Privacy Policy

Last updated: 19 August 2026. Cornerstone Consulting LLC, a Kentucky limited liability company ("we", "us").

1. What this policy covers

This policy explains what data we process, why, how long we keep it, and how to have it deleted. It covers two separate things: information about visitors to this website and people who contact us, and social media comment data we process on behalf of our clients. The second is the substance of our service and is governed by section 4.

2. Website visitors and enquiries

If you email us, we hold your name, email address, and whatever you choose to tell us, for as long as needed to respond and to maintain a record of the enquiry. We do not run advertising trackers, we do not use tracking pixels in our email, and we do not sell or share enquiry data with anyone.

3. Client engagement data

When a client engages us, we hold the client contacts, contract and billing records necessary to run the engagement, for the period required by law and our professional obligations.

4. Social media comment data processed for clients

What we process

Where a client authorises us, we access public comments and replies on the client's own Facebook Pages and Instagram Business accounts through Meta's official Graph API. This includes comment text, timestamps, engagement counts, and the commenter's public username or user identifier. We do not scrape, and we do not access private messages.

Our role and legal basis

We act as a service provider and processor on behalf of the client, and only on the client's documented instructions. The client is the controller of that data and determines the purpose. Where UK or EU data protection law applies, processing is carried out under the client's lawful basis and under a written data processing agreement.

What we do not do with it

We do not combine one client's data with another client's data. Each client's data is stored separately.
We do not use client data for our own purposes, including research, benchmarking or marketing.
We do not sell, license or otherwise commercialise it.
We do not use it to train or fine-tune machine learning models, and our AI processing vendors are contractually bound to the same restriction with zero data retention enabled.
We do not build profiles of individual commenters.

Sub-processors

We use a small number of vendors — cloud hosting, and AI language model providers for text classification — each engaged under a written agreement requiring them to process data only on our instruction and for no other purpose. A current list is available on request to rollie@cornerstoneconsultingky.com.

Retention

Comment data is retained only as long as necessary for the engagement and any agreed follow-up period, and in any event is deleted at the client's instruction, on request from an individual whose data it contains, or when the engagement ends — whichever comes first.

5. Data deletion

You may request deletion of personal data we hold about you at any time, and we will act on it promptly and without charge.

To request deletion, email rollie@cornerstoneconsultingky.com with the subject line "Data deletion request". Include the platform (Facebook or Instagram), your username or profile link, and the brand whose page your comment appeared on if you know it.
We will confirm receipt within 5 business days and complete deletion within 30 days.
If your data was processed on behalf of a client, we will also notify that client, as they are the controller.
You may also delete or edit your comment on the platform itself. Where you do, we remove it from our records on our next scheduled refresh, and immediately on request.

If you reached this page from a Facebook or Instagram data deletion link, this section is the deletion instruction URL for that purpose.

6. Your rights

Depending on where you live you may have rights to access, correct, delete, port or restrict processing of your personal data, and to object to it. Contact rollie@cornerstoneconsultingky.com and we will respond within the period required by the applicable law. We do not discriminate against anyone for exercising these rights. If you are in the UK or EU and are dissatisfied with our response, you may complain to your supervisory authority.

7. Security

We maintain administrative, technical and physical safeguards appropriate to the data we hold, including per-client data separation, encryption in transit and at rest, access controls, and defined retention limits. See our security page for how to report a vulnerability.

8. Changes and contact

We will post any material change to this policy on this page and update the date above. Questions: rollie@cornerstoneconsultingky.com, or Cornerstone Consulting LLC, PO Box 910505, Lexington, KY 40591.