Privacy Policy

Effective Date: March 23, 2026  ·  Last Updated: March 23, 2026

This Privacy Policy describes how Liam J Penwell, Attorney at Law ("we," "us," or "our") collects, uses, and discloses personal information through our website located at www.penwell.law (the "Website"). This Privacy Policy is provided in compliance with the California Online Privacy Protection Act (Cal. Bus. & Prof. Code §§ 22575-22579), the Federal Trade Commission Act (15 U.S.C. § 45), and other applicable federal and state laws.

By accessing or using the Website, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with the practices described herein, please do not use the Website.

Information We Collect

Information You Provide Directly

When you submit an inquiry through our contact form, we may collect the following categories of personally identifiable information ("PII"):

• Your name
• Your email address
• Your telephone number
• The content of your message

We strongly advise you not to include sensitive, privileged, or detailed confidential information in any contact form submission. As described in our Terms of Use and in the contact form disclaimer, information submitted through the Website is not confidential and is not protected by the attorney-client privilege.

Information Collected Automatically

When you visit the Website, certain information is collected automatically through standard server operations and our third-party service providers:

• Server Logs: Our web hosting provider may automatically record your IP address, browser type and version, operating system, referring URLs, pages visited, date and time of access, and other standard log data.

• Cloudflare: Our Website uses Cloudflare, Inc. ("Cloudflare") for content delivery, performance optimization, and security services. In the course of providing these services, Cloudflare may process your IP address, HTTP request headers (including user agent and referrer), traffic routing data, and browser characteristics for bot detection and threat mitigation purposes. Cloudflare sets the following strictly necessary cookies on your device:

  Cookie	Purpose	Duration
  __cf_bm	Bot management. Distinguishes human visitors from automated traffic. Data is encrypted and readable only by Cloudflare.	30 minutes of inactivity
  cf_clearance	Stores proof that a visitor passed a Cloudflare security challenge to prevent repeated challenges.	30 minutes (default)
  __cfruid	Rate limiting. Helps distinguish individual visitors who share an IP address.	Session (expires when browser closes)

  These cookies are classified as strictly necessary for Website operation, do not track you across other websites, and do not correspond to any user ID or profile. No opt-in consent is required for strictly necessary cookies under California law.

  For more information about how Cloudflare processes data, please review Cloudflare's Privacy Policy.

• Cloudflare Web Analytics: Our Website may use Cloudflare Web Analytics, a privacy-focused analytics service that collects aggregated, anonymized traffic data. This service does not use cookies, does not use browser fingerprinting, does not perform cross-site tracking, and strips IP addresses at the network edge before any data is stored. No personally identifiable information is collected or retained through this service.

How We Use Your Information

We use the information we collect for the following purposes:

• To respond to your inquiries submitted through the contact form
• To evaluate potential conflicts of interest in connection with prospective legal engagements
• To maintain internal records for conflict-checking and business administration
• To operate, maintain, and secure the Website
• To comply with applicable legal and ethical obligations

We do not use your information for behavioral advertising, user profiling, or automated decision-making.

How We Share Your Information

We do not sell, rent, or trade your personally identifiable information to third parties for their marketing purposes. We may share your information with the following categories of third parties, solely as necessary to operate the Website and our law practice:

• Cloudflare, Inc.: As described above, for content delivery, security, and Website performance services. Cloudflare acts as a data processor on our behalf and does not sell or share visitor personal data for its own purposes.
• Web Hosting Provider: Our hosting provider processes server requests and maintains server logs in the ordinary course of providing hosting services.
• Email Service Provider: If you contact us by email or through the contact form, your message may be transmitted and stored through our email service provider.
• Legal and Regulatory Authorities: We may disclose information if required to do so by law, subpoena, court order, or other legal process, or if we believe in good faith that such disclosure is necessary to comply with applicable law, protect our rights, or respond to a government request.

Cookies and Tracking Technologies

The Website uses only strictly necessary cookies set by Cloudflare, as described above. We do not use advertising cookies, analytics cookies that track individual behavior, social media pixels, or any other cross-site tracking technologies.

Do Not Track Signals

Your browser may offer a "Do Not Track" ("DNT") setting. Because the Website does not engage in cross-site tracking of individual users, the Website's behavior does not change in response to DNT signals. No third parties collect personally identifiable information about your online activities over time and across different websites when you use our Website.

Data Retention

We retain contact form submissions and related correspondence for as long as necessary to fulfill the purposes for which the information was collected, including to satisfy conflict-checking obligations under the California Rules of Professional Conduct and applicable legal retention requirements. Server logs maintained by our hosting provider and Cloudflare are retained in accordance with their respective retention policies. Cloudflare edge access logs are typically deleted within approximately four hours for non-Enterprise customers.

Data Security

We implement and maintain reasonable administrative, technical, and physical security measures designed to protect the personally identifiable information we collect from unauthorized access, disclosure, alteration, and destruction, in compliance with California Civil Code § 1798.81.5. However, no method of electronic transmission or storage is completely secure, and we cannot guarantee absolute security.

Your Rights and Choices

Reviewing or Requesting Changes to Your Information

If you have submitted information through our contact form and wish to request access to, correction of, or deletion of that information, please contact us at [email protected]. We will make reasonable efforts to respond to your request in a timely manner, subject to our legal and ethical obligations to retain certain records for conflict-checking and other professional responsibility purposes.

California Consumer Privacy Act (CCPA/CPRA)

The CCPA/CPRA applies to for-profit businesses meeting specific revenue and data-processing thresholds set forth in Cal. Civ. Code § 1798.140(d). As a solo law practice, we do not meet these thresholds. However, we respect your privacy rights. If you have questions about your personal information or wish to submit a request regarding your data, please contact us using the information provided below.

Children's Privacy

The Website is not directed to children under the age of 13, and we do not knowingly collect personally identifiable information from children under 13. If we become aware that we have inadvertently collected personal information from a child under 13, we will take steps to delete that information promptly.

Third-Party Websites

The Website may contain links to third-party websites or resources. We are not responsible for the privacy practices, content, or security of any third-party websites. We encourage you to review the privacy policies of any third-party websites you visit. The inclusion of a link on the Website does not imply endorsement of the linked site or its content.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes, we will update the "Last Updated" date at the top of this page and post the revised Privacy Policy on the Website. We encourage you to review this Privacy Policy periodically. Your continued use of the Website after any changes constitutes your acceptance of the updated Privacy Policy.

Contact Information

If you have questions about this Privacy Policy or our data practices, you may contact us at: