Privacy Policy

1. Who We Are

Our primary website address is: https://sdmgeo.com (operated by Top Gun Holdings CO d/b/a Schoneke Digital Media / SD Media).

SD Media is committed to protecting your privacy and ensuring that your personal data is handled safely, ethically, and transparently in full compliance with search engine guidelines and applicable data protection regulations.

2. Lead Intake, Diagnostic & Strategy Session Submissions

When executives or prospective clients submit contact inquiries, request a free GEO/SEO domain diagnostic, download executive resource assets, or schedule a strategy session on our website, we collect the business contact details, corporate domain, revenue tier, and operational objectives provided in the form.

To protect our systems from automated bot abuse, credential stuffing, and spam submissions, our API routes check basic request security details, including IP rate-limiting tokens, HTTP security headers (Sec-Fetch-Site), and form timing checks, before sending qualified lead records to our CRM.

3. Domain Diagnostics & Public Search Telemetry

When you submit a business domain for a Generative Engine Optimization (GEO), Answer Engine Optimization (AEO), or Local SEO diagnostic, our analysts and audit tools inspect publicly available search signals, including Schema.org JSON-LD markup, sitemap rules, Core Web Vitals, and AI citation visibility across major Large Language Models.

4. First-Party Attribution, Session Storage & Consent Mode v2

We use lightweight first-party session storage (`localStorage` and `sessionStorage`) to preserve campaign attribution parameters (`utm_source`, `utm_medium`, `utm_campaign`, click identifiers, and landing page URLs) so that executive consultations are accurately attributed to the originating search or research channel.

Our analytics implementation enforces Google Consent Mode v2 and automatically honors browser-level Global Privacy Control (`navigator.globalPrivacyControl`) and Do Not Track (`DNT: 1`) signals by restricting advertising storage and cross-site behavioral tracking when privacy signals are active.

5. Embedded Content From External Sites

Articles and service descriptions on this site may include embedded content (e.g., videos, charts, research widgets, or interactive tools). Embedded content from third-party websites behaves in the exact same manner as if the visitor had visited the external website directly.

These third-party websites may collect data about you, use cookies, embed additional third-party tracking tools, and monitor your interaction with that embedded content.

6. Data Sharing & Retention

Form submissions, lead qualification details, and metadata are retained indefinitely to enable continuous account management, automated workflow follow-up, and compliance tracking.

We do not sell, rent, or trade your personal information to third-party data brokers. Information is shared strictly with authorized operational automation sub-processors (such as CRM routing engines and scheduling infrastructure) required to deliver our services.

7. Your Data Rights (CCPA / CPRA & GDPR)

If you have submitted inquiries or established an account with SD Media, you can request an exported file of the personal data we hold about you. You may also request that we correct or erase any personal data we hold. This excludes data we are obligated to retain for administrative, legal, regulatory, or security purposes.

California residents (under the CCPA/CPRA) and international visitors (under GDPR) have the right to know what categories of personal data are collected, the business purpose for collection, and the right to non-discrimination when exercising privacy rights.

8. AI Workflow Processing & Security Governance

When you submit a strategy inquiry or interact with SD Media's automated lead qualification workflows, your submission payload is transmitted over TLS-encrypted connections to our enterprise CRM and workflow orchestration infrastructure. We do not use confidential client inquiry data or proprietary business metrics to train public foundation models.

All API keys, webhook signatures, and CRM sub-processor integrations are governed by strict role-based access controls (RBAC) and periodic security audits.