Twenty states now have a comprehensive privacy law and they do not agree with each other. Most of them only reach a business over a size threshold, which a company of ours is comfortably under in nearly every one. Two states set no volume threshold at all. We could have worked out, state by state, which rights we owe you and which we do not. Instead we took the strictest version of every right, every deadline and every protection, and gave it to everybody: to every reader of this page, in all fifty states, whether or not the statute of the state you live in reaches us. Nothing in this document is written as “where required by law”, because that phrase is how a business keeps the option of doing less. Anything you want to ask goes to [email protected], and the answer does not depend on your zip code.
Who is responsible for your data #
DEVIQO decides what happens to the personal data described here, so DEVIQO is answerable for it.
Fumo Media LLC, a company formed in the State of Wyoming and trading as DEVIQO, is the business responsible for the personal data described in this policy. That is the word the US state privacy statutes use for the company that decides what happens to your data and answers for it, and it is us. Our mailing address is Fumo Media LLC, 1910 Thomes Ave., Cheyenne, WY 82001-3527, United States and our Wyoming filing ID is 2024-001553648. The same details are on every invoice we send.
Most of those statutes only apply to a company above a size threshold, usually 100,000 residents’ worth of data, and a business of ours is under that threshold in nearly every state that sets one. Two states, Texas and Nebraska, set no volume threshold at all and instead exempt small businesses by federal size standard. We do not rely on any of those exemptions and we do not intend to. We treat ourselves as a covered business everywhere, and every right in section 12 is available to every reader of this page.
For anything to do with your data, write to [email protected]. That is our designated privacy contact and it reaches the person responsible. General questions go to [email protected] or to live chat, and either way you get an answer in writing.
No privacy law that applies to us requires a formal data protection officer, and we have not appointed one. Responsibility sits with the people who run the company.
Who this policy is about #
It covers three groups of people:
- Visitors to deviqo.com. Anyone reading this page, using the live chat or leaving an email address.
- Customers. Anyone who has ordered a website or hosting, and the named people at a customer business.
- People who apply to work with us, or who ask about the partner program.
It does not cover the personal data of your customers, which arrives through your website, your store or your mailbox. That belongs to you and you decide what happens to it. We hold it on your behalf as your processor, and the terms of that arrangement are in section 14.
It also does not cover other people’s websites. If you follow a link from here to someone else’s site, their policy applies once you arrive.
The personal data we hold #
Your contact details, your account, what you told us about your business, a record of your payments, our conversations with you, and the ordinary technical record every web server keeps.
| Category | What is in it | Where we got it |
|---|---|---|
| Identity and contact | Your name, your business name, email address, mailing address, the domain you use. | From you, when you order or get in touch. |
| Account | Your login and a hashed password, which plan you are on, your dashboard settings, the dates things happened. | Created when your account is opened, then added to as you use it. |
| What you told us about the business | Your questionnaire answers: services, prices, opening hours, area covered, photographs, staff names and roles if you gave them. | From you. This may include personal data about your staff, so please only send what is needed. |
| Payment | Your invoices, what was paid and when, the payment reference, the billing address, and the card type, expiry month and last four digits. We never hold the full card number. | From Stripe, our payment processor, which takes the card details directly. |
| Conversations | Emails to and from us, live chat transcripts, and the notes our team makes on your account. | From the conversation itself. |
| Technical | IP address, browser and device type, referring page, pages viewed, dates and times, and error and security logs. | Recorded automatically by our servers, as on every website. |
| Marketing | Whether you are on our list, when you joined, whether you have unsubscribed, and whether our emails were opened. | From you, when you subscribe or when you order. |
We do not ask for and do not want special category data: health, ethnicity, religion, politics, trade union membership, sexual orientation, biometrics or genetics. If your trade means such data ends up on your website, for example a clinic listing treatments, that is your content and your responsibility under section 14. Please do not send special category data to our support team.
We do not buy personal data from anyone and we do not scrape it.
What we use it for, and what you can stop #
Every use we make of your data, why we make it, and whether you can tell us to stop. Where the answer is that you can, it is one line to us and it costs you nothing.
