Privacy Policy
Effective September 29, 2026
This site belongs to Zach Wallington, an independent web, software, and technology consultant based in South Carolina ([email protected]). It is a small business site, not a data platform: the only personal information it handles is what you send me when you reach out. This page explains what is collected, why, who else touches it, and how to exercise your privacy rights — written so it satisfies both California (CCPA/CPRA) and EU/UK (GDPR-style) expectations.
What I collect
- Contact form submissions: your name, email address, company (optional), the service you select, and your message. Submissions are stored in this site's database and emailed to me for reply.
- Abuse-prevention data: your IP address and a timestamp recorded with each submission, honeypot and timing checks, and a Google reCAPTCHA score when the widget is active.
- Basic server logs: standard web-server access logs (IP, browser, referring page, timestamp) used only to operate and secure the site.
- Live chat: if you open the chat widget, the chat vendor processes the messages and session data under its own policy.
No advertising or behavioral analytics trackers run on this site. I do not build profiles about you, and I do not sell or share personal information for cross-context behavioral advertising.
Cookies and local storage
- A security cookie (CSRF token) that protects the contact form from forged submissions. Strictly necessary; it is not used for anything else.
- Local storage on this origin remembering that you dismissed the notice banner.
- Third-party cookies that Google (reCAPTCHA, fonts), and the chat vendor may set when their features load. I do not control these directly.
How I use it — legal bases
To answer your inquiry and prepare an estimate or agreement (performance of a contract / pre-contract steps); to secure the site and stop spam (legitimate interests); and, for chat and anti-abuse features, on the basis of your acknowledgment of the banner or your use of those features. Declining still leaves plain email ([email protected]) as an option.
Who else touches your data
Only service providers working under contract on my behalf: the hosting provider running this server (Linode/Akamai, USA), the transactional email provider delivering form notifications (Mailgun, USA), the chat vendor, and Google for reCAPTCHA and web fonts. Under CCPA terms these are service providers — disclosure for a business purpose, never a "sale" or "sharing" for ads.
Retention
Contact submissions stay in the site database while I use them to serve the project they relate to, and are deleted on request. Server logs rotate automatically and are not kept longer than needed for security.
Your rights
- Know / access: ask me and I will tell you what personal information I hold about you and provide a copy.
- Delete: ask and I will delete your information from the site database, subject to legal retention obligations.
- Correct: ask and I will fix inaccurate records.
- Opt out of sale/sharing: nothing to opt out of — I do not sell or share personal information for advertising purposes.
- Limit sensitive-data use: I do not collect or process sensitive personal information.
- No discrimination: exercising any right will not change pricing or service quality.
- Agents: you may use an authorized agent with written permission; I will verify both of us.
- GDPR-style rights (for visitors from the EEA/UK): access, rectification, erasure, restriction, portability, and objection. The site is operated from the United States; by submitting the contact form you acknowledge transfer to and processing in the US.
Verifiable requests are answered within 45 days, free of charge. California residents may also contact the California Privacy Protection Agency or the Attorney General; EEA/UK residents may lodge a complaint with their supervisory authority.
Security
The entire site runs over HTTPS with HSTS, database access is limited to the application's own credentials on a loopback-only port, form posts are rate-limited and spam-checked, and software is patched continuously.
Children
This site is directed at businesses, not children, and I do not knowingly collect information from anyone under 16.
Changes
If this policy changes materially, the effective date above is updated. Continued use of the contact form after an update acknowledges the revised policy.