Privacy

What we collect

Only what you type, what you send us as a client, and the little your browser sends with any request. Visiting the site needs no account.

When you send the contact form

• Your name, and your business name if you give one.
• Your email address, and your phone number if you give one.
• What you need, when you need it, a rough budget, and your current website if you give one.
• The message you write.
• Which page you were on, where you arrived from, and any campaign parameters in the link you followed. This is how we tell whether an ad was worth paying for.
• Your IP address and browser user-agent string, recorded with the message.

When you use the chat panel

Your name if you give one, the email or phone number you leave so we can reply, your message, and the same IP address and user-agent. The panel is not live chat. It reaches us the same way the form does.

When you become a client

• Your account. Your name, your sign-in email address, the businesses and projects you are linked to, and a record of sign-ins. You sign in with a one-time code we email you; there is no password to store.
• Your project. Your intake answers, the files you upload (logos, photos, documents), your feedback on previews and your approvals.
• Invoices and payments. What we billed, what you paid, refunds and your payment consents. Card payments are handled by Square. We never see or store your card number or security code; Square gives us a reference to your saved card, its brand, its last four digits and its expiry date, and that is all we keep.

When we contact a business

We sometimes email businesses we think we could help. We use business contact details the business publishes itself, on its website or a public listing: the business name, address, phone number, website and published email address, and notes on what we found on its site. We do not buy lists.

Every email we send carries a way to opt out, and one request is enough. We then add the address, and the business's own domain, to a suppression list so it is never contacted again. That list is the one thing we keep after an opt-out, because deleting it would let the address back onto a future list.

If we make a sample site for a business, it sits at an unlisted address that search engines are told not to index, and it is removed after 30 days.

What we do not collect

We do not use advertising or tracking cookies. We do not build a profile of you, and we do not sell, rent or trade anyone's data.

Visit counts

We count visits with Umami, which we run on our own server. It sets no cookies, stores nothing in your browser and keeps no record of who you are: only which pages were visited, the referring site, and the browser, device type and country, in aggregate.

What we keep in your browser

On the public site, one thing, and only if you arrive with a campaign link or from another site: the referring site and any campaign parameters, kept in your browser's session storage so the contact form can include them if you choose to send it. It is first-party, it never leaves your browser unless you submit the form, and it disappears when you close the tab. Using the chat panel also keeps a conversation id there, so a second message arrives attached to the first.

Clients who sign in get a first-party cookie that keeps them signed in, plus short-lived ones while a sign-in code or invitation is being used. They exist only so the account works.

Where it goes

A message is written to a file on our own server first, then emailed to us. Persisting it first means a mail outage cannot lose your inquiry. Client accounts, project files and billing records live in our own database and storage on servers we run.

A few companies handle it on the way. Cloudflare sits in front of this site and sees the request, as it does for most of the web. Microsoft carries our email, including sign-in codes and invoices, because our mail runs on Microsoft 365. Square processes card payments and holds saved cards. None of them is given your details for their own marketing. If we ever turn on Cloudflare's anti-bot check, it will see that a submission happened; it is designed not to identify who you are.

We name them rather than saying "our providers", because a privacy notice that hides who touches your data is not much of one.

How long we keep it

• Inquiries from the contact form and chat: 2 years.
• Account data: while your account is active, then 1 year.
• Uploads and site files: deleted 90 days after our work or hosting for you ends.
• Invoices, payments and refunds: 7 years, because tax and accounting rules require it.
• Businesses we contacted that never replied: 12 months.
• The opt-out suppression list: indefinitely.

What you can ask for

A copy of what we hold about you, a correction, or deletion. Write to [email protected] and a person will answer. We do not charge for this and we do not require a particular form of words. We delete what we can and confirm when it is done. Financial records we are required to keep, and an opt-out on the suppression list, are kept for their full retention period.

Children

This site is for businesses. It is not directed at children and we do not knowingly collect their data.

Changes

If what we collect changes, this notice is updated in the same release as the change, not afterwards. The effective date at the top is the one to check.

Getting in touch

GSTECH is a software studio in South Carolina. Questions about anything here go to [email protected]. Our terms of service and refund policy cover payments and hosting.