US privacy law does not ask a business to name a legal basis the way European law does. It asks two different things: that you say what each use is for, and that you say clearly which uses a person can opt out of. So that is what the third column does.
| What we do | Data used | Why, and whether you can stop it |
|---|---|---|
| Build your website and put it live | Identity and contact, account, what you told us about the business | To do the thing you paid for. We cannot build the site without it, so this one cannot be switched off while a build is running. Cancel and it stops. |
| Register and manage your domain | Identity and contact | To do the thing you paid for. The registry requires a named registrant and that name is yours, so this is a condition of owning a domain rather than a choice we made. |
| Host the site and run the mailbox | Account, technical | To do the thing you paid for. |
| Take the $1 and the monthly payment | Identity and contact, payment | To take the payment you authorized and to leave you a receipt and an invoice you can produce later. |
| Keep accounting and tax records | Payment, identity and contact | Because the law makes us. The Internal Revenue Service can normally assess for three years and for six where income is substantially understated, and state revenue departments set their own periods for sales tax records, commonly three to four years. We keep these for seven years after the tax year and we cannot delete them on request, which is the one place a deletion request meets a hard stop. Section 9 has the periods. |
| Spot and stop fraudulent payments | Payment, technical | To stop card fraud against you and against us. This is not something we offer to switch off, because switching it off is exactly what someone using a stolen card would ask for. |
| Answer your questions and fix your problems | Conversations, account, technical | To answer the thing you asked. If you were never a customer and would rather we did not keep the exchange, say so and we delete it. |
| Email you about the service: an outage, a price change, a renewal, a change to these policies | Identity and contact, account | To run the account you bought. These are not marketing, and you cannot unsubscribe from them while you are a customer. The trade is that we never use them to sell you anything. |
| Send you our newsletter and offers | Identity and contact, marketing | Marketing, and you can stop it. One click, or one line to us, and it stops in every channel, immediately and permanently. We do not ask why. Section 6. |
| Keep the servers and your account secure | Technical, account | To keep the service up and attackers out. Not optional, for the same reason as the fraud row above. |
| Count visits and see which pages are read | Technical, in aggregate | To see which pages are read, and you can stop it. We measure without cookies and without following anyone between sites, and a browser opt-out signal is enough on its own. See the cookie policy. |
| Show your finished site in our portfolio | Business name, the public site itself | To show our work, and you can stop it. One email and it comes down, no questions asked and no effect on your service or your price. |
| Deal with a complaint, a legal claim or a request from a regulator | Whatever is relevant | To establish or defend a legal claim, or because a court, a regulator or a law enforcement agency with the authority to ask has asked. We check that authority before we answer, which is section 11 of the acceptable use policy. |
Four things that are not in that table, because we do not do them
- We do not sell your personal data. Not for money and not for anything else of value, which is the wider definition the strictest state statutes use.
- We do not share it for cross-context behavioral advertising, and we do not use it for targeted advertising anywhere.
- We do not profile you in a way that produces a legal or similarly significant effect, and we do not let a machine decide anything about you. Section 11.
- We do not collect sensitive personal information. Not health, not ethnicity, not religion, not politics, not union membership, not sexual orientation, not immigration status, not precise location, not biometrics, not genetics. We do not want it, we do not ask for it, and we would not sell it if we had it. That is stricter than any state requires: the strictest of them allows sensitive data only where it is necessary and bans selling it outright, and the simplest way to meet that is not to hold it.
If we ever want to use your data for something not in this table, we will tell you before we start and ask you first. Not afterwards, and not by publishing a new version of this page and hoping.
Cookies and browser storage #
This site sets no advertising cookies and no cross-site tracking cookies. What it does store, why, and how long each item lasts, is listed one item at a time in the cookie policy, along with how to turn off the optional ones in any browser.
Marketing, and how to stop it #
We send two sorts of email. Service emails tell you that a payment is due, that your site was updated, that maintenance is planned or that these terms have changed. They are part of the service and they continue while you are a customer.
Marketing emails are the weekly newsletter and the occasional offer. Federal law, the CAN-SPAM Act, sets the rules for marketing email in the US, and it lets a business send a first message to someone who never asked, as long as the message says who it is from and offers a way to stop. We do not use that permission. Marketing from us goes only to people who asked for it and to people who are already customers, which is stricter than the federal act requires and is the standard the strictest states expect. We do not buy lists, we do not rent them and we do not mail someone because their address appeared somewhere. Every message has an unsubscribe link that works immediately, or reply and say stop, or email [email protected].
What that federal act asks of every marketing message we send, and what you can therefore check ours against:
- the sender and the subject line have to be truthful and not misleading, and the message has to be identifiable as an advertisement;
- it has to carry a valid physical postal address for the business sending it;
- it has to give a clear way to opt out, which cannot charge you, cannot make you log in, and cannot ask for anything beyond your email address and your preferences;
- that opt-out route has to keep working for at least 30 days after the message went out;
- the opt-out has to be honored within 10 business days, and we do it immediately.
The postal address in every marketing message we send is Fumo Media LLC, 1910 Thomes Ave., Cheyenne, WY 82001-3527, United States. It is the same address published in section 1 and printed on every invoice. A commercial email without a real postal address in it is not a message we are willing to send.
We go past the federal minimum on two of the points above. An unsubscribe is acted on immediately rather than inside the ten business days the act allows, and the opt-out route keeps working indefinitely rather than for the 30 days the act requires.
When you unsubscribe we keep a note of your address on a suppression list. That is the only way to make sure you are not added again by accident, and it is the one record that outlives the rest.
We do not sell, rent or swap your details with anyone for their own marketing. Not ever, and not to a group company. There is no advertising network, no tracking pixel and no cross-site advertising audience on this website at all. On the wide definitions the strictest state statutes use, that means we neither sell nor share personal information, so there is nothing behind an opt-out link to switch off. We publish the opt-out anyway, in section 12 and by honoring a browser signal for every visitor, so that the right is already there and already working on the day it stops being an empty one. If any of that ever changes we will say so here and in the cookie policy before it changes rather than after.
Who else touches your data #
A handful of suppliers, each doing one job for us under a contract, and nobody else.
We use service providers: companies that handle data on our instructions and may not use it for anything of their own. Each one is under a written contract that carries the terms the strictest state privacy statutes require, which means it is contractually barred from selling the data, from sharing it for advertising, from keeping, using or disclosing it for any purpose outside the job we hired it for, and from combining it with data it holds from anywhere else. Each contract also requires the supplier to tell us if it can no longer meet those terms, and gives us the right to stop and remediate any use that breaks them. We describe them by the job they do, because suppliers change and a list of brand names goes stale.
| Role | What they see | Where |
|---|---|---|
| Payment processor (Stripe) | Your card details, which go to them and not to us, plus your name, email and billing address. | The United States |
| Infrastructure provider | The servers your site and your mailbox run on. They hold the data at rest but do not use it. | Two data centers in the United States |
| Content delivery network | Requests to your website as they pass through, and the technical data in them. | Fifteen locations worldwide, with each visitor served from the nearest |
| Email delivery provider | The address we are sending to and the contents of the message. | The United States |
| Domain registrars and registries | The registrant details a domain registration legally requires. | The United States and, for some endings, elsewhere |
| Accounting software and our accountants | Invoices and payment records. | The United States |
Outside that list, we disclose personal data only where we are legally obliged to: to law enforcement or a court where a valid request is made, to a regulator, to our insurers or professional advisers where a claim requires it, or to a buyer if the business is ever sold, in which case this policy continues to apply until they tell you otherwise.
Ask us for the current name of any supplier in that table and we will tell you.
Sending data abroad #
It does not leave the United States, except for the network in front of your site, which serves a visitor from wherever is nearest to them.
No US privacy statute restricts moving personal data out of the country the way European law does. That is not a reason to be casual about it, so we make a commitment instead of relying on the absence of a rule: your website, your mailbox, your backups and your account records are stored in the United States and stay there. If that ever has to change, we will say so on this page before it changes and tell you which country and why.
Your website, your mailbox and your backups live in the United States. That is where we chose to put them and it is where they stay. The web hosting page describes the servers themselves, and the service level document says how often they are backed up and how quickly a backup comes back.
