Privacy Policy

This Privacy Policy describes how Whebb Works LLC ("Whebb Works," "we," "us," or "our") collects, uses, and discloses information about you when you visit whebb.works (the "Site") or interact with us through the forms and channels available on the Site (collectively, the "Services").

If you do not agree with this Privacy Policy, please do not use the Services. By using the Services, you agree to the practices described here. This Privacy Policy governs the whebb.works marketing site only. Personal information you provide directly to Whebb Works in the course of a client engagement is also covered by the privacy and confidentiality terms of your written agreement (proposal, statement of work, master service agreement) with us.

Summary of key points

This summary highlights the main points of our Privacy Policy. Detailed sections follow.

What we collect. Name, email, phone number (optional), business name, message content, file attachments, and standard technical data your browser sends automatically. We do not collect sensitive personal information.
How we collect it. Directly from you when you submit a form on the Site, and automatically from your browser when you visit (cookies, analytics, server logs).
How we use it. To respond to inquiries, fulfill client work requests, operate and secure the Site, comply with law, and analyze how the Site is used so we can improve it.
Who we share it with. Service providers who help us deliver the Services (email delivery, hosting, analytics, bot protection, spreadsheet storage). We do not sell or rent personal information.
How long we keep it. As long as needed for the purpose collected. Specific retention periods are listed below.
Your rights. You can request access, correction, or deletion of your personal information. Residents of certain US states have additional rights described in Section 11.
How to reach us. Email info@whebb.works.

What information do we collect?
How do we use your information?
When and with whom do we share your information?
Cookies and tracking technologies
How long do we keep your information?
How do we keep your information safe?
Do we collect information from minors?
What are your privacy rights?
Controls for Do-Not-Track features
Global Privacy Control
Do US state residents have specific rights?
Updates to this Privacy Policy
How to contact us

1. What information do we collect?

Information you provide to us directly

We collect the personal information you choose to give us when you fill out a form on the Site or otherwise contact us. This includes:

Contact form (/contact): name, email address, phone number (optional), the message you write, and an optional budget range you select.
Client work-request form (/clients/work-request): first name, last name, email address, business name (optional), the URL of the page in question (optional), the type of change requested, a description of the request, a priority level, and any file you choose to upload (up to 10 MB; PNG, JPG, GIF, WEBP, or PDF).
Email correspondence. When you email us at info@whebb.works, we receive your email address and the content of your message.

We do not require you to create an account or set a password to use any part of the Site.

Information collected automatically

When you visit the Site, certain information is collected automatically by your browser and our infrastructure. This includes:

Device and connection data: IP address, approximate location derived from IP, browser type and version, operating system, screen size, referring URL, and timestamps of your visit.
Usage data: Pages viewed, links clicked, time spent on pages, and events such as form submissions. This is collected via Google Analytics 4 (loaded through Google Tag Manager) for the purpose of understanding how visitors use the Site.
Security data: When you submit a form, Cloudflare Turnstile evaluates whether the submission appears to come from a human or a bot. Turnstile collects technical signals about your browser and interaction patterns for this purpose.
Server and edge logs: Cloudflare (which hosts the Site) maintains standard request logs containing IP address, user agent, requested URL, and response status, used to operate the Site and protect against abuse.

What we do not collect

We do not collect or process sensitive personal information (such as racial or ethnic origin, religion, health information, biometric data, sexual orientation, or government identifiers). We do not knowingly collect information from children under 18.

2. How do we use your information?

We process your personal information for the following purposes:

To respond to your inquiries. When you submit the contact form or email us, we use the information you provided to reply and follow up.
To fulfill client work requests. When you submit the work-request form, we use the information to triage, schedule, and complete the requested work as part of your existing engagement with us.
To operate and secure the Site. We use technical data to keep the Site running, detect and prevent abuse, block automated attacks, and protect against malicious activity.
To understand and improve the Site. We use analytics data to see which content is useful, identify usability issues, and decide what to build or write next. This analysis is done at an aggregate level whenever possible.
To comply with our legal obligations. We may process information as needed to comply with applicable laws, respond to lawful requests, or enforce our Terms of Service.

We do not use your personal information to make automated decisions that have legal or similarly significant effects on you, and we do not perform profiling for advertising purposes.

We share personal information only with the service providers required to operate the Services, and only as needed for them to perform their function. We do not sell or rent personal information, and we do not share it for cross-context behavioral advertising.

The categories of third parties we share information with are:

Email delivery (Brevo, formerly Sendinblue). When you submit the contact form, the message is delivered to our inbox via Brevo's transactional email API. Brevo receives the name, email, and message content from the submission so it can deliver the email.
Hosting and edge security (Cloudflare). The Site is hosted on Cloudflare Pages. Cloudflare processes every request to the Site and provides bot protection, DDoS mitigation, and TLS termination. Cloudflare Turnstile also runs on our forms to verify that submissions are not automated.
Analytics (Google Analytics 4 via Google Tag Manager). Google receives standard analytics data — page views, clicks, IP address, browser data — for the purpose of compiling aggregate usage reports for us.
Spreadsheet storage and file uploads (Google). When you submit the work-request form, the data is appended to a private Google Sheet via a Google Apps Script Web App. Any file you upload is stored in a private Google Drive folder that only authorized Whebb Works staff can access. Google processes this information as our service provider.
Reviews display (Google Business Profile API). The reviews carousel on the homepage is generated at build time by fetching reviews you wrote on Google's platform. We do not receive any information about you when a visitor views these reviews; we only display the public review text and reviewer name you chose to publish on Google.

