Privacy, in plain language

Most privacy policies are written so you won't read them. This one is written so you will. It covers windocreative.com, go.windocreative.com, and intake.windocreative.com, and they behave differently. go.windocreative.com is where our ad campaigns land; intake.windocreative.com is the intake form we send to clients before an audit. Every claim on this page describes what each site actually does. When that changes, this page changes in the same breath.

What we collect

Anonymous analytics. We use Google Analytics (through Google Tag Manager) to understand how the site is used: which pages get visited, how people move through the five-question quiz, and whether the audit preview gets used. This involves cookies from Google (the _ga family). We've configured it conservatively: no advertising personalization, and data is retained for 14 months.

What you send us. If you complete the quiz, your answers and the contact details you type (name, email, company) are emailed directly to our inbox. They are not stored in a database, not added to an automated marketing sequence, and a person (not a sequence) replies. The same is true of the audit request form: your name, email, the website you want looked at, and anything you add.

The checklist mailing list. The checklist page is the one place on this site that puts you on a mailing list, and only when you ask it to there. Your email address, and your first name if you give it, go to Resend, the service that sends those emails. Signing up starts emails from us: the checklist, a short series after it, then an occasional note. Resend records whether each one was delivered, opened, or clicked, which is how we tell whether they are worth sending. Every email has an unsubscribe link, and unsubscribing stops them. Nothing else on this site, and nothing on go.windocreative.com or intake.windocreative.com, adds anyone to this list.

Your display preference. The dark/light mode toggle saves your choice in your own browser's storage. It never leaves your device and identifies nothing.

Our ad funnels (go.windocreative.com)

What they are. Pages on go.windocreative.com are the destination of our Meta (Facebook and Instagram) ads. They ask a few one-tap questions, then offer a short form.

Meta Pixel and Conversions API. When you visit, we tell Meta which steps you reached and whether you submitted the form, both from your browser and from our server. This is how we measure whether an ad works. Meta receives its own cookie values (_fbp and _fbc), your browser's user agent, your IP address, and a hashed anonymous visitor id.

If you submit the form. The details you typed (email, phone if asked, name) are hashed with SHA-256 before they are sent to Meta, so Meta can match them to an account. We never send the readable values.

Your answers. Your answers to the funnel's questions are used to route you through it and to score whether you are a fit. Meta receives a qualified or not qualified flag, a fit score, and the step you reached, never the answers themselves.

What we store ourselves. The steps you visited, timing, the ad and campaign that brought you (UTM parameters and click ids), the page you arrived on, your browser type, and your country, derived from the request rather than your address. If you submit the form, we also store your contact details and answers. Contact details are encrypted at rest. Your IP address is passed to Meta in memory and is never written to our database or a cookie.

Cookies on go.windocreative.com.

• bf_anon (1 year): anonymous visitor id.
• bf_attr (30 days): which ad brought you here (UTMs, click ids, referrer).
• bf_sid (30 minutes): the current visit.
• _fbc (90 days): Meta click id, set only when you arrive from a Meta ad.
• _fbp (set by Meta): Meta's browser id.
• bf_p_* (1 hour): your partly completed form, encrypted, deleted when you submit.
• bf_a_* (24 hours): your quiz answers, so the page works with JavaScript off.

Where submissions go. Your submission is stored, encrypted, in our system, and a person (not a sequence) reads it and replies. It is not added to an automated marketing sequence.

Variant testing. We sometimes show two versions of a funnel and keep the one that performs better. Which version you see is decided from your visitor id and does not change what we collect.

The audit intake form (intake.windocreative.com)

Your answers and contact details are stored encrypted and read by a person. That form carries no advertising or analytics tracking: nothing about your visit or your answers is sent to Meta. Your answers are also copied into the audit tool we run on our own machine to prepare your audit. Ask us to delete them and they go from both places.

The form keeps working through the same bf_anon, bf_attr,bf_sid, and bf_a_* cookies listed above. The Meta cookies never appear here, because no pixel exists on this form.

What we don't do

• On windocreative.com itself: no advertising or remarketing pixels, no Meta. Ad tracking exists only on go.windocreative.com, and only as described above.
• We never sell, rent, or share your information with anyone for marketing.
• No data brokers, no “partners,” no list-building from visitors who did not ask for it on the checklist page.
• The audit preview on the homepage runs on sample data. Typing a domain into it sends nothing to us and creates no record of you.

Who touches the data

Six companies process data on our behalf, each doing one job: Google (the analytics described above), Vercel (hosting all of these sites, which involves ordinary server logs), Hostinger (our email, where quiz and audit submissions arrive), Meta (the Pixel and Conversions API described above, on go.windocreative.com only), Neon (the database where funnel sessions and encrypted submissions are stored), and Resend (the checklist mailing list, for the people who signed up to it). None of them may use your information for their own purposes on our behalf. Meta is the exception in kind: for the data the Pixel sends it, Meta also acts under its own data policy.

Your choices

• Block analytics entirely with any content blocker, or Google's own opt-out browser add-on. The site works identically either way.
• On go.windocreative.com, a content blocker stops the Pixel in your browser. Our server still reports the steps you reached to Meta, with your IP address and browser type. The only way to avoid that is not to visit those pages.
• You can control how Meta uses data from other sites in Meta's ad settings.
• On the checklist emails, the unsubscribe link in any of them takes you off the list. To have your address deleted from Resend altogether, email us.
• Want the details you sent us corrected or deleted? Email us. It's an inbox, and we'll handle it like people. That covers funnel submissions too: deleting one removes it from our database and our inbox. Hashed values already sent to Meta cannot be recalled.

Questions

Write to hello@windocreative.com. A person reads it.