Skip to main content
Book a callEstimateGet Estimate
Privacy

Privacy Policy

This covers acuityweblabs.com — its contact form, its estimator, its booking page at /book, and the demo apps under /demos. Work I do for a paying client runs under a separate written agreement and is not covered here.

Who is responsible

Acuity Web Labs is a registered business operated by Drew Palframan from Ucluelet, British Columbia. My service providers may process or store your information outside Canada, including in the United States.

Send privacy questions and requests to info@acuityweblabs.com, the same address as general inquiries.

What the contact form collects

The contact form collects the following information.

  • Your name — required.
  • Business name — required.
  • Email address — required.
  • Phone number — optional. The form works without it.
  • What your business does — required.
  • Your estimate and selected options — hidden fields, present only if you used the estimator. They carry the summary you saw on screen.
  • Which page you came from — a hidden field naming the page or button that opened the form, for example “Homepage”.
  • A logo file — only if you attached one in the estimator.
  • A consent checkbox — you agree to be contacted about the estimate.
  • A hidden anti-spam field — always empty for a real person.

What happens when you submit

When you press submit, the form first runs your inquiry past a check that screens out automated spam and confirms the required fields are usable. If it fails, the form stops and nothing is sent on. Netlify applies its own spam filtering underneath that.

Otherwise it goes to Netlify Forms — a service run by Netlify, Inc., which hosts this site — which stores it and sends me an email notification. Beyond that I do not sell, rent, or trade your information, and it goes into no CRM, spreadsheet, or automation tool. Two companies handle it: Netlify, which stores the submission, and Google Workspace, which carries the email to me.

How long a submission is kept: up to 12 months from my last contact with you, as a business record, and then I delete it — the submission, any file attached to it, and the email thread. Ask me to delete yours sooner and I will. If it becomes a project, the correspondence belongs to that client relationship and its separate agreement.

To prevent spam and repeated submissions, the site also processes your IP address and information derived from your inquiry for a short time. Those records are removed automatically on a daily schedule.

The estimator and your logo

Your answers to the estimator’s questions are saved in your own browser so you can close the tab and come back. Those answers reach me only when you press submit, and clearing site data for this site removes the draft. This is about the estimator itself — analytics, described below, runs separately.

If you upload a logo, the accent colour is picked by reading the image inside your own browser — no upload, no server, no AI service — and the file is deliberately never saved into that draft. The image leaves your device only if you go on to submit the form with it attached.

Booking a call

The booking page collects your name, your email address, anything you choose to write in the notes box, the topic you pick and the time you pick. It has the same hidden anti-spam field as the contact form.

When you book, that is written to a store on Netlify’s servers, and two emails go out — a confirmation to you, and a copy to me with your notes. Netlify stores the booking, Resend sends the confirmation to you and a copy to me, and Twilio sends me a text message that you booked — your name, the time and the booking reference, nothing more. For a paid strategy session, Stripe processes the $175 CAD card payment; I do not receive or store your card number. When my Google Calendar is connected, the times you can pick come from it and the call is placed on it with your name, email and notes. It goes into no CRM or automation tool, and it is not sold, rented or traded.

How long a booking is kept: until you cancel it, which deletes it, or until you ask me to remove it — there is no automatic sweep of calls that have already happened. After seven days, an unpaid checkout draft is removed once Stripe confirms the session expired; a refunded draft is removed then too. Stripe retains its payment records under its own rules. The copy I receive by email is kept like any other inquiry, under the rule above.

The link in your confirmation is what lets you cancel or move the call from this site. This site keeps only a one-way fingerprint of it, not the link itself, and my own copy of the booking never carries it — it goes in the email to you and to nobody else. If you lose it, email me with your reference instead.

Analytics and cookies

I use Google Analytics 4 to see which pages people read and where inquiries come from. It reports pages viewed, rough location, and general device and browser information to Google, and sets its own cookies.

I also use Ahrefs Web Analytics to measure page views, traffic sources, outbound link clicks and form submissions. Ahrefs receives page URLs, referrers, browser and device information, and an IP address used to estimate location. According to Ahrefs, its default analytics does not set cookies or retain raw IP addresses.

