MITO

Privacy Notice

Last updated 3 September 2026

This notice explains how Crest Advisory Group LLC (“Crest,” “we,” “us”), which operates the MITO programme, handles information collected through mitomoat.com (the “Site”). It covers this Site only. It is not a contract and does not create rights beyond those given by applicable law.

1. What we collect

The Site has no accounts, no advertising and no third-party analytics. We collect information in two ways.

We do not set analytics or advertising cookies. Cloudflare Turnstile may set a short-lived token in your browser as part of the challenge described below.

2. Bot verification

The contact form runs a Cloudflare Turnstile challenge, which is designed to confirm that a submission comes from a person rather than an automated script. Turnstile is provided by Cloudflare, Inc. and processes limited technical signals from your browser for that purpose. It does not require you to solve a puzzle in most cases, and it is not used to profile you.

3. Why we hold it

We use what you send solely to read your note, reply to it, and keep a record of the conversation. Our lawful basis, where the UK or EU GDPR applies, is our legitimate interest in responding to business enquiries addressed to us. The IP hash and user-agent are retained for security and abuse prevention, including the rate limiting described below.

4. Rate limiting

To limit abuse, the Site counts recent submissions per IP hash and may decline further submissions from the same source for a short period. This uses the hash only; it does not identify you.

5. Who sees it

Contact submissions are read by the MITO founders and a small number of Crest personnel who support them. We do not sell personal information, we do not share it with advertisers, and we do not add you to any marketing list or newsletter.

The Site is hosted on Cloudflare Workers and submissions are stored in Cloudflare D1, both operated by Cloudflare, Inc. as our processor. We may disclose information where we are compelled by law, or where disclosure is necessary to protect rights, safety or property. Fonts are served by Google Fonts, which receives your IP address as a technical consequence of the request.

6. Where it is held, and for how long

Submissions are stored in Cloudflare’s Eastern North America region. If you are outside the United States, this means your information is transferred there; where required, such transfers rely on the standard contractual clauses in our processor’s terms.

We anticipate retaining contact submissions for up to 24 months from the last exchange, after which they are deleted, unless a longer period is required for a live discussion or by law. Retention periods are subject to change at our sole discretion.

7. Your choices

Depending on where you live, you may have the right to ask for a copy of the information we hold about you, to have it corrected or deleted, to object to or restrict our use of it, and to complain to your data protection authority. To make a request, write to [email protected]. We may need to confirm your identity before we act, and we aim to respond within the period the applicable law allows.

8. Security

The Site is served over TLS and submissions are stored on Cloudflare infrastructure with access limited to those who need it. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Please do not send confidential deal information, personal data about third parties, or anything you would not want held in an email system through this form.

9. Children

The Site is directed to business professionals and is not intended for anyone under 18. We do not knowingly collect information from children.

10. Changes

We may update this notice at our sole discretion. The version published here, with the date shown above, is the current one.

11. Contact

Crest Advisory Group LLC — [email protected]