days for security monitoring and abuse investigation, then deleted or anonymized.
• Business correspondence retained for the duration of any business relationship and for a reasonable period thereafter consistent with applicable legal obligations and our record-keeping policies.

We do not retain personal information longer than is necessary for the purposes described in this policy or as required by law.

08 Your Privacy Rights

Depending on where you reside, you may have specific rights regarding your personal information. We will not discriminate against you for exercising any of these rights.

To exercise any right, contact us at owner.timbuktu@gmail.com. We will respond within 45 days as required by the Virginia CDPA, and within 45 days as required by the CCPA/CPRA, with one possible 45-day extension when reasonably necessary. We will verify your identity before processing requests involving access to or deletion of personal data.

Virginia residents who receive an adverse response to a request may submit an appeal to owner.timbuktu@gmail.com. If your appeal is denied, you may contact the Virginia Attorney General at oag.state.va.us.

09 Security

We implement reasonable administrative, technical, and physical safeguards appropriate to the type and sensitivity of information we hold, including encrypted HTTPS transmission, server-side access controls, and security monitoring aligned with NIST Cybersecurity Framework guidelines.

No method of data transmission or storage is completely secure. We cannot guarantee absolute security. If you believe your information has been compromised or that you have identified a security vulnerability on our site, contact us immediately at owner.timbuktu@gmail.com. Do not attempt to exploit any vulnerability please report it and allow us to address it.

10 Third-Party Links

This site may contain links to our operating divisions' pages and external third-party websites. This privacy policy does not apply to those sites. We are not responsible for the privacy practices or content of any external website. We encourage you to review the privacy policy of each site you visit.

11 Children's Privacy

This website is not directed at children under the age of 13 and we do not knowingly collect personal information from children under 13. If we learn that we have inadvertently collected such information, we will delete it promptly. If you believe a child under 13 has provided us with personal information, please contact us at owner.timbuktu@gmail.com.

Services provided by individual TIMBUKTU divisions are intended for adults. Minors seeking services through any division must do so with the involvement of a parent or legal guardian.

12 Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices, legal requirements, or business operations. When we make changes, we will update the "Last Updated" date at the top of this page. Material changes such as adding new categories of data collection or new third-party processors will be noted prominently.

Your continued use of this site after the updated policy is posted constitutes your acceptance of the changes. If you do not agree with the updated policy, please stop using this site.

13 Contact Us

For privacy-related questions, to exercise your rights, or to report concerns about our data practices, contact us at: