Privacy Policy | Ochil Hills Management

Ochil Hills Management LLC — CAIRN (CFO Analytics, Insights & Real-time Numbers)
Last Updated: March 18, 2026

1. Introduction

Ochil Hills Management LLC (“Ochil Hills,” “Company,” “we,” “us,” or “our”) is a Washington limited liability company that provides fractional CFO and COO services and operates CAIRN — CFO Analytics, Insights & Real-time Numbers (the “Platform”), a financial planning and analysis tool for business intelligence dashboards, reports, and analytics.

This Privacy Policy explains how we collect, use, disclose, and protect your information when you visit our website at ochilmanagement.com (the “Website”), use CAIRN, or otherwise interact with our services. By accessing or using our Website or the Platform, you acknowledge that you have read and understood this Privacy Policy.

This Privacy Policy should be read in conjunction with our Terms of Service, which govern your use of the Platform.

2. Information We Collect

2.1 Information You Provide Directly

We collect information that you voluntarily provide to us, including:

Contact form submissions: When you submit our contact form, we collect your name, email address, phone number, company name, revenue range, services of interest, and any additional information you include in the message field. Contact form submissions are processed through a third-party form handling service.
Account information: When you create a CAIRN account, we collect your name, email address, company name, and account credentials.
Communications: When you email us, schedule a consultation, or otherwise communicate with us, we collect the content of those communications and any information you provide.

2.2 Financial Data from Connected Accounting Systems

If you are a CAIRN client, the Platform connects to your third-party accounting systems to import financial data for analysis and reporting purposes. This may include:

General ledger transactions and chart of accounts data
Accounts receivable and accounts payable records
Revenue, expense, and payroll data
Balance sheet and income statement data
Bank account and financial institution data
Entity, department, and class-level financial data
Currency and intercompany transaction data

This financial data (“Your Data”) is imported solely for the purpose of providing Platform services to you. Your accounting system remains the authoritative source of truth for all financial records. For details on data ownership and rights, please refer to Section 4 of our Terms of Service.

2.3 Information Collected Automatically

When you visit our Website, we automatically collect certain information through Google Analytics 4 (GA4) and standard web technologies, including:

Device and browser information: Browser type and version, operating system, device type, screen resolution, and language preferences.
Usage data: Pages visited, time spent on pages, scroll depth, click interactions, referring URLs, and navigation paths through the Website.
Network information: IP address (anonymized by GA4), approximate geographic location derived from IP address, and internet service provider.
Engagement metrics: CTA button clicks, contact form interactions, outbound link clicks, email and phone link clicks, and scroll depth milestones (25%, 50%, 75%, 100%).

3. How We Use Your Information

We use the information we collect for the following purposes:

3.1 Service Delivery and Platform Operation

Providing, operating, and maintaining the CAIRN platform and related services
Processing and transforming your financial data to generate dashboards, reports, and analytics
Authenticating users and managing account access
Providing customer support and responding to inquiries

3.2 Communication

Responding to contact form submissions and consultation requests
Sending service-related communications, including account notifications and Platform updates
Communicating about changes to our terms, policies, or services

3.3 Website Analytics and Improvement

Analyzing Website traffic and user behavior to improve our Website and content
Understanding how visitors find and interact with our Website
Measuring the effectiveness of our content and calls to action
Identifying and resolving technical issues

3.4 Platform Improvement

Improving, enhancing, and developing new features for CAIRN
Generating aggregated and anonymized benchmarks and insights (see Section 4.3 of our Terms of Service)
Monitoring Platform performance and reliability

3.5 Legal and Compliance

Complying with applicable laws, regulations, and legal processes
Enforcing our Terms of Service and other agreements
Protecting our rights, property, and safety, and the rights, property, and safety of our users and others

4. Legal Basis for Processing

We process your information based on the following legal grounds, as applicable under the General Data Protection Regulation (GDPR) and similar data protection laws:

Performance of a contract: Processing Your Data through the Platform is necessary to perform our contractual obligations to you under the Terms of Service or applicable Master Service Agreement.
Legitimate interests: We process Website analytics data and usage information based on our legitimate interest in understanding how our Website and Platform are used, improving our services, and communicating with prospective and current clients. We balance these interests against your privacy rights.
Consent: Where required by applicable law, we process your information based on your consent, such as when you submit a contact form or opt in to communications. You may withdraw consent at any time by contacting us.
Legal obligation: We may process your information to comply with applicable legal obligations, such as tax, accounting, or regulatory requirements.

5. Data Sharing and Third Parties

We do not sell, rent, or trade your personal information to third parties. We share your information only in the following circumstances:

5.1 Service Providers

We engage third-party service providers to assist in operating our Website and Platform. These providers process your information solely on our behalf and under our instructions:

Form processing: Contact form submissions are transmitted through a third-party form handling service for delivery to our team.
Website analytics: We use Google Analytics 4 (GA4) to collect and analyze Website usage data. GA4 processes data on Google’s servers. You can learn more about Google’s data practices in the Google Privacy Policy and opt out using the Google Analytics Opt-out Browser Add-on.
Website hosting and security: Our Website is served through a content delivery and web security provider that may process network-level data (IP addresses, request headers) for performance optimization, caching, and security threat mitigation.
Cloud infrastructure: Platform data is stored and processed on cloud infrastructure providers that maintain industry-standard security certifications.
Accounting system integrations: The Platform connects to your third-party accounting systems through authorized API integrations. We access only the data necessary to provide Platform services, and only with your authorization.

5.2 Legal Requirements

We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., a court order, subpoena, or government regulation), or if we believe in good faith that disclosure is necessary to protect our rights, your safety or the safety of others, investigate fraud, or respond to a legal request.

