Privacy Policy

Effective date: 2026-09-24 · Last revised: 2026-09-25

1. Who we are

BuiltRight Digital LLC, a Florida limited liability company ("BuiltRight", "we", "us", "our") is a full-stack marketing studio in Tampa, Florida. We operate the website builtrightdigital.us (the "Site") and provide website design and development, website hosting, search-engine optimization (SEO), answer-engine optimization (AEO), Google Business Profile setup and management, and — through our content studio Crystal Hook Media — film, photography and social content, to businesses in the United States. Websites are the focus of the practice. Our services are not limited to any single industry.

Principal office and mailing address: BuiltRight Digital LLC, 4902 W Lancaster St, Tampa, FL 33616, USA Phone: (813) 956-4416 Contact for privacy requests: support@builtrightdigital.us

2. Information we collect

2.1 Information you provide directly

Email you send us: the Site's footer email link and every contact link on it open your own mail client addressed to support@builtrightdigital.us. We receive whatever you write, your email address and any signature data. There is no chat widget on the Site.
Enquiry form: if you send us an enquiry through the form on the Site, we collect your name and email address (required) and whatever else you choose to give us: business name, website, phone number, what you need help with, and your message. With it we record the page the form was on, any campaign tags in the link you arrived by (utm_ parameters), your browser's user-agent string, and a one-way salted hash of your IP address — never the IP address itself — so we can spot and block abuse. We use the enquiry only to reply to you and follow up about the work you asked about. Sending it does not sign you up for marketing email or text messages, and no automated reply is sent. The enquiry is stored in our Cloudflare database, and a copy is posted to our internal Slack workspace so the team sees it straight away. To keep out spam, the form may use Cloudflare Turnstile, a bot check that runs in your browser. Enquiries are kept for sales follow-up and deleted on request (see §8).
Booked-meeting information: the booking links open a Google Calendar appointment page (calendar.app.google). You book through Google, not through us: the name, email address, time slot and any notes you enter there are collected and processed by Google under Google's own privacy policy, and Google sends us the resulting booking. We then hold the date/time of the meeting and the notes you provided.
Do-Not-Call opt-out form at /optout: the phone number you want suppressed and, optionally, a free-text reason. We store the number permanently so we can never contact it again — that is the point of the list.
Client feedback portal at /f/<token>: if you are a Client and we send you a private feedback link, we store the feedback, ratings and notes you submit through it.
Email replies to any outreach we send: full email content, your email address, signature data.
Voice / phone interactions: if you speak with a member of our sales team by phone, we collect the phone number dialed, call duration, any recording (if and when call recording is enabled — see §3), and notes from the conversation.
Billing information (only if you become a paying Client): name, business name, billing address, payment card or ACH info (processed via our payment processor — BuiltRight does not store full card numbers).

2.2 Information collected automatically

Site analytics — PostHog. The Site's only analytics tool is PostHog (PostHog, Inc., US cloud, us.posthog.com). It is the only third-party script on the Site that measures anything, and we run no advertising or ad-retargeting tag of any kind. PostHog records: page views, page-leave events, clicks, form submissions and input-change events, referring URL, device/browser type, and approximate geographic region (city/country, inferred from IP).
Session recording, with every input masked. PostHog session recording is enabled on the Site. A recording replays how a page was used — pointer movement, scrolling, clicks, page structure. Every form input is masked, so the characters you type are not captured in a recording. Recordings are used to find and fix usability problems.
Do Not Track is honored. If your browser sends a Do Not Track signal, PostHog is never started: no page views, no click capture, no session recording, no analytics cookie.
Nothing is measured on the Do Not Call opt-out page. On /optout PostHog is never started, and if you arrive there from another page, nothing that happens on it is sent: no page view, no click capture, no session recording.
Token scrubbing. Private client links carry an access token in the URL. Those token parameters are stripped from every URL before anything is sent to PostHog, in the page and again in PostHog's outbound filter.
IP address at the time of request (used for fraud prevention and rough geolocation).
Cookies and local storage: essential session cookies (session, CSRF protection); PostHog stores its device and session identifiers in localStorage and a first-party cookie. No advertising or marketing cookies.
Google Fonts. The Site loads its typefaces from Google's font servers (fonts.googleapis.com, fonts.gstatic.com), so your browser makes a request to Google, which Google receives with your IP address and user-agent. We send Google nothing else.

