Privacy Notice.

Effective: January 1, 2026  · Last updated: January 1, 2026

Roman James Advisory, LLC (“James Roman,” “we,” “us”) is a California-domiciled environmental advisory practice. This Privacy Notice explains what personal information we collect, how we use it, with whom (if anyone) we share it, and the rights you have under California law — including the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA).

i. Information we collect.

From you, when you contact us

• Identifiers — name, email address, telephone number.
• Property information — the area or address of the property your inquiry concerns, the nature of the matter.
• Communications — the content of your message, follow-up correspondence, notes from any consultation.

Automatically, when you visit this site

• Essential cookie — a single locally-stored value recording your cookie preference (set only after you make a selection).
• Server logs — IP address, browser type, pages visited, retained for security and operational purposes for no longer than thirty (30) days.

If you become a client

• Engagement record — signed engagement letter, NDA, scope, deliverables, correspondence.
• Property file — assessment notes, sample chain-of-custody, laboratory results, photographs, vendor correspondence, all retained on encrypted infrastructure.
• Billing information — invoices, payment records (we do not store full payment card data; payments are processed by a PCI-compliant third party).

We do not knowingly collect sensitive personal information as defined by the CPRA (such as Social Security numbers, government identifiers, geolocation data, racial or ethnic origin, religious beliefs, biometric data, or health information) except where you voluntarily provide it in connection with a matter (for example, where occupant health symptoms are relevant to an indoor air quality engagement). Where you do, we treat it under the elevated standards described in Section vi below.

ii. How we use your information.

1. To respond to your inquiry and arrange a consultation.
2. To perform the services you have engaged us to perform, and to communicate with you, your counsel, your contractors, your insurers, or your other advisors as you direct.
3. To meet our legal, regulatory, professional, and recordkeeping obligations.
4. To maintain the security of our systems and prevent fraud or unauthorized access.
5. To improve our practice — in aggregate and de-identified form only.

We do not use your personal information for advertising, profiling, or automated decision-making. We do not sell your personal information. We do not share it for cross-context behavioral advertising.

iii. Who receives your information.

Your information is held by James Roman and a small number of carefully-vetted service providers operating under written confidentiality and data-processing agreements:

• Encrypted communication and storage (e.g., Proton, Signal) for sensitive correspondence and document handling.
• Accredited laboratories for sample analysis, under chain-of-custody and confidentiality terms.
• Payment processor (PCI-compliant) for invoicing.
• Professional advisors (legal, accounting, insurance) where engaged on our own behalf, under privilege or confidentiality.

We disclose your information to other parties — your counsel, your insurer, a contractor — only at your direction, in writing. We do not share, syndicate, or sell your information for marketing or any commercial purpose.

We may disclose information where compelled by law (subpoena, court order, regulatory process) and will, to the extent legally permitted, notify you before doing so.

iv. Your rights as a California resident.

Under the CCPA and CPRA, California residents have the following rights with respect to their personal information:

• Right to know the categories and specific pieces of personal information we have collected about you, the sources, the purposes, and the categories of recipients.
• Right to delete personal information we have collected from you, subject to legal and recordkeeping exceptions (most notably, professional engagement files we are required to retain).
• Right to correct inaccurate personal information we hold about you.
• Right to opt out of sale or sharing. We do not sell or share personal information; this right is therefore moot in practice, but it is yours.
• Right to limit use of sensitive personal information. Where you have provided sensitive information, you may limit its use to the purposes for which it was provided.
• Right to non-discrimination. We will not deny services, charge different prices, or provide a different quality of service in response to your exercising any of these rights.
• Right to data portability. Where you exercise the right to know, you may request the information in a portable, readily usable format.

v. How to exercise your rights.

To exercise any of the rights described above, contact us using any of the following methods:

• Email: privacy@jamesroman.la
• Telephone: +1 (310) 430-2500
• Post: Roman James Advisory, LLC — Privacy — Malibu, California

We will respond within forty-five (45) days as required by the CPRA, with one forty-five-day extension where reasonably necessary. We will verify your identity before acting on a rights request, using the minimum information needed to do so.

You may designate an authorized agent to make a request on your behalf, in writing. We may, in our discretion, ask the agent to provide proof of authority and ask you to verify the agent’s authority directly.

vi. Sensitive personal information.

Where you provide sensitive personal information in the course of a matter (for example, health symptoms relevant to an indoor air quality engagement), we use it solely to perform the engagement, retain it on encrypted infrastructure, and do not disclose it except as you specifically direct or as compelled by law. We do not use sensitive personal information to infer characteristics about you.

vii. Cookies, analytics & trackers.

By default, this site loads no third-party cookies, analytics, or advertising trackers. A single first-party essential value records your cookie preference, and only after you have made a selection. If you affirmatively accept additional cookies, any analytics that may be loaded will be configured to respect your Do Not Track and Global Privacy Control signals.

Our Cookie Policy describes this in detail, including how to reset your preference at any time.

viii. Data retention.

• Inquiries that do not become engagements — correspondence retained for twelve (12) months, then deleted.
• Engagement files — retained for ten (10) years following project closure, consistent with industry practice and applicable statutes of limitation. You may request return or destruction of materials at any earlier point, subject to our legal and professional obligations.
• Server logs — thirty (30) days.
• Cookie preference — until cleared by you, or twelve (12) months, whichever comes first.

ix. Security.

We maintain reasonable administrative, technical, and physical safeguards designed to protect personal information against loss, misuse, unauthorized access, disclosure, alteration, or destruction. Sensitive engagement materials are held on encrypted jurisdiction-aware infrastructure. No system is impervious; in the event of a security incident materially affecting your information, we will notify you in accordance with applicable law.

x. Children.

This site and our services are not directed to children under the age of sixteen. We do not knowingly collect personal information from minors. If you believe a minor has provided personal information to us, please contact us at the address in Section v and we will delete it.

xi. Changes to this notice.

We will update this notice from time to time. The “Last updated” date at the top of the document indicates the most recent revision. Material changes will be flagged prominently here, and where required by law, communicated to clients directly.

xii. Contact.

Questions about this notice, or about how we handle your information, may be directed to the privacy contact in Section v. We respond personally and within the regulatory window.