5.3 Business Transfers

In the event of a merger, acquisition, reorganization, bankruptcy, or other similar event, your information may be transferred as part of that transaction. We will notify you of any such change and any choices you may have regarding your information.

5.4 With Your Consent

We may share your information with third parties when we have your explicit consent to do so.

6. Data Security

We take the security of your information seriously and implement administrative, technical, and physical safeguards designed to protect your information from unauthorized access, use, alteration, or disclosure. Our security measures include:

Encryption: Data is encrypted in transit using TLS/SSL and at rest using industry-standard encryption algorithms.
Access controls: Access to client data is restricted to authorized personnel on a need-to-know basis, with role-based access controls and multi-factor authentication.
Infrastructure security: Our Platform is hosted on cloud infrastructure with industry-standard security certifications, network isolation, and continuous monitoring.
Data pipeline security: Financial data extracted from your accounting systems is transmitted through secure, encrypted connections. Data transformation and storage processes operate within isolated, access-controlled environments.
Regular assessments: We conduct regular security reviews and assessments of our systems and processes.

While we strive to protect your information, no method of transmission over the Internet or method of electronic storage is completely secure. We cannot guarantee the absolute security of your information.

7. Data Retention

7.1 Website Data

Google Analytics data is retained in accordance with our GA4 configuration settings. Contact form submission data is retained for as long as necessary to respond to your inquiry and maintain a record of our communications, or as required by applicable law.

7.2 Platform Client Data

We retain Your Data for the duration of your access to the Platform. Upon termination of your access, we retain Your Data for a period of thirty (30) days, during which you may request an export. After this period, we may delete Your Data from our systems, except as required to comply with legal obligations, resolve disputes, or enforce our agreements. For full details, see Section 4.4 of our Terms of Service.

7.3 Aggregated and Anonymized Data

Aggregated and anonymized data that does not identify you or any individual may be retained indefinitely for research, benchmarking, and Platform improvement purposes.

8. Your Rights

Depending on your location and applicable law, you may have the following rights regarding your personal information:

Right of access: You may request a copy of the personal information we hold about you.
Right to correction: You may request that we correct inaccurate or incomplete personal information.
Right to deletion: You may request that we delete your personal information, subject to certain legal exceptions.
Right to data portability: You may request a copy of your personal information in a structured, commonly used, machine-readable format.
Right to restrict processing: You may request that we restrict the processing of your personal information in certain circumstances.
Right to object: You may object to our processing of your personal information based on legitimate interests.
Right to withdraw consent: Where processing is based on consent, you may withdraw your consent at any time without affecting the lawfulness of processing performed before withdrawal.
Right to opt out of analytics: You may opt out of Google Analytics tracking by installing the Google Analytics Opt-out Browser Add-on or by adjusting your browser’s cookie settings.

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within thirty (30) days or as required by applicable law. We may ask you to verify your identity before processing your request.

If you are located in the European Economic Area (EEA) or United Kingdom and believe our processing of your personal information violates applicable data protection law, you have the right to lodge a complaint with your local data protection supervisory authority.

9. Cookies and Tracking Technologies

9.1 Cookies We Use

Our Website uses cookies and similar tracking technologies. The primary cookies on our Website are set by Google Analytics 4 (GA4) for the purpose of analyzing Website traffic and usage patterns. These cookies include:

_ga: Used to distinguish unique users. Expires after 2 years.
_ga_[ID]: Used to persist session state. Expires after 2 years.

GA4 cookies collect information such as pages visited, time on site, scroll depth, button clicks, and general engagement metrics. GA4 anonymizes IP addresses before storage.

9.2 Essential Cookies

Our Website may also use essential cookies necessary for Website functionality, such as theme preference (light/dark mode) and session management. These cookies do not track you across other websites.

9.3 Managing Cookies

You can manage or disable cookies through your browser settings. Most browsers allow you to:

View and delete existing cookies
Block all cookies or only third-party cookies
Set preferences for specific websites

Please note that disabling cookies may affect the functionality of our Website. You can also opt out of Google Analytics specifically by installing the Google Analytics Opt-out Browser Add-on.

9.4 Do Not Track

Our Website does not currently respond to “Do Not Track” (DNT) browser signals, as there is no industry-standard protocol for DNT compliance. We will update this policy if a standard is established.

10. Children’s Privacy

Our Website and Platform are not directed to children under the age of thirteen (13), and we do not knowingly collect personal information from children under 13. If we become aware that we have collected personal information from a child under 13, we will take steps to delete such information promptly. If you believe we have collected information from a child under 13, please contact us at [email protected].

11. International Data Transfers

Ochil Hills is based in the United States. If you access our Website or Platform from outside the United States, your information may be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your country of residence.

By using our Website or Platform, you consent to the transfer of your information to the United States. Where required by applicable law (such as the GDPR), we rely on appropriate legal mechanisms for international data transfers, including standard contractual clauses or your explicit consent.

Our third-party service providers may also process your data in jurisdictions outside your country of residence. We require all service providers to maintain appropriate safeguards for the protection of your personal information.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes, we will update the “Last Updated” date at the top of this page and post the revised Privacy Policy on our Website.

We encourage you to review this Privacy Policy periodically. Your continued use of our Website or Platform after any changes constitutes your acceptance of the updated Privacy Policy. If we make changes that materially affect your rights, we will provide additional notice as appropriate, such as via email or a prominent notice on our Website.

13. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

Ochil Hills Management LLC
Email: [email protected]
Website: https://ochilmanagement.com

We will endeavor to respond to all privacy-related inquiries within thirty (30) days.