2.3 Information from third parties

Prospect data: if we reach out to you cold, we obtained your publicly listed business name, phone number, website, and similar business contact details from publicly available business directories — primarily Google Business Profile, accessed through the Google Places API — together with other public business listings and government business registries. We collect business contact information, not personal data unrelated to your business.
Payment processing data from our payment processor when you pay an invoice.
CRM enrichment via our CRM platform (GoHighLevel) — business name lookups, social profiles.

2.4 Information we do NOT collect

We do NOT collect precise geolocation.
We do NOT collect government IDs, SSNs, financial account numbers directly (payment data goes through our payment processor).
We do NOT collect biometric data beyond voice recordings of calls you participate in (voice recordings are not used for biometric identification).
We do NOT collect information about children under 13. The Site is not directed to children.

Our outbound calls are placed by human members of the BuiltRight sales team. We do not use an AI voice assistant, automated voice, or robocalling.
Recording. Outbound and inbound calls may be recorded for quality, training, compliance, and dispute-defense purposes. We treat a dialed published business line as having a reduced expectation of privacy under federal one-party consent (18 U.S.C. §2511(2)(d)).
Two-party consent jurisdictions. If you are located in a two-party consent state (e.g., Florida, Fla. Stat. §934.03(2)(d), and similar provisions in other states), you may stop the recording at any time during the call by telling the representative "stop recording", "don't record me", or words to similar effect; we will disable recording for the remainder of that call. Continuing the conversation without objection constitutes your implied consent under those states' equivalent provisions.
Recording retention: we retain any call recordings only as long as required by federal TCPA and TSR recordkeeping rules and our internal quality and dispute-defense needs. Retention is shortest for non-Client cold calls and longest for calls that resulted in a booked meeting or Client engagement.
Access to recordings: only authorized BuiltRight personnel have access. Recordings are NOT used to train AI models. Recordings are NOT shared with third parties outside the sub-processor list in §6.
Request deletion of your call recording: email support@builtrightdigital.us with the phone number dialed and approximate date/time. We will delete within 30 days of verification, except where retention is legally required.

4. How we use your information

To provide services: build your website, host it, respond to support inquiries, process payments.
To contact you: respond to inquiries, schedule meetings, deliver website updates, send invoices.
For cold outreach (prospects only): place outbound calls by our sales team to published business phone numbers, send a follow-up SMS with a booking link after you verbally agree on a call to receive it (see the "SMS Consent" section of our Terms), and send business email outreach.
For analytics and site improvement: understand Site traffic, improve Site UX, measure campaign effectiveness.
For compliance and legal reasons: respond to lawful requests by public authorities, enforce our Terms of Service, defend against claims.
Marketing email opt-out: every marketing email we send includes an unsubscribe link (CAN-SPAM compliant). Clicking unsubscribe removes you from the marketing list within 10 business days (often within 24 hours).

We do NOT sell your personal data. We do NOT share your personal data with third parties for their own marketing. We do NOT use your personal data for automated decision-making with legal or similar significant effects.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All of the data categories described in this policy exclude text-messaging originator opt-in data and consent; this SMS opt-in information is never shared with any third parties, and is used solely to send the booking-link and appointment messages you consented to.

For visitors located in the EU/EEA/UK (though not our target market):

Consent (Art. 6(1)(a) GDPR): analytics cookies, marketing emails.
Legitimate interest (Art. 6(1)(f) GDPR): fraud prevention, Site security, direct B2B outreach.
Contract performance (Art. 6(1)(b) GDPR): providing services to Clients.
Legal obligation (Art. 6(1)(c) GDPR): retention to satisfy TCPA/TSR rules.

6. Sub-processors (third parties that process data on our behalf)

We use a small number of service providers, listed below. Where a provider is named, that is the provider we actually use. Two rows are still shown as a category rather than a name, because the named provider for that function is not yet settled; if you need the named vendor operating under a category for a legitimate compliance, security-review, or data-subject-rights purpose, email support@builtrightdigital.us with subject line "Sub-processor list request" and we will respond within 30 days.