We may also share information when required by law, such as in response to a subpoena, court order, or other valid legal process, or to protect the rights, property, or safety of Whebb Works or others.

If Whebb Works is involved in a merger, acquisition, financing, or sale of all or a portion of our business, personal information may be transferred as part of that transaction. Any successor entity will be bound by the terms of this Privacy Policy.

4. Cookies and tracking technologies

The Site uses a small number of cookies and similar technologies:

Cloudflare security cookies. Cloudflare sets cookies (such as __cf_bm) to identify and block malicious traffic. These are required for the Site to function.
Cloudflare Turnstile. Turnstile may set cookies or use local storage on your browser to verify form submissions are not automated.
Google Analytics. GA4 (loaded via Google Tag Manager) sets cookies such as _ga and _ga_* to distinguish visitors and sessions and compile usage reports.

We do not use cookies for advertising or cross-site tracking. Most browsers let you refuse cookies or delete them after a session; doing so may affect some Site functionality.

5. How long do we keep your information?

We keep personal information only as long as we need it for the purposes described in this Privacy Policy, after which we delete or anonymize it. Specific retention periods are:

Contact form submissions: retained in our email inbox following standard email retention practices. We do not maintain a separate database of contact form submissions outside email.
Work-request submissions: retained in the Google Sheet for as long as the client relationship is active, and for a reasonable period afterward for business records.
Uploaded files: retained in the Google Drive folder for as long as needed to complete the work request and for a reasonable archival period afterward.
Analytics data: retained according to Google Analytics 4's default retention setting (14 months), at the end of which user-level data is automatically deleted.
Server and security logs: retained per Cloudflare's standard log retention policy.

If we are required to keep information longer to comply with a legal obligation (tax, accounting, dispute resolution), we will do so.

6. How do we keep your information safe?

We use reasonable technical and organizational measures designed to protect personal information from unauthorized access, alteration, disclosure, or destruction. These include:

TLS encryption for all traffic to and from the Site.
Server-side validation and bot protection on form submissions (Cloudflare Turnstile, origin allowlists, honeypot fields).
API keys and secrets stored only in encrypted environment variables, never in browser code.
Access controls on the Google Drive folder where uploaded files are stored.
Routine review and updating of our infrastructure and third-party dependencies.

No method of transmission over the internet or method of electronic storage is fully secure. While we work to protect your information, we cannot guarantee absolute security. Please use the Site within a secure environment and report any suspected security issues to us at info@whebb.works.

7. Do we collect information from minors?

The Services are not directed to children under 18, and we do not knowingly collect personal information from minors. If you become aware that a minor has provided us with personal information, please contact us at info@whebb.works and we will delete it promptly.

8. What are your privacy rights?

Regardless of where you live, you may:

Request access to the personal information we hold about you.
Request correction of personal information you believe is inaccurate.
Request deletion of personal information we no longer have a legitimate need to keep.
Withdraw consent where we are processing information based on your consent.
Opt out of receiving further communications from us.

To exercise any of these rights, email info@whebb.works. We will respond within a reasonable time and within the timeframe required by applicable law. We may need to verify your identity before fulfilling a request.

If you live in a jurisdiction that grants additional rights (see Section 11), those rights also apply.

9. Controls for Do-Not-Track features

Some browsers and mobile operating systems offer a "Do-Not-Track" (DNT) signal you can enable to indicate a preference that your online activity not be tracked. There is currently no industry standard for how DNT signals should be handled, and we do not respond to DNT signals at this time.

10. Global Privacy Control

Global Privacy Control (GPC) is a browser-level signal that some users enable to indicate that they do not consent to the sale or sharing of their personal information. Because we do not sell or share personal information for cross-context behavioral advertising, there is functionally nothing to opt out of when we receive a GPC signal. We do not currently process the GPC signal as a separate opt-out, but our practices already align with what the signal would request.

11. Do US state residents have specific rights?

If you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, you may have additional rights under your state's privacy law. These typically include:

The right to know what categories of personal information we collect about you and the categories of sources and third parties we share it with.
The right to access a copy of the personal information we hold about you.
The right to correct inaccurate personal information.
The right to request deletion of your personal information.
The right to opt out of the sale or sharing of personal information for cross-context behavioral advertising (which we do not do).
The right to non-discrimination for exercising any of these rights.
In some states, the right to appeal a denial of a privacy request.

The exact scope and any thresholds for these rights vary by state. To exercise a state-specific right, email info@whebb.works. We will respond within the timeframe required by the applicable state law.

California "Shine the Light" law

California Civil Code Section 1798.83 ("Shine the Light") permits California residents to request information once a year about disclosures of personal information to third parties for those third parties' direct marketing purposes. Whebb Works does not share personal information with third parties for their direct marketing purposes.

Sensitive personal information

Where applicable state law treats certain categories as "sensitive personal information," we confirm that we do not collect, process, or sell sensitive personal information through the Services.

12. Updates to this Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. Material changes will be highlighted in the policy or communicated through the Site. Continued use of the Services after a change indicates your acceptance of the updated policy. We encourage you to review this page periodically.

13. How to contact us

If you have questions about this Privacy Policy or wish to exercise any of your rights, contact us at:

Whebb Works LLC
info@whebb.works