Privacy Policy

This policy covers the public website at vcweb.net and the personal data we handle as a business — visitors, people who send us an enquiry, and clients we work with. Where we process data inside a client’s own Google Ads, Analytics or hosting account, we do that under the client’s instructions and their privacy policy governs that data; ours governs ours.

1. Who we are and how to contact us

VCweb Digital Agency is the controller of the personal data described below. Our registered trading address is 214 Commerce St, Suite 300, Dallas, TX 75201, United States. You can reach us by email at [email protected], or through the contact page. Our office hours are Monday to Friday, 9:00 AM – 6:00 PM Central Time.

For anything specifically about privacy — an access request, a correction, a deletion, an opt-out, or a question about this policy — write to [email protected]. That inbox is monitored by the same small team that runs the business, not by an outsourced desk.

2. What we collect

Three things, and nothing else. We do not buy contact lists, we do not enrich your record from data brokers, and we do not run tracking pixels for advertising networks on this site.

Enquiries you send us

There is no contact form on this website and no form processor behind it. The only way to reach us is to email [email protected], so the only enquiry data we ever hold is whatever you choose to put in that email — typically your name, your email address, and whatever you tell us about your business.

Those emails sit in our own mailbox and are read by a person. We do not copy them into a CRM or a marketing automation platform, we do not add you to a mailing list because you wrote to us, and there is no drop-down, hidden field or tracking parameter collecting anything you did not type yourself.

Server access logs

Like every web server, ours records requests: IP address, timestamp, the URL requested, the response status, referring URL and user agent. These logs exist so we can diagnose errors, measure load and investigate abuse. We do not use them to build profiles of individual visitors.

Analytics, only with consent

Optional analytics run only if you accept them on the consent banner. Decline, and no analytics or measurement scripts are loaded at all — not in a reduced state, not queued for later. Analytics data we do receive is used in aggregate to see which pages are read and where people drop off. See our Cookie Policy for the current inventory.

3. Why we collect it, and on what legal basis

Different data, different justification. We list them separately because bundling everything under “to improve our services” tells you nothing.

We do not use enquiry data to send unrelated marketing. If we ever want to add you to a mailing list, we will ask first and the answer being “no” will not affect your enquiry.

4. How long we keep it

An enquiry record is kept while the enquiry is live and for a reasonable period afterwards, because a business that asked for a quote in March often comes back in September and it is unhelpful to have lost the context. If a conversation goes nowhere and clearly will not resume, we delete it. If you ask us to delete it sooner, we do.

Server access logs are short-term operational records, retained only as long as they are useful for diagnosis and abuse investigation, then rotated out. Rate-limiting records live in memory for minutes and are discarded when the process restarts. Client records tied to a signed engagement are retained for as long as the relationship runs and then for the period required by tax, accounting and limitation rules — that retention is a legal obligation, not a preference, and it survives a deletion request for those specific records.

5. Who we share it with

We do not sell personal data. We have never sold personal data, and we do not share it with third parties for their own marketing or advertising purposes. There is no category of data we “share” in the sense that term carries under California law for cross-context behavioural advertising.

The parties who can technically access data on our behalf are the ones needed to run a website and a business:

• Our hosting and infrastructure provider, which stores the server and its logs
• Our email provider, which carries the messages between you and us
• Our analytics provider, but only where you have consented to analytics
• Professional advisers — accountants and, if ever needed, lawyers — under their own duties of confidence

These act as processors under contract: they may use the data to provide the service to us and for nothing else. The web fonts on this site are served from Google’s font infrastructure, which means your browser makes a request to those domains and Google receives your IP address as a consequence of that request. We may also disclose data where we are legally required to, or to establish or defend a legal claim, as described in our Terms of Service.

6. Cookies, local storage and analytics

The consent banner you see on a first visit offers two options: Accept all and Essential only. Choosing either records your choice in your browser’s local storage under a single key, which is why the banner does not reappear on the next page. That record stays on your device, is not transmitted to us, and is not a cookie — clearing your browser’s site data removes it and the banner returns, letting you change your mind.

If local storage is blocked in your browser, we take that as a signal to leave you alone: the banner is not shown and optional scripts are not loaded. Full detail on every category, including what a third-party embed can set if we ever include one, is in the Cookie Policy.

7. Your rights

Wherever you live, you can ask us to do the following with data we hold about you, and we will not charge you for asking or treat you differently for having asked:

• Access — a copy of the personal data we hold about you and what we do with it
• Correction — fix anything inaccurate or incomplete
• Deletion — remove it, subject to records we must keep for tax or legal reasons
• Opt out — withdraw analytics consent, or object to processing based on legitimate interest
• Portability — receive the data you gave us in a portable format

Residents of California have specific rights under the CCPA as amended by the CPRA: to know the categories and specific pieces of personal information collected, the sources, the purposes and the categories of recipients; to delete; to correct; to opt out of sale or sharing; and to limit the use of sensitive personal information. Two of those are simple for us to answer — we do not sell or share personal information, and we do not collect sensitive personal information as that term is defined. You may use an authorised agent, and we may need to verify their authority and your identity before acting. Residents of other states with comprehensive privacy laws, including Colorado, Connecticut, Virginia, Texas and others, have closely equivalent rights and can use the same route.

8. Security

We apply technical and organisational measures proportionate to what we hold. Traffic to and from this site is encrypted in transit with TLS. Access to enquiry records is limited to the people who need it to reply to you. The infrastructure is patched on a schedule, backups are held off the machine that serves the site, and the same practices we sell on our managed hosting plans are the ones we run here.

No method of transmission or storage is perfectly secure, and any company that tells you its systems cannot be breached is selling something. What we can commit to is keeping the amount of personal data we hold small, not collecting fields we have no use for, and telling you promptly and honestly if a breach affects your data.

9. Children

This site is directed at businesses and the people who run them. We do not knowingly collect personal data from anyone under 16, and we have no service that would sensibly be marketed to them. If you believe a child has submitted personal data through our forms, tell us at [email protected] and we will delete it.

10. International visitors

We are a United States business serving US clients, and our servers and service providers are located in the United States. If you contact us from outside the US, the data in your enquiry will be transferred to and processed in the United States, where privacy law differs from the law where you live. Sending us an enquiry is your decision to proceed on that basis. Where a transfer mechanism is legally required for a specific client engagement, we address it in the contract for that engagement rather than by assertion here.

11. Changes to this policy

We update this policy when what we do changes — a new provider, a new form field, a new legal requirement — and not on a marketing schedule. The effective date at the top of this page changes whenever we publish a revision, and the previous version it replaces is named alongside it. For a material change affecting how we use data you have already given us, we will say so prominently on the site and, where the change requires it, ask for fresh consent rather than assuming it.

12. Questions and complaints

Ask us first: [email protected], or through the contact page. Most privacy questions turn out to be simple, and we would rather answer one directly than have you file a complaint to find out. If you are not satisfied with our response, you may complain to your state attorney general’s office or, outside the US, to your local data protection authority.

---

Related pages

The rest of the picture: our Cookie Policy covers storage and consent in detail, our Terms of Service covers the contractual side, and our accessibility statement covers how the site itself is built. If you are here because you are weighing us up before making contact, our about page explains who does the work and our FAQ answers what most people ask before an enquiry — including the fact that clients own their own ad, analytics and hosting accounts outright.