Sub-processor	Purpose	Data processed	Location
PostHog — product / site analytics	Traffic, UX metrics, session recording (all inputs masked)	Device + session IDs, event data, IP address, device/browser info, masked session recordings	US
Cloudflare — site hosting, CDN, DNS	Host and serve builtrightdigital.us	Request logs, page view logs, edge function logs; enquiry-form submissions (stored in a Cloudflare database); Turnstile bot-check signals when the form uses it	US company; served from the Cloudflare edge location nearest the visitor, which may be outside the US
Slack — internal team messaging	An instant internal alert when an enquiry arrives through the Site's form	The enquiry-form fields you submitted (not your IP address or its hash)	US
Supabase — database + backend infrastructure	Store CRM, call, client and opt-out data	All CRM, call, client, recording and Do-Not-Call data	US
GoHighLevel — CRM / sales pipeline platform	Sales CRM, pipeline management	Lead contact info, pipeline stage, meeting data	US
Google — appointment scheduling, fonts, public business data	The Google Calendar page the booking links open; the Site's webfonts; the Google Places API used to find publicly listed businesses	Booking name/email/time/notes; IP + user-agent for font requests; public business listings (name, phone, website, address)	US
Instantly — cold email outreach platform	Send and track business email outreach, handle bounces and unsubscribes	Business email address, business name, email content, engagement + bounce events	US
Twilio — telephony / SMS and phone-number validation	Telephony, SMS, call recording, and checking whether a published business number is a working line before any outreach	Phone numbers, call records, recordings, SMS content	US
Payment processor	Process invoices and Client payments	Billing name, business name, card data (tokenized — we never see the PAN), ACH details	US
Business email provider	Operational email	Email content	US

We require each sub-processor to (a) have commercially reasonable security practices, (b) process data only for our instructed purposes, (c) support our deletion / access requests. We review this list at least annually and update as the infrastructure changes.

7. Your rights

7.1 Rights for everyone (FL + anywhere in US)

Access / portability: request a copy of the personal data we hold about you.
Correction: ask us to fix inaccurate data.
Deletion: ask us to delete your data (exceptions apply — see §7.4).
Marketing opt-out: unsubscribe from marketing emails; ask us to add you to our internal Do Not Call (DNC) list.
Opt-out of sale of sensitive data (FDBR, applies to all businesses regardless of revenue): we do not sell any personal or sensitive data, but if this ever changes, an opt-out path will be published here first.

7.2 Additional rights for California residents (CCPA/CPRA)

Right to know categories and specific pieces of personal information collected.
Right to delete personal information.
Right to correct inaccurate personal information.
Right to opt out of sale or sharing of personal information. We do not sell or share your personal information.
Right to limit use of sensitive personal information. We do not use sensitive personal information beyond permitted purposes.
Right to non-discrimination for exercising CCPA rights.

All rights under Arts. 15-22 GDPR (access, rectification, erasure, restriction, portability, objection, non-automated decision-making).
Right to lodge a complaint with a supervisory authority.

7.4 How to exercise your rights

Email: support@builtrightdigital.us
Subject line: "Privacy Request — [Access / Deletion / Correction / Opt-Out]"
Response time: 30 days for most requests; 45 days if complex (we will notify you of any extension).
Verification: we may ask you to verify your identity before acting on a request (typically by matching the email address or phone number on file).

7.5 Retention exceptions to deletion

We may retain data past a deletion request if legally required:

TCPA/TSR recordkeeping (5 years for outbound call artifacts).
Accounting/tax records (7 years per IRS guidance).
Active litigation or legal hold.
Fraud prevention records.

8. Data retention

We retain personal data only for as long as needed for the purposes for which it was collected, and as required by applicable law. The categories below are operational; specific retention periods are reviewed periodically and may be adjusted to meet legal, accounting, or security needs.