One thing reaches further. The content delivery network in front of your site has servers around the world, so a visitor in Sydney is served from nearer than Chicago.
Where personal data does leave the United States, we keep it under the same written contracts and the same encryption in transit and at rest that protect it at home, and we do not move it anywhere to sidestep the promises in this policy. Ask us for the safeguards on any particular transfer and we will send them.
How long we keep it #
Nothing is kept forever except the record that says not to email you again.
The strictest privacy rule now in force asks a business to publish an actual retention schedule rather than a sentence saying data is kept “as long as necessary”, and bars keeping anything indefinitely without a reason. This table is that schedule. Where we could choose the period, we chose the shorter one.
| What | How long | Why that long |
|---|---|---|
| Website content, pages and files | Deleted 30 days after your plan ends | Long enough for you to take an export, short enough not to sit on data nobody needs. |
| Mailbox contents | Deleted 30 days after your plan ends | The same window. Export or forward the mailbox before then. |
| Nightly backups | They age out on their own: 30 days on Basic, 90 days on Complete | A backup cannot be edited without destroying it, so deleted content leaves the backups as they expire rather than immediately. |
| Account and contact details | 6 years | Most states allow a claim on a written contract to be brought for up to six years, so that is the window in which either of us might still need the record. A handful of states allow longer, and we have not extended the period to match them. |
| Invoices and payment records | 7 years after the end of the tax year | Federal tax law. The Internal Revenue Service can normally assess for three years and for six where income is substantially understated, and state revenue departments set their own periods for sales tax records. Seven years covers all of them. We cannot delete these on request. |
| The record of your consent to the recurring charge | 3 years, or 1 year after your plan ends, whichever is longer | The strictest state automatic-renewal statute sets exactly that period, and we apply it to every customer. It is what lets us prove to you, or to anyone else, what you were shown and what you agreed to. Section 4 of the billing terms. |
| Support emails and chat transcripts | 3 years | Long enough to see the history of a recurring problem. |
| Server, security and error logs | 90 days | Long enough to investigate an incident, then gone. |
| Website and dashboard usage events | 90 days, then only the counts | Long enough to compare this month against the two before it. Then the individual lines are deleted and only totals remain, with nobody attached to them. No IP address, browser string or typed text is in this store at any point. |
| An inquiry that never became an order | 12 months | People come back. After a year they are not coming back. |
| Marketing list | Until you unsubscribe, and reviewed every 2 years | Nobody should stay on a list they never open. |
| Unsubscribe suppression record | Indefinitely | It is the only way to guarantee you are never added again. |
| Job applications | 6 months after the role is filled, unless you ask us to keep them | Enough time to come back to you about something similar. |
When a period ends we delete the data or anonymize it so it can no longer be traced to a person. Anonymized counts, such as how many sites we built last year, are kept.
How we keep it safe #
Data is encrypted in transit and at rest. Access to customer data is limited to the people who need it to do their job, each with their own login and two-factor authentication, and every access is logged. Servers are patched on a schedule, scanned daily for malware and sit behind a firewall. Backups run nightly and are held separately from the live system.
If there is ever a breach
All fifty states have a breach notification statute and no two of them are the same: the trigger differs, the deadline differs, what the notice has to contain differs, and which office has to be told differs. Working out which one applies to you would take longer than telling you. So we have written one procedure, taken from the strictest deadline any state sets, and we follow it for everybody. These are commitments and none of them is conditional on where you live:
- we start investigating the day we learn of it, and we do not wait for certainty before we start;
- we write to every person affected within 30 days of establishing that a breach happened, and sooner where we can. Thirty days is the tightest deadline in the country and we apply it to everybody rather than to the residents of the states that impose it;
- the notice says in plain English what happened, when, what data was involved, what we have done about it, what you should do about it, and a named person to reply to. It is not a paragraph of lawyer’s prose you have to decode;
- we notify the attorney general of every state whose residents are affected, and any other office a state requires, on that state’s own timetable or sooner;
- we do not delay a notice to give ourselves time to prepare a statement, and the only thing that will ever hold one back is a law enforcement agency telling us in writing to hold it;
- if your own customers’ data is involved, we tell you without undue delay and give you everything you need to make your own notifications, because that duty is yours and we are not going to leave you to discover it.
