Privacy Policy

1. What We Collect

When you contact us:

• Your name, so we know what to call you
• Your email address, to reply
• Your phone number, if you would rather we called
• What you wrote to us

How you found us: the campaign tags on the link you clicked, the site you came from, and the first page you landed on. We use this to work out which of our marketing actually works.

How you use our site: which pages you visit, how long you stay, what you click, and a rough location (city and region, from your network connection, not your street address).

Your device and connection: your IP address and your browser's user-agent string. See Section 2, which explains what we do with them.

Calls and texts: where a client's plan includes a tracking phone number, we record the connection details of calls and messages to it: the number that called, the time, how long it lasted, and where it was routed. That is call routing, not call content.

Payments: card payments are handled by a third-party payment processor. Your full card number never touches our systems and we never store it. We keep the record of the transaction: amount, date, the last four digits, the card brand, and whether it went through, so we can support you, handle refunds, and keep the books.

If you cancel: the date you asked, how you asked, the reason you picked, and anything you typed in the box. We keep it to work out what we are getting wrong. It is never used to market back at you, and telling us nothing is a valid answer.

If a payment is disputed: where a bank tells us a charge has been disputed, we record the dispute, its reason code, and its status, so we can work out what went wrong and put it right with you.

Your agreement to our terms: when you accept our Terms of Service and this policy at signup, we record that you accepted, which version, the date and time, your IP address, your browser's user-agent string, and your email address. We keep it so both of us have a clear record of what was agreed, and we may show it to a bank if a payment is ever disputed.

What we do not collect: we do not read your installed fonts, your screen size, your browser language, or anything else from inside your browser to identify you. An earlier version of this page said we did. That was wrong, and we would rather correct it than leave it.

2. How We Recognise Returning Visitors

This is the part most privacy policies are vague about, so here it is plainly.

What happens. Every time a page on builtbyduo.com is requested, our server takes your IP address and your browser's user-agent string, runs them through a one-way scramble, and gets back a short code. The same visitor usually produces the same code, so we can tell a returning visitor from a new one. Against that code we store your IP address, your user-agent, the rough location our network provider reports, the site you came from, and the campaign tags on your link.

When it happens. On our server, as the page is being built, before anything loads in your browser and before you have clicked anything, including before our cookie banner appears.

Why we do it. So that when someone fills in our contact form we can tell which advert or link brought them, even if they visited three times first; and to spot obviously automated or abusive traffic.

What we do not do with it. We do not follow you to other websites, we do not build an advertising profile, and we do not sell or share it. It stays with us.

What will not stop it, and we would rather say so.Turning on "Do Not Track," blocking cookies, or turning off JavaScript will not prevent any of the above, because it happens on our server before your browser is involved. A lot of people assume otherwise. Rejecting our cookie banner does not stop it either; the banner covers cookies. The one browser setting that does stop it is Global Privacy Control, which is next.

What will stop it. Two things. Send a Global Privacy Control signal, which several browsers and extensions offer; we honor it and skip the whole process. Or email hello@builtbyduo.com and ask us to opt you out, and we will, permanently, and confirm when it is done. A VPN will also change what we see, since we would be recording the VPN's address rather than yours.

3. Forms on Our Clients' Websites

We build and run websites for local businesses. If you filled out a form on one of them, asking a landscaper for a quote or a plumber to come out, this section is about you.

What you submit, which may include your name, phone number, email address, street address, and your message, passes through our systems on its way to that business.

• The inquiry belongs to the business you contacted, not to us
• We act only as their service provider: we store it and deliver it, and we do nothing else with it
• We never sell it, never market our own services to you with it, and never give it to any other business
• We keep it for as long as that business is our client, plus 12 months, then delete it

To have your inquiry corrected or deleted, the fastest route is to contact the business directly, because it is their record. You can also email hello@builtbyduo.com and we will pass the request on and act on it on our side.

4. Custom Build Projects

When we build something custom for you, the project runs on a build log: a page where you, anyone else you bring in, and we write to each other. Every message becomes part of that project's written record. This section is what that record holds.

What the record holds. Your name, your email address, what you wrote, any files you attached, the moment you wrote it and your time zone, the city, state and country your message came from, and a short phrase naming the kind of device and browser you used.

What stays with us and appears nowhere on the project.Your IP address, your full browser and operating-system versions, your device model, the raw user-agent string your browser sends, and a fingerprint computed from those. We keep these so that "who approved this, and from where" has an answer if a project is ever disputed. Nobody outside Built By Duo sees them.

What other people on the project see. Your name and your words, and the files you attached. Not your email address, not your location, not your device, and none of the detail in the paragraph above.

Files, and what we make from them. Attachments are stored unchanged and served from a domain separate from any website, so an uploaded file can never run as part of a page. We also produce something searchable from each one: a timestamped transcript of a video or a voice note, the text inside a document, the text visible in an image. A transcript is made by machine, is labelled as such, and never replaces the original.

The two halves have different lives. The written record is durable, because what was asked for and agreed on a project is the project's history and we do not rewrite it. The detail we hold on our side is not: we delete it three years after it is recorded, and sooner if you ask, and the page then says the record was removed and when. Asking removes that half; it does not erase what you wrote.

We do not use anything on a build log to market to you, and we do not use it outside your project.

5. Cookies

Cookies are small files stored by your browser. We use three kinds.

Essential: stopping duplicate form submissions, remembering whether you chose light or dark mode, and keeping you signed in during a visit. These cannot be switched off without breaking the site.

Analytics: understanding which pages are useful and where people get stuck.

Marketing attribution: remembering which link brought you, for 30 days.

You can control these through our cookie banner or your browser settings. To be clear about what the banner does and does not cover: it controls cookies, and it does not affect the server-side recognition described in Section 2, which has its own opt-out.