I also use the Meta Pixel, so I can tell whether my Facebook and Instagram ads bring anyone to the site and show those ads to people who have visited. It reports the pages you view, your browser and device, and your IP address to Meta, and sets its own cookie. If you are logged in to Facebook or Instagram, Meta can connect the visit to that account.

Google Analytics does not receive what you type. The form sends its contents directly rather than putting them in the web address, and the site never writes your answers into the address bar. What it does see is the address itself, which can name the package you clicked from the pricing page.

Two things worth stating plainly rather than leaving you to assume otherwise: there is currently no cookie banner and no consent gating on this site, so analytics runs on every visit; and the only analytics cookies set here are Google Analytics’ and Meta’s own — this site sets none of its own.

Two things are kept in your own browser rather than sent anywhere on their own. An estimate you start in the Get Started wizard is saved on your device so a refresh, or a look at the pricing page, does not wipe your answers — it stays until you use the wizard's own Start over button or clear your browsing data. And if you arrive from an ad, a search result or another website, the campaign tags in that link and the domain you came from are kept for that visit only, so I can tell which pages actually bring people here; if you then send an inquiry, that is attached to it. Closing the tab clears it.

How long Google keeps that analytics data: the property is set to 2 months for event data and 14 months for user data. Google notes these cover the detailed records only — its aggregated reports are unaffected, and the user-data window can restart on a return visit.

Other services this site touches

  • Ahrefs provides the cookie-free web analytics described above. See what Ahrefs says it collects.
  • Netlify hosts the site and stores form submissions and bookings, so its servers see request IP addresses and browser user-agent strings. Netlify's own Real User Monitoring is available on my plan but is not switched on, so Netlify collects no analytics here beyond the ordinary server logs any host keeps. Netlify’s privacy policy.
  • Google provides the analytics above, the Workspace mail that carries your inquiry, or my copy of your booking, to me — and, when it is connected, the Google Calendar the booking page reads my free times from and places your call on. Google’s privacy policy.
  • Resend sends the booking confirmation to you and my copy of it to me, so your name, your email address and your notes pass through it. What it keeps of a sent message, and for how long, is set out in Resend’s privacy policy.
  • Stripe processes card payments for the paid strategy session. The payment form is provided by Stripe; I do not receive or store your card number. See Stripe’s privacy policy.
  • The demo apps under /demos load styling, icons and fonts from public CDNs, and the vehicle quote demo looks up models through a public US government vehicle database. Connecting to any of those gives that provider the ordinary information a web request carries, including your IP address. The demos have no backend of mine and keep what you type in your own browser — but they are demonstrations, so use fictional details rather than real customer information.
  • Fonts on the main site are served from this site itself, so no request goes to Google Fonts. The demo apps above are the exception — they load theirs externally.
  • There are no embedded maps, chat widgets, ad pixels or social tracking tags anywhere on this site.

How the site is secured

The site is served over HTTPS only, and is configured with the standard browser security protections against code injection, framing and unnecessary data leaking to other sites.

Your choices

  • Clearing your browser’s site data for this site removes the saved estimator draft and anything the demo apps stored.
  • Google publishes an official browser add-on that opts you out of Google Analytics across sites that use it.
  • To ask what is held about you, or to have it corrected or deleted: email info@acuityweblabs.com. I will acknowledge it promptly and respond within 30 business days. If there is something I cannot hand over or delete — because I am required to keep it, or because it is bound up with someone else's information — I will tell you which and why.

Children

This site sells web development services to businesses. It is not directed at children and does not knowingly collect information from them.

If you have a concern

I am responsible for privacy at Acuity Web Labs. If something here worries you, or you think I have handled your information badly, email me first at info@acuityweblabs.com and I will do my best to put it right.

If my answer does not satisfy you, you can take it to the Office of the Information and Privacy Commissioner for British Columbia. Their guidance for the public is at oipc.bc.ca.

Changes to this policy

If this policy changes in a way that affects what is collected or where it goes, the effective date below changes with it.

Effective date: 9 September 2026