No system is perfect and anyone who says otherwise is selling something. What we promise is that we take it seriously, that we will tell you quickly, and that we will not hope you do not notice.
Automated decision making and profiling #
No computer decides anything about you on its own. People do, and you can always ask one.
We do not carry out automated decision making that produces legal effects for you or similarly significantly affects you, and we do not profile you.
The single place automation touches a decision is at the payment step, where our payment processor screens transactions for fraud and may decline a card. That screening is theirs and it is standard for card payments everywhere. If a payment of yours is declined, tell us and a person will look at it and sort it out with you.
Your rights #
Nine rights. Every one of them is yours whichever state you live in, every one of them is free, and using one changes nothing about your service or your price.
The twenty state privacy laws now in force grant overlapping but different lists of rights, and most of them only reach a business bigger than ours. Rather than publish a list that varies by zip code, we have taken every right any of them grants and given all of them to everybody. You do not have to tell us which state you live in, and we will not check.
- 1. To know
- To be told what personal data we collect, where it came from, what we use it for, who we disclose it to and how long we keep it. That is what this document is for, and if any part of it is unclear, ask and we will explain it in writing.
- 2. Of access
- To get a copy of the personal data we hold about you. Not a summary of the categories, the data itself. It is free and there is no limit on how often you may ask.
- 3. To correct
- To have anything wrong corrected and anything incomplete filled in. Most of it you can correct yourself in the dashboard, immediately.
- 4. To delete
- To have your data deleted. We do it, and we tell you clearly what we are keeping and why, which in practice is only the tax records in section 9 and the suppression record that keeps you off the mailing list. We also pass the deletion on to any service provider holding a copy.
- 5. To a portable copy
- To receive the data you gave us in a common, machine-readable format you can hand to someone else. For your website content that is the export in section 7 of the refunds and cancellation policy.
- 6. To opt out of sale, sharing and targeted advertising
- To tell us not to sell your personal data, not to share it for cross-context behavioral advertising and not to use it for targeted advertising. We do none of those things today, so the right currently has nothing to switch off, and we publish it anyway so that it is already working on the day that changes. A Global Privacy Control signal from your browser is enough on its own, for every visitor, with nothing else to fill in: see section 8 of the cookie policy.
- 7. To limit the use of sensitive personal information
- To restrict what we do with data about health, ethnicity, religion, politics, union membership, sexual orientation, immigration status, precise location, biometrics or genetics. We do not collect any of it, which is the strongest version of this right there is, and we will never sell it.
- 8. About profiling and automated decisions
- Not to be subject to profiling in furtherance of a decision that has a legal or similarly significant effect on you, and to ask for a person to look again at anything a machine touched. As section 11 says, we do not make such decisions, and the right stands anyway.
- 9. To appeal
- If we refuse a request, to have that refusal reviewed by someone who did not make it. We tell you the route in the refusal itself, and we answer an appeal within 45 days. If we turn the appeal down too, we tell you in the same message how to complain to your state attorney general and give you the contact details for your state.
Four things that come with those rights
- No retaliation, ever. Nothing about your service, your price, the speed of your support or the answer you get changes because you exercised a right. We do not offer a worse deal to people who opt out and we do not offer a better one to people who do not.
- Someone may act for you. A person or business you authorize can make any of these requests on your behalf. We will ask for evidence that you authorized them, and we will ask you directly to confirm it if we can reach you, and that is all the check involves.
- Withdrawing consent. Where we relied on your consent, you can withdraw it at any time, as easily as you gave it. That does not undo anything done lawfully before you withdrew it.
- It is always free. Some statutes let a business charge for repeat requests. We do not.
How to use one of those rights #
Email [email protected] and say what you want. You do not need to quote a section number or use any particular form of words, and you can raise it on live chat instead if that is easier: we will put it in writing for you. There is no form to fill in and no account to create.
- It is always free, however often you ask.
- We confirm we have it within 10 business days, so you are never left wondering whether the email arrived.
- An opt-out is acted on within 15 business days, which is the tightest deadline any state sets, and a browser opt-out signal is acted on right away because it needs no human at all.