6. What We Use It For, and Who Sees It

We use what we collect to answer your questions, deliver what you bought, run and improve our sites, work out which marketing is worth the money, send you service messages, and meet legal obligations like tax records.

Service providers. We use third-party companies to run our business. By category:

• Hosting, security, and content delivery, to keep sites online and protected
• Domain registration, to register and renew domains
• Payment processing, to take card payments and issue refunds
• Email and text message delivery, for replies, notifications, and lead alerts
• Appointment scheduling, for booking calls
• Analytics and product measurement, to understand how our sites are used
• Business listing and search services, to manage our clients' presence on maps and search
• Automated and AI writing tools, which we use to help draft website copy; we do not send them your personal information, only the business content we are working on

Each is contractually bound to protect your data and to use it only for the service they provide to us. We choose them and we may change any of them at any time. We list them by category so that swapping one provider for a better one does not mean reissuing this page; the current list of who they actually are is yours for the asking. Email hello@builtbyduo.com and we will send it.

Text messaging. If you give us your mobile number and agree to receive texts, that consent is treated separately from everything else on this page.

Text messaging originator opt-in data and consent will not be shared with any third parties, excluding aggregators and providers of the text message services.

In plain terms: the only outside parties who ever see that you opted in are the companies that physically carry the message to your phone. Nobody else, for any reason. Our full texting terms, including how to stop, are on the SMS Terms page.

Legal requirements. We may disclose information if the law requires it, if a court orders it, or to protect someone's safety or our rights.

If the business is sold. If Built By Duo is acquired or merged, information about our own visitors and clients may transfer to the new owner, and we will tell you. One carve-out: the customer inquiries collected on our clients' websites belong to those clients, not to us, so they are not ours to transfer as part of a sale. They go to the client, or wherever the client directs.

We do not sell your information. We do not sell personal information for money, and we do not share it with anyone for cross-context behavioural advertising. Some privacy laws define "sale" and "share" broadly enough to catch ordinary analytics, so to be precise: the analytics described above are the only thing that could arguably fall inside those definitions, we treat them as opt-out-able, and Section 8 tells you how.

7. How Long We Keep Things

• Messages you send us: while you are a client or an active enquiry, plus 24 months, then deleted
• Returning-visitor records (Section 2): 12 months from your last visit
• Analytics: 26 months
• Marketing attribution: 30 days in your browser, 12 months in our reports
• Inquiries from our clients' websites: while that business is our client, plus 12 months
• Build project records (Section 4), the written half: kept as the project's history, for as long as we hold the project's record
• Build project records (Section 4), the detail we hold on our side: 3 years, and sooner on request
• Payment records: 7 years, as tax law requires
• Terms acceptance records: 7 years, the same as payment records, because the two go together if a charge is ever disputed
• Call and message connection records: 24 months
• Cancellation reasons and payment-dispute records: 7 years, alongside the payment records they relate to

When a period ends, we delete the data or strip it of anything that identifies you. Inquiries submitted on our clients' websites are the one category we always delete outright rather than de-identify, because the Terms promise our clients exactly that. Every period above has an end; we do not keep anything indefinitely "just in case."

8. Your Rights

Wherever you live in the United States, you can ask us to:

• Tell you what we hold about you, and give you a copy
• Correct anything wrong
• Delete it
• Stop the returning-visitor recognition in Section 2
• Opt out of the analytics described in Section 6, which some state privacy laws treat as a "sale" or "share"
• Stop sending you marketing email
• Give you your data in a format you can take elsewhere

We do not treat anyone worse for exercising these. Email hello@builtbyduo.com with "Privacy Request" in the subject line and we respond within 30 days, usually much sooner.

Two honest limits. We cannot delete the payment and terms-acceptance records listed in Section 7, which we keep for seven years, for tax reasons and because they are what settles a payment dispute. We will say so if that is the reason. And for an inquiry you submitted on a client's website, the business you contacted holds the record; we will act on our side and pass the request to them, and we cannot make the decision for them. And on a build project, we delete the detail we hold on our side whenever you ask, but what you wrote stays in the project's record, because it is a record shared with the other people on that project and it is what the work was agreed on.

Universal opt-out signals. If your browser sends Global Privacy Control, we honor it automatically, both for the returning-visitor recognition in Section 2 and for the analytics in Section 6.

Outside the United States. We serve small businesses in the United States and our services are not directed at people elsewhere. If you are outside the US and want your data removed, email us and we will remove it, subject to the same two limits above: we still cannot delete the seven-year payment and acceptance records, and an inquiry on a client's site is that client's to decide. We would rather tell you that than publish a list of rights under laws we are not set up to administer.

9. Security

Everything travels over encrypted connections. Access to client data is limited to the two of us and to the service providers listed in Section 6. Our hosting provider gives us denial-of-service protection, a web application firewall, and bot filtering. We apply security updates promptly, which is part of what your plan pays for.

No system is completely secure, and anyone who claims otherwise is overselling. If we discover a breach affecting your information, we will tell you promptly and tell you what we know.

10. Children

Our services are for businesses and are not directed at children under 13. We do not knowingly collect information from them.

If you believe we have, email hello@builtbyduo.com and we will delete it promptly.

11. Changes to This Policy

We update this policy when our practices or the law change. The version and date at the top always reflect the current one.

For a material change in how we use your data, we will tell you by email or a clear notice on our website at least 30 days before it takes effect.

12. Contact Us

Questions, or want something deleted? Just ask.

Email: hello@builtbyduo.com
Phone or text: (912) 800-8181
Response time: quickly, on business days

Put "Privacy Request" in the subject line for anything about your data and we will prioritize it.