Who we are

We provide marketing services to service-based businesses in the United States. We primarily serve U.S. visitors and customers.

Information we collect

• Identity: name, company, role/title
• Contact: email, phone, mailing address
• Account: login/username, hashed passwords, user IDs
• Device/Usage: IP address, cookies, analytics data, pages viewed, UTM parameters, session data
• Marketing: email/SMS opt-ins, preferences, message history
• Payments: processed by Stripe; we do not collect or store full card numbers (Stripe may provide limited billing details such as last4 or tokens)
• Files/Media: content you upload or send us
• Sensitive data: we do not intentionally collect special-category data
• Minors: we do not target or knowingly collect data from individuals under 16/18

How we collect it

• Forms, chat widgets, booking calendars, surveys
• Email/SMS/phone interactions and voluntary submissions (no call recording/tracking)
• Cookies/pixels and similar technologies
• Publicly available sources and third-party enrichment (we use public databases and custom AI tools to locate business-related, non-sensitive information wherever avoidable)

Why we use it (purposes)

• Sales and service delivery (quotes, demos, onboarding, account management)
• Marketing (email/SMS, advertising, retargeting, lookalike audiences)
• Analytics and product/service improvement
• Security, fraud prevention, and legal compliance/recordkeeping

Cookies, ads, and tracking

• We use analytics and advertising cookies/pixels, including for retargeting (“cross-context behavioral advertising”).
• Consent banner: in place (notice/assumed consent). You can adjust your browser settings to block cookies.
• Do Not Track (DNT): we do not respond to DNT signals.
• Global Privacy Control (GPC): not honored at this time.
• “Sale”/“Sharing” (California): we do not sell or share personal information as defined by applicable law.

SMS and email

• Email: collected via newsletter sign-ups, purchases, or requests. You can unsubscribe via the link in our emails or by emailing us.
• SMS: we obtain consent before sending texts (e.g., you text us first or opt in via our forms). Reply STOP to end, HELP for help. Message frequency varies; message/data rates may apply. We store consent records in our CRM (GoHighLevel).

Our role and processors

• Role: We are the controller for our own sales/marketing data. We act as a processor/service provider for client-provided data under their instructions.
• Data Processing Addendums (DPAs): we do not currently offer a standard DPA; contact us to discuss if needed.
• Sub-processors (representative list; subject to change):
  • CRM/Messaging: GoHighLevel
  • Cold outreach/prospecting: Smartlead, Zerobound, nobounce, custom AI tools
  • Advertising platforms: Google/Microsoft Ads, Meta, LinkedIn, TikTok, YouTube
  • Analytics/Ops: Google Analytics/Tag Manager/Search Console, Hotjar/Microsoft Clarity, SE Ranking, Screaming Frog
  • Automation: Zapier
  • Payments/Billing: Stripe
  • Storage/Collaboration/Security: Google Drive (Google Workspace), Vaultwarden
  • Forms/Booking: GoHighLevel Forms

How we share information

We share personal information with the service providers listed above to operate our services, fulfill requests, conduct analytics/advertising, process payments, and comply with law. We do not sell or share personal information as those terms are defined under California law. If we undergo a business transaction (e.g., merger, acquisition), information may transfer as permitted by law.

Data location and transfers

We store and process data primarily in the United States and do not intentionally transfer personal information outside the U.S.

Retention

We retain information indefinitely unless a shorter period is required by law or you request deletion and we are able to honor it. We also retain records as needed for legal, tax, fraud-prevention, and security purposes.

Security

We use reasonable administrative, technical, and organizational measures, including least-privilege access, password managers, OAuth-based integrations, encryption in transit (HTTPS), and account access controls. No method of transmission or storage is 100% secure.

Your privacy rights (U.S.)

Depending on your state law and eligibility, you may have rights to:

• Access/know the personal information we hold about you
• Correct inaccuracies
• Delete personal information
• Opt out of targeted advertising
• Obtain a portable copy of your data

How to exercise your rights: email [email protected]. We will verify requests by matching your name and email with our records. You may use an authorized agent by emailing us from your account and providing written permission. Appeals (where required): email [email protected] with “Privacy Appeal” in the subject line.

Children’s privacy

Our services are not directed to minors under 16/18. We do not knowingly collect their data. If you believe a minor provided data to us, contact us and we will take appropriate action.

Changes to this Policy

We may update this Policy from time to time. We will maintain a “Last updated” date and notify active clients by email of material changes.