Privacy Policy

Information We Collect

• Information you submit through the short inquiry form: name, email address, phone number, and any optional production capabilities you select.
• Each project-form submission also includes a random submission ID, query-free page path, language, stable form and location codes, applicable service or campaign codes, and a snapshot of the four tracking-consent signals at submission. If analytics is denied, browser and session identifiers and analytics attribution remain blank.
• With analytics consent, random browser and tab-session identifiers, query-free page paths, page language, stable route, service, form and CTA codes, active visible engagement, scroll depth, and typed contact or form events.
• Before you choose, allowlisted UTM and click fields, the external referrer hostname, and a query-free landing path may be held only in temporary browser memory. They are not persisted or transmitted before analytics consent and are cleared after denial. With analytics consent, they may be stored as campaign attribution.
• When Analytics is granted, a project inquiry may include the real Google Analytics client ID obtained through the consent-managed Google tag. When Advertising is granted and Global Privacy Control is not enabled, it may include allowlisted Google or Meta click and browser identifiers. Each purpose includes the policy version and time of the recorded grant; denied purpose fields remain blank.
• After an inquiry, our CRM and first-party systems may record HubSpot contact and deal identifiers, contact and qualification stages, whether a proposal was sent, whether services were contracted or not contracted, a stable outcome reason, relevant stage times, and an approved deal value and currency. While Analytics remains authorized, configured HubSpot Deal properties may also receive stable channel and campaign-page classifications plus a registry-authenticated paid campaign identifier and query-free paid landing path; referrer, term, ad-content, and click-identifier values are excluded.
• For approved paid-campaign inquiries, first-party systems may also store an immutable versioned modeled USD value based on the campaign's service category. It is an internal campaign-measurement estimate, not a quote, invoice, contract price, or actual revenue. A verified contracted amount takes priority for closed-won reporting.
• Hosting and security providers may process technical request information needed to deliver and protect the site. We do not intentionally persist IP addresses, user agents, precise location, fingerprints, raw referrer URLs, query strings, or fragments in our behavioral analytics records.

How We Use Information

• To reply to inquiries and provide quotes.
• To contact you, discuss your event needs, prepare an appropriate production scope, and plan audiovisual services after that conversation.
• With the relevant consent, to measure site performance, journeys, campaign effectiveness, and advertising conversions.
• To improve service quality, operations, and response times.

Consent and Tracking Choices

Necessary technology remains active to operate the site and remember your policy-bound selection for up to 180 days. Analytics and advertising are separate optional choices and default to denied. An enabled Global Privacy Control signal denies Advertising without automatically changing Analytics. You may accept all, use necessary technology only, or save a custom selection. Forms and contact links remain available either way, and Cookie settings in the footer lets you change future processing at any time.

Withdrawing analytics consent clears optional analytics identity and attribution from that browser, cancels active first-party analytics requests where possible, stops future first-party journey collection, and uses that browser's opaque Analytics capability to suppress unsent Analytics lifecycle work for the inquiry. Withdrawing advertising consent sends denied advertising signals and uses a separate opaque Advertising capability to suppress unsent advertising-conversion work. An event already accepted by a provider cannot be recalled by changing a browser preference. Withdrawal does not automatically delete business, CRM, or analytics records already received; you may submit a deletion request where applicable.

If suppression cannot be confirmed immediately, the browser retains and retries only the opaque pending withdrawal in limited batches. Re-enabling a category later does not cancel a withdrawal already requested for earlier work.

Data Separation and Marketing Tags

Contact information from a project inquiry is stored in contact and lead systems. Behavioral analytics uses random UUIDs and stable machine codes. Names, email addresses, phone numbers, and form-field values are not placed in the browser data layer or first-party behavioral event records.

Google Tag Manager is the only approved browser boundary for optional analytics and advertising tags. The external container is not requested before at least one optional category is granted. Destination providers may process permitted identifiers under their own terms and the consent signals supplied to them.

If only advertising is granted, the container may receive approved PII-free page and action events with a random event ID and time, query-free path, language, and stable route or action codes. It does not receive our first-party browser or session identifiers, analytics attribution, or form-field values in that state.

Separately from browser tags, Supabase may deliver consented server-owned lifecycle events to Google Analytics 4 through Measurement Protocol, Google Ads through Google Data Manager, and Meta through the Conversions API. GA4 lifecycle delivery does not include contact information and marks ad user data and ad personalization denied. For Advertising-authorized delivery, Google Ads and Meta may receive consented click or browser identifiers and just-in-time normalized SHA-256 hashes of contact information for matching. Raw contact values exist only in transient delivery memory for this matching step; our system does not persist provider payloads or response bodies.

Sharing and Service Providers

We do not sell personal information for money. Netlify supports website hosting, delivery, and related request handling. Supabase processes project-form and lead records, consent snapshots, first-party journeys, lifecycle outcomes, withdrawal state, queued provider delivery, and delivery diagnostics. HubSpot processes contact and project details, CRM stages, proposals, deal identifiers, and contracted or not-contracted outcomes for sales operations. Google Tag Manager may send permitted browser events to authorized destinations after the relevant optional choice; the separate server delivery paths are Google Analytics 4 Measurement Protocol, Google Data Manager for Google Ads, and Meta Conversions API. Depending on the technology and applicable law, advertising measurement may be treated as a sale, sharing, or targeted advertising; you can opt out by denying Advertising in Cookie settings and may contact us about additional rights.

Retention

The browser privacy preference expires after 180 days. We have not yet approved fixed, category-specific database retention periods or enabled an automated deletion schedule for business inquiries, anonymous or converted journeys, campaign identifiers, consent records, webhook receipts, and delivery diagnostics. Bounded cleanup tools require an authorized operator and explicit cutoff; they do not establish a retention period or schedule. Until those controls are approved, records may remain in active systems and provider-managed backups for longer than a defined period.

Data Security

We use reasonable technical and organizational safeguards designed to reduce unauthorized access, alteration, disclosure, or loss. No method of transmission or storage is completely secure.

Your Rights

Depending on where you live, you may have rights to request access, correction, deletion, or a copy of personal information; to withdraw consent; or to opt out of certain sale, sharing, or targeted-advertising activity. We may need to verify your request and may retain information when the law permits or requires it.