- Everything else is answered within 45 days. The statutes allow a business to take a further 45 days on a complex request. We treat that extension as a last resort rather than a default, and if we ever use it we will tell you inside the first 45 days, say why, and give you a date.
- An appeal is answered within 45 days, which is shorter than the 60 several statutes allow, by someone who did not make the original decision.
- We may ask you to prove who you are. Only where we are unsure, and only enough to be sure. We will not ask you to create an account, send a photograph of a government document, or hand over more data than we already hold. We are not going to send someone else your data because they knew your email address.
- We will tell you what we did, including where we could not do all of it, exactly which part we could not do, and why.
Your own customers’ data #
Inquiries, orders and mailbox contents belong to you. We only hold them, and we only do what you tell us with them.
When someone fills in a form on your website, buys from your store, books a slot or emails your mailbox, that personal data is yours. In the language the US state privacy statutes use, you are the business that decides what happens to it and we are your service provider. You decide, we hold, and this section is the written agreement between us about that. It forms part of the terms of service, and if you need it on your own paper as a separate signed document, ask and we will sign one.
What we do, and for how long
We process that data only to provide hosting, mailboxes, forms, store and booking functions to you, for as long as your plan runs and for the 30 days afterwards described in section 9. The categories are whatever your site collects, typically names, contact details, messages, order details and delivery addresses.
What we undertake
These are the commitments the strictest state statutes require a service provider to make in writing, and we make all of them to every customer:
- not to sell it and not to share it for cross-context behavioral advertising, to anyone, for any consideration;
- not to keep, use or disclose it for any purpose other than performing the service for you, including not for a commercial purpose of our own and not outside our direct business relationship with you;
- not to combine it with personal data we receive from anywhere else, except where we are permitted to on your instruction;
- to act only on your documented instructions, unless the law requires otherwise, in which case we tell you if we are allowed to;
- to tell you promptly if we ever determine that we can no longer meet these obligations, and to stop and remediate any unauthorized use if you tell us to;
- to keep it secure with the measures in section 10;
- to make sure the people handling it are under a duty of confidence;
- to bind anyone we bring in behind us to these same terms, and not to bring in a new one without telling you first and giving you a chance to object;
- to help you answer a request from one of your customers, and to help you with a breach report or a privacy assessment;
- to tell you without undue delay if we become aware of a breach affecting your data, and to give you everything you need to make your own notifications;
- to delete or return it when your plan ends, on the timings above;
- to give you the information you need to show you are complying, and to allow an audit on reasonable notice.
What you have to do
You have to have your own lawful basis for collecting it, tell your customers what you do with it in your own privacy notice, and answer their requests. If one of your customers contacts us directly about their data, we will not deal with it ourselves: we will pass it to you and tell them we have.
The simplest way to make all of that easy is to collect less. A form asking for four things you will use beats a form asking for fifteen you will not, which is the case made in the inquiry form: five fields, not fifteen. A privacy notice of your own is one of the five pages every small business website needs, and we fit one to your site as part of the build.
If you need a signed data processing agreement on your own paper, email [email protected] and we will sort it out.
Children #
Nobody under 18 may open an account. If a child’s data reaches us anyway, we delete it and we do not ask for anything before we do.
This is a service for businesses. It is not directed to children, we do not advertise it to them, and there is nothing on this site aimed at a child or that a child would have a reason to sign up for. You must be 18 to open an account with us, which is the highest line any of the applicable rules would draw and is therefore the one we use.
The federal children’s privacy rule sets its own line at 13, and it reaches a general-audience service like ours the moment the operator knows it has collected personal information from a child under that age. What we commit to, without conditions:
- we do not ask visitors for a date of birth we would not act on, and we do not build a profile of anyone;
- if we learn that we hold personal information about a child under 13, we delete it and close any account, and we do it whether the child, a parent, a school or anyone else told us;
- we do not require a child, or a parent, to hand over more information than is needed to find the record before we will delete it;
- we never sell, share or use for targeted advertising the personal data of anyone under 18. We do none of those things for anyone, and this is the line at which it would be indefensible.
