Last updated: August 7, 2026
Information we collect
When you contact us
- Identifiers — your name and email address.
- Inquiry context — the market, matter type, and message you choose to provide.
- Correspondence — follow-up communications and consultation notes.
If you use the Private Office
- Account and security information — account identity, access role, session records, and staff multi-factor authentication records where applicable.
- Engagement information — engagement scope, documents, messages, workflow activity, and permitted client or contractor contacts.
- Commercial records — contracts, invoices, change orders, and payment-status records. Payment-card details are handled by the payment processor, not stored by James Roman Advisory.
Technical information
Our hosting and security systems process ordinary request and security information, including IP address, user-agent information, request time, and page or API request. The Private Office also uses strictly necessary session and authentication cookies described in the Cookie Policy.
How we use information
- To respond to an inquiry and arrange a consultation.
- To deliver an engagement, communicate with permitted participants, and maintain the engagement record.
- To authenticate users, enforce access scope, protect the system, and investigate misuse or unauthorized access.
- To issue, administer, and reconcile commercial records and payments.
- To comply with legal, professional, accounting, and recordkeeping obligations.
We do not operate advertising trackers or build marketing profiles from Private Office activity. We do not use engagement information to make solely automated decisions about you.
Service providers and disclosures
We use carefully selected providers to operate the service, including Vercel for hosting and private file storage, Neon for application data, Resend for transactional email, Stripe for payment processing, and a distributed rate-limit provider where configured. They process information only as needed to provide their services to us.
We may disclose engagement information to counsel, insurers, laboratories, contractors, or other professionals only where the engagement, your instructions, or applicable law permits it. We may also disclose information when legally compelled and, where permitted, will notify the affected client first.
California privacy rights
California residents may have rights to request access to, correction of, or deletion of personal information, and to obtain information about its collection and disclosure. We will verify a requestor's identity and respond within the period required by applicable law. Some requests may be limited by legal, professional, security, and recordkeeping obligations.
To make a privacy request, email roman@jamesroman.la with the subject line “Privacy Request.” Authorized agents may be asked to provide proof of authority and may require separate identity verification.
Retention and security
We retain information only for as long as reasonably necessary for the purpose for which it was collected, the engagement terms, and applicable obligations. Retention periods for engagement records are subject to the operative engagement documents and the firm's counsel-approved retention schedule.
We use administrative, technical, and physical safeguards designed to protect information. No system is immune from risk; if an incident materially affects information, we will respond in accordance with applicable law and the relevant engagement obligations.
Changes and contact
We may update this notice as the service, its providers, or applicable requirements change. The date at the top identifies the latest revision. Questions about this notice may be sent to roman@jamesroman.la.