Privacy policy.

If you use the contact form or email us, we keep what you send: your name, your email address, your business name if you give it, and your message. If we go on to work together, we also keep the details needed to do the job, such as logins you share with us for your site and accounts.

If you pay by card, you pay on a checkout page run by Stripe, our card payment provider. Stripe collects your card details, which we never see in full, and your name and email address. On a weekly plan, the checkout also asks for your business name, billing address and phone number, and we keep those with your agreement.

If you use the unsubscribe page, we keep the address you type, or the code in your unsubscribe link, so we can take you off our email list and keep you off it.

If you run a business, we may make a private preview of a website for it. A preview is built only from what the business publishes itself, such as its own website, listings and social pages. It sits at an address nobody can guess, is marked noindex so search engines leave it out, and is never linked from this site or anywhere public.

When you browse the site, two tools record the visit: Google Analytics and the Meta (Facebook) Pixel, joined by Microsoft Clarity if we switch it on. They record which pages you view and when, your device and browser, your IP address, the page or ad that brought you here, and actions such as tapping to email or call and sending the contact form. Google Analytics shows us totals, such as pages viewed and rough location by country or city, so it does not tell us who you are. Meta can link a visit to your Facebook or Instagram account if you are logged in on the same browser.

To reply to you, to quote and deliver work you have asked for, to invoice you, and to keep a record of what we agreed. We use the visit data for two things: to see which pages are useful and which are not, so we can improve the site, and to measure whether our ads work, for example whether people who see one of our ads on Facebook or Instagram go on to visit the site or get in touch. We do not use your name or email address for marketing unless you have asked us to stay in touch.

If a business opens a page we made for it, we may phone the business about it. We only call a number the business publishes for itself, and we stop the first time you say no.

Only the services that make this site and our work run:

• Vercel, which hosts this website and runs the contact and unsubscribe forms.
• Resend, which delivers contact form and unsubscribe messages to our inbox, and sends the email confirming we got your enquiry.
• Google, through Google Analytics, which records the visit data above.
• Meta, the company behind Facebook and Instagram, through the Meta Pixel, which records the visit data above so we can measure our ads.
• Microsoft, through Microsoft Clarity, if we switch it on. Clarity shows how pages are used, for example where people tap and how far they scroll, and can replay a visit as a recording. It does not record what you type into the contact form.
• Stripe, which takes card payments and sends receipts. It receives your card details, name and email address, and on a weekly plan your business name, billing address and phone number.
• Google (Gmail) for replying to you, and our invoicing software for sending invoices.

When you send the contact form, the site may also tell Google and Meta directly, from our server, that an enquiry arrived, so we can see which ads bring enquiries. Meta then receives a scrambled copy of your email address that it can match but not read back, your IP address and your browser details. Neither company is sent your message, your name or your email address in readable form.

Vercel, Resend, Gmail and our invoicing software hold your data on our behalf and are not allowed to use it for anything else. Google, Meta and Microsoft are different: they also use the visit data for their own purposes, including advertising, under their own privacy policies. Stripe also uses payment details for its own purposes, such as preventing fraud and meeting its legal duties, under its own privacy policy.

Vercel, Resend, Stripe, Google, Meta and Microsoft are based in the United States, so what they receive is processed and stored there, and sometimes in other countries where they run servers. The privacy law in those countries may not protect it in the same way New Zealand's does.

We do not sell your details, and we do not hand them to anyone else unless the law requires it, with one exception. If you owe us money and it is still unpaid after our written notice, we may give your name, contact details and the amount owed to a debt collector and a credit reporting company, as clause 4 of our terms says.

Enquiries that do not turn into work are deleted after 12 months. If we work together, we keep the project records and invoices for seven years, which is the Inland Revenue record-keeping minimum, after the work ends, because tax law asks us to. Logins you share with us are removed from our records when the project or care plan finishes. Unsubscribe requests are kept for good, because the point is that you stay off the list. A private preview is deleted when the business asks, or 60 days after we made it, whichever comes first. Visit data held by Google and Meta is kept for the periods their services set.

This site runs Google Analytics and the Meta Pixel, and may also run Microsoft Clarity. Each sets cookies in your browser so it can tell visits apart and recognise your browser next time.

• Google Analytics, from Google, counts visits and shows us which pages people use and what brought them here. Google may also use the data for its advertising features, for example to link visits by people signed in to a Google account across their devices.
• The Meta Pixel, from Meta, tells Meta each time a page loads, and when someone taps to email or call or sends the contact form. We use it to see whether our Facebook and Instagram ads bring people here. Meta may also use it to choose which ads it shows you.
• Microsoft Clarity, if we switch it on, records how pages are used, such as taps and scrolling, so we can find the parts of the site that confuse people. It masks what you type.

We do not show a cookie banner. You can turn any of them off:

• Google: the Google Analytics opt-out add-on stops Google Analytics in your browser on every site. My Ad Center controls the ads Google shows you, and Google explains how it uses data from sites like this one.
• Microsoft: Clarity respects the cookie settings in your browser, and blocking cookies stops it recognising you.
• Meta: your ad preferences in Meta's Accounts Centre control whether activity on sites like this one shapes the ads you see, and your activity off Meta technologies lets you disconnect it from your account. Meta's cookies policy explains the rest.

You can also block cookies or trackers in your browser settings and the site will still work.

Under New Zealand's Privacy Act 2020 you can ask to see the personal information we hold about you, and ask us to correct it if it is wrong. You can also ask us to delete it, and we will unless we have to keep it for tax or legal reasons. Email us and we will respond within 2 working days. If you are not happy with how we handle it, you can complain to the Office of the Privacy Commissioner.

Anything about your data, or this policy, goes to Nick. A short email is fine.