Email [email protected] if you believe a child’s data has reached us, from any route, and we will find it, delete it and write back to tell you we have.
The other place children’s data can appear is on a website we build for you. If your own business collects information from children, that duty is yours rather than ours, and it is a serious one. Tell us before we build so that the site is not designed in a way that makes it worse, and section 14 sets out where the line between us falls.
If your own website is aimed at children, or is likely to be used by them, the rules on children’s data apply to you as the operator of that site. Ask us and we will point you at what they mean in practice.
Complaining to a regulator #
There is no single national privacy regulator here. The office you want is your state attorney general, and we will find you the address if you ask.
Please come to us first, at [email protected]. Most things are a misunderstanding we can clear up the same week, and we would rather fix it than have it fixed for us.
But you do not have to, and you never lose the right to take it elsewhere. There is no federal privacy regulator in the United States in the way other countries have one, so the routes are these:
- Your state attorney general. Every state has a consumer protection division, and in the twenty states with a comprehensive privacy law that office is the one that enforces it. This is the right first stop wherever you live, including in the states with no privacy statute of their own, because every state has a consumer protection act.
- The California Privacy Protection Agency, if you are a California resident. It is the only dedicated state privacy agency in the country and it takes complaints directly.
- The Federal Trade Commission, which enforces the federal rules on unfair and deceptive practices, on children’s privacy and on commercial email.
Tell us where you are and we will send you the address of the right office, free of charge and without asking why. We will not try to talk you out of going, and complaining changes nothing about your service, your price or the answers you get from us.
Going to a regulator does not stop you taking a claim to court as well, and section 23 of the terms of service is deliberately written so that nothing stands in the way of that: no arbitration clause, no class action waiver, and your own state’s courts.
Changes to this privacy policy #
We review this policy at least once a year and whenever the service changes in a way that affects it. The date at the top is the date it last changed.
If we change something that materially affects you, we email you before it takes effect rather than editing the page.
Common questions about this privacy policy #
Six questions people send to [email protected] often enough to be worth answering here. The sections above are the full version of each.
How do I get a copy of the personal data you hold about me?
Email [email protected] and say what you want. That is a request to see what we hold and it does not need any particular form of words. It is free, we answer inside 45 days, and we will only ask you to prove who you are where we are unsure. Much of it you can see for yourself in the dashboard right away. Section 13 sets out how a request is handled.
Do you sell my data, or use it to advertise to me?
No, to both, and not to a group company either. We do not buy personal data, we do not scrape it, and there are no advertising cookies anywhere on this site: the cookie policy lists every single thing the site stores in your browser, by name. Marketing email only goes to people who asked for it or who are already customers, and one click stops it for good.
Where are my website, my mailbox and my backups kept?
In the United States, on servers in two data centers, encrypted in transit and at rest. The one thing that reaches further is the content delivery network in front of your site, which answers a visitor from wherever is nearest to them. What that infrastructure is made of is described on the web hosting page, and the mailboxes on the business email page.
Who owns the inquiries that come in through my website?
You do. When someone fills in your form, buys from your store, books a slot or writes to your mailbox, that personal data is yours and you decide what happens to it. We only hold it and act on your instructions, on the terms in section 14. You can export the lot from the dashboard whenever you want. Collecting less of it in the first place is the easiest way to stay on the right side of this, which is the argument in the inquiry form: five fields, not fifteen.
Does my own website need a privacy policy?
Yes, if it collects anything at all, and a contact form collects plenty. You have to tell your visitors what you do with what you take from them, and it has to be your notice rather than ours, because you are the one deciding. We fit one as part of the build and we will help you word it: it is one of the pages in the five pages every small business website needs, and the website design page shows where it sits.
What if I am not happy with how you have handled my data?
Come to us first at [email protected], because most of it is a misunderstanding we can clear up the same week. You never lose the right to take it to a regulator instead, and talking to us first does not give it up. Section 16 names the offices: your state attorney general, the California Privacy Protection Agency if you are in California, and the Federal Trade Commission. Tell us where you are and we will send you the address.
Want to see what we hold about you?
Ask. It is free, it takes one line, and we will answer within 45 days. Most of it you can also see for yourself in your dashboard right now.