Data type	Retention principle
Enquiry-form submissions (non-Client), including the Slack alert copy	Retained for sales follow-up; deleted from our database and from Slack on request unless an active pipeline relationship exists
Cold-outreach lead records (phone, email)	Retained for sales cycle duration; DNC requests retained indefinitely so we never re-dial an opted-out number
Call recordings + transcripts (non-Client)	Retained only as long as required for our internal quality review and applicable federal recordkeeping rules
Call recordings + transcripts (Client / booked meeting)	Retained for the duration of the engagement plus the periods required by federal TCPA + TSR rules
Client project + deliverables	Retained as required by tax + intellectual-property recordkeeping rules
Client billing records	Retained as required by IRS rules
Website analytics	Retained on a rolling window for product improvement
Server logs	Retained on a rolling window for security + debugging
Backup snapshots	Retained on a short rolling window for disaster recovery

9. Security

All data in transit encrypted via TLS 1.2+.
Database uses AES-256 encryption at rest.
Access controls: role-based; only authorized BuiltRight personnel have admin access.
Call recordings stored in private object storage with signed-URL-only access.
Incident response: any confirmed data breach affecting 50+ records or sensitive personal data will trigger notification to affected individuals within 30 days, per FL, CA, and applicable federal law. Written breach notification policy on file internally.

10. Cookies and tracking

Essential cookies: required for Site function (session, CSRF protection).
Analytics: PostHog stores its device and session identifiers in localStorage and in a first-party cookie, and records the events and masked session recordings described in §2.2.
How to opt out of analytics entirely: turn on "Do Not Track" (or equivalent) in your browser. PostHog is then never initialised on the Site — no page views, no click capture, no session recording, no analytics cookie. Clearing site data for builtrightdigital.us removes the identifiers already stored. There is no cookie banner on the Site to click.
No third-party advertising cookies.
No cross-site tracking pixels.
No other analytics tool, and no advertising or ad-retargeting tag of any kind. PostHog is the only measurement script on the Site.

The Site does not display a cookie-consent banner. Under US law, including the Florida Digital Bill of Rights at our scale, it is not required to. We have chosen not to show one rather than show a banner that does not actually gate anything — the honest opt-out is the Do Not Track setting above, which we enforce in code.

11. Children's privacy

The Site and BuiltRight's services are not directed to children under 13. We do not knowingly collect personal information from children. If you believe a child has provided personal information to us, contact support@builtrightdigital.us and we will delete it promptly.

12. Do Not Call (DNC)

If you ask us — verbally or in writing — to stop calling you, we will:

Add your number to our internal DNC list within 24 hours.
Never dial that number again from any BuiltRight-operated DID.
Propagate the DNC flag across all our calling platforms.

You may also register on:

Federal DNC Registry: https://www.donotcall.gov
Florida Do Not Call List (FDACS): https://www.fdacs.gov/Business-Services/Florida-Do-Not-Call

We scrub against both the federal and Florida DNC lists weekly prior to any outbound calling campaign.

13. International data transfers

Our infrastructure and all of our service providers are based in the United States. If you access the Site from outside the US, your information is transferred to and processed in the US, which may have different data protection laws than your country. One qualification, for accuracy: the Site is served from Cloudflare's global edge network, so the server that answers your request is the Cloudflare location nearest to you, which may be outside the US. Your request log may therefore be handled at a non-US edge location before reaching our US systems.

For EU/UK visitors: we rely on the relevant Standard Contractual Clauses (SCCs) in place between BuiltRight and our sub-processors where applicable. (Most of our sub-processors have self-certified under the EU-US Data Privacy Framework.)

14. Changes to this Privacy Policy

We may update this Privacy Policy from time to time.
Material changes will be announced at least 30 days in advance via banner on the Site and/or email to active Clients.
The "Effective Date" at the top reflects the most recent revision.

15. Contact

Privacy questions, requests, complaints:

BuiltRight Digital LLC, a Florida limited liability company 4902 W Lancaster St, Tampa, FL 33616, USA Phone: (813) 956-4416 Email: support@builtrightdigital.us Do-Not-Call / opt-out: remove@builtrightdigital.us, or the form at https://builtrightdigital.us/optout Site: https://builtrightdigital.us/privacy