Privacy Policy

This policy describes what Graphcast Web Design collects through https://graphcast.com, why, how long it is kept, and what you can ask us to do about it. It covers this website only. It is not a client services agreement, and it does not describe how we handle data inside a website we build for a client — that is set out in the agreement for that project.

Who we are

Graphcast Web Design is a Houston-based web design studio serving small businesses across the United States. For anything in this policy, write to [email protected].

Contact form submissions

This site has two forms. The free website preview form collects your business name, your name, email address, phone number, industry, a description of your services, and optionally your current website address. The quote form collects your name, business name, email address, phone number and the service you selected, plus — if you open the optional section — your current website address, budget range, desired launch date and project description.

Along with those, our form handler records things you did not type:

• Your IP address, used to rate-limit the form (a maximum of five submissions per address every ten minutes) and included in the notification email so we can identify abuse.
• The page you submitted from, taken from the browser's referrer header, so we know which page produced the enquiry.
• How you found us — see "Campaign attribution" below: the campaign parameters of your first visit, the page you first landed on, and the site that referred you, if any.
• A hidden field that only automated bots fill in. If it is filled, the submission is discarded and nothing is sent.

Each submission is saved as a lead record in a file on our own server, outside the public website, so an enquiry is never lost if email fails. It is also delivered to us by email through Mailgun, an email delivery provider, and may be copied into the customer relationship management (CRM) tool we use to track enquiries and follow-ups. The stored record does not include your IP address.

We use these details only to reply to your enquiry and, if you become a client, to run the project. We do not sell them, rent them, or add you to a marketing list.

Spam protection

This site uses Google reCAPTCHA v3 to distinguish people from bots. The reCAPTCHA script is loaded only when you first interact with a form field — not on page load — and when it runs, Google receives information about your interaction with the page and may set cookies. Google's handling of that data is covered by theGoogle Privacy Policy and Terms of Service.

Campaign attribution

When you first arrive from a link that carries campaign parameters — for example from one of our ads or emails — the site saves those parameters (utm_*, and the click IDs gclid and fbclid), the page you landed on and the referring site in your browser's local storage for up to 90 days. Nothing is sent anywhere unless you submit a form, in which case they travel with your enquiry so we know which campaign produced it. Clearing your browser's site data removes them.

Analytics and cookies

Production pages load Google Analytics 4 (measurement ID G-XCLTLSRW7C). It sets cookies in your browser and reports to Google which pages were viewed, roughly where in the world the visit came from, what device and browser was used, and which site or search referred you. We use it to see which pages bring in enquiries.

Alongside page views, we count a few specific interactions:

• Form starts and submissions — that a form was started or sent, which form, and the service or industry selected. The event does not carry your name, email, or phone number.
• Phone reveals — when someone taps a "show phone" button, we record that it happened and on which page. We do not record or track the call itself.
• Email link clicks — that a mailto link was clicked, and where.
• Call-to-action and plan clicks — the button text and page, so we can tell which calls to action work.

None of these events send your name, email address, phone number, or the contents of your message to Google. You can block all of it with a browser extension or by disabling cookies; the site works normally either way.

Call tracking

We do not use call-tracking numbers, and we do not record, transcribe, or route calls through a third-party tracking service. The number on this site is our number and it rings directly. As described above, analytics records that a phone button was revealed — not who called, or whether a call was placed.

Advertising

We advertise on Google and Meta (Facebook and Instagram). To measure whether those ads produce enquiries, production pages load the following tags:

• Meta Pixel — records page views and form submissions so Meta can measure our ads and show them to people likely to be interested, including people who have visited this site. It uses cookies set by Meta. You can control this in your Meta ad preferences. When you submit a form, our server also tells Meta about it directly (Meta's Conversions API), so we can measure our ads even when the pixel is blocked. That report includes your email address, phone number and name in hashed (scrambled) form, which Meta uses only to match the submission to a Meta account, along with your IP address and browser type. It never includes your message.

These tags receive that a page was viewed or a form was submitted. Apart from the hashed details described for Meta above, our conversion events do not send them your name, email address, phone number or message. You can block the tags with a browser extension or by disabling third-party cookies; the site works normally either way.

Embedded and third-party services

• Mailgun — delivers contact form submissions to our inbox.
• Google Analytics 4 — website analytics.
• Meta Pixel — advertising measurement and audiences.
• Our CRM provider — if used, holds a copy of enquiry records for follow-up.
• Google reCAPTCHA v3 — form spam protection.
• Our hosting provider — keeps standard server access logs, which include IP addresses, for security and troubleshooting.

Fonts are served from this site's own domain, not from a font CDN, so loading a page does not disclose your visit to a third-party font host. There are no embedded videos, maps, chat widgets, or social media trackers.

How long we keep things

• Enquiries and lead records — kept while we are in contact and for up to two years afterwards, so we can find a past conversation. Ask and we will delete yours sooner, from our lead records, inbox and CRM.
• Client project records — kept for the life of the engagement and for as long afterwards as tax and accounting rules require.
• Rate-limit records — the form handler keeps a short-lived file per IP address that expires after ten minutes.
• Analytics data — retained according to the retention setting in our Google Analytics property; it is aggregate reporting data, not a record about you by name.
• Server logs — rotated by our host on their standard schedule.

Your choices

You can ask us to:

• tell you what we hold about you;
• stop sending you marketing email — every marketing email we send has an unsubscribe link, and we honour it immediately;
• correct anything that is wrong;
• delete your enquiry and any related correspondence;
• stop contacting you.

Email [email protected] and we will action it. There is no form to fill in and no account to close. Depending on where you live you may have additional statutory rights — Texas residents, for example, have rights under the Texas Data Privacy and Security Act — and we will honour any request covered by a law that applies to you.

Children

This is a business-to-business website. It is not directed at children, and we do not knowingly collect information from anyone under 13.

Changes to this policy

When what the site does changes, this page changes with it, and the "last updated" date at the top moves. There is no archive of previous versions; if you need to know what a previous version said, ask.

Contact

Questions about this policy, or a request about your data: [email protected], or use the contact page.