Privacy Policy

The short version

This summary is here to help you skim, and the full policy below is what counts.

• I collect the information you give me, like your name, email address and business details, so I can answer your questions, keep your place on my waitlist, build your website, and take care of hosting if you choose me for it.
• I don't sell your personal information, and I don't rent it or trade it to anyone.
• Payments go through Square, so I never see or store your full card or bank account number.
• My site only loads analytics and advertising tools (Google Analytics, Google Ads and the Meta Pixel) if you say okay to them. Until you do, they stay off, and if your browser sends a Global Privacy Control signal, I treat that as a no.
• You can ask me to show you, correct or delete your information anytime through my contact form.
• My services are for US businesses run by adults, and my site isn't meant for children.

1. Who I am and how to reach me

iBuildFreeWebsites is a business name of Hawkins Holdings LLC, a Florida limited liability company. In this policy, "I," "me" and "my" mean Hawkins Holdings LLC. Miller is the person who runs the company and does the work, so when this policy says "I," he's speaking for the company. "You" means anyone who visits my website or uses my services, and "my site" means ibuildfreewebsites.com.

Hawkins Holdings LLC is responsible for the personal information described in this policy. If you have a question about it or want to make a request, you can reach me in any of these ways:

• Contact form: use the contact form at the bottom of my homepage.
• Email reply: if I've already emailed you, you can simply reply to any of my emails.
• Mail: Hawkins Holdings LLC, Attn: Privacy, {{MAILING_ADDRESS}}.

2. What this policy covers

This policy explains how I collect, use, share and protect personal information when you:

• visit my site, including pages like Edit Request;
• join my waitlist;
• fill out my intake form, which is a Google Form I email you a link to;
• email me, including when you reply with photos, logos, screenshots or other files;
• send me a message through my contact form, or send an edit request through my Edit Request page;
• buy hosting, or pay for edits or add-ons through Square; or
• become a client, including when I take care of hosting your website.

This policy doesn't cover:

• Other companies' websites and services. Google Forms and Square's payment pages are run by those companies under their own privacy policies, even when I send you to them. The same goes for any website I link to, like the sites in my portfolio.
• The visitors to my clients' websites. When I build or host a website for a client, that client decides what its website collects from its own visitors, and the client's own privacy policy applies to that information. Section 11 explains my limited role there.

In this policy, "personal information" means information that identifies you or could reasonably be linked to you, like your name, email address or phone number. Information about your business, like its name, address and hours, can be personal information too when it's tied to you, so I treat it with the same care.

3. What I collect and where it comes from

3.1 Information you give me

Every form on my site also sends me the date and time you sent it, the page you sent it from and the agreement line you saw next to the button, so I have a record of what you agreed to and when.

Information I don't want. Please don't send me passwords, Social Security numbers, driver's license or other government ID numbers, bank account or card numbers, or health or medical information, through my forms, my intake or email. I never need any of that to build or host a website. If I need access to something like your domain account, I'll walk you through a safer way to do it, like adding me as a delegate user or sharing your screen while you type your own password. If you send me something like that by accident, I'll delete it, and if it's a password, I'll ask you to change it.

3.2 Information about other people that you send me

Your website might include photos of you, your staff or your customers, along with testimonials, team bios and similar content. When you send me information about other people, you're confirming that you have their permission for me to use it to build your website and for it to be published there. I use that information only for your website.

3.3 Information from other sources

• Public information about your business that you point me to, like your current website, Google Business Profile, social media pages and online reviews. I look at these to write your site and match your look.
• Square sends me payment and subscription details, as described in section 3.1.
• My hosting provider gives me technical and status information about my site and the sites I host, like whether a site is online and how much traffic it gets.
• Google Analytics, Google Ads and Meta give me reports about how my site and my ads are doing, but only if you've allowed those tools (see section 3.4). The reports I see are totals and trends, not your name.

3.4 Information collected automatically on my site

What every website collects. When your browser asks for a page on my site, my hosting provider automatically receives and logs basic technical information, like your IP address, your browser and device type, the page you asked for, the page that sent you there, and the date and time. This is how websites are delivered and protected from abuse, and I don't use it to figure out who you are.

Your cookie choice. Once you make a choice in the cookie banner or Cookie settings, or if your browser sends a Global Privacy Control signal, my site saves that choice and the date in your browser's local storage so it doesn't keep asking you. Nothing else is saved on your device unless you allow analytics or advertising, and this record stays on your device and isn't sent to me.

Only if you say yes. If you allow analytics or advertising cookies, Google Analytics, Google Ads and the Meta Pixel collect information about how you use my site, like the pages you visit, how long you stay, the link or ad that brought you to my site, whether you sent a form (but not what you typed in it), your device and browser, and your general location based on your IP address. They use cookies and similar technology to do this. If you're signed in to a Google, Facebook or Instagram account, those companies may connect this information to your account, depending on your settings with them. My Cookie Policy lists each tool and cookie.

What my site doesn't do. My site doesn't use session recording or "heatmap" tools that record your mouse movements and typing, it doesn't have a chat widget, and it doesn't load fonts or scripts from other companies before you make a cookie choice. My forms catch spam with a hidden "honeypot" field instead of a CAPTCHA service, so filling out a form doesn't send anything about you to a CAPTCHA company.

4. How I use your information

I use personal information to:

• Answer you, including replies to your messages, edit requests and questions about retainers.
• Run the waitlist. That means sending you the link to my intake form, sending friendly reminders at 3, 7, 14 and 30 days if you haven't finished it (and then stopping), keeping track of your place in line, and emailing you every two weeks to let you know where you stand.
• Build your website. I use your intake answers, emails, photos and logo to plan, design, code and write your site, send you drafts and preview links, make your revisions and give you your website files.
• Host and look after your website if you choose hosting, which includes keeping it online, keeping its security certificate (the padlock) current, keeping backups, fixing things that break on my end and making the paid edits you ask for.
• Handle payments and billing. That includes sending invoices and receipts, setting up and managing your Square subscription, sending renewal reminders and other notices the law requires, confirming cancellations, and sending reminders during the 7-day grace period if a hosting payment doesn't go through.
• Schedule and hold the calls you book and pay for.
• Show my work by displaying your finished website in my portfolio, unless you've told me not to (see section 5.3).
• Keep my site and services working and safe, including blocking spam, preventing fraud and fixing problems.
• Understand and improve my site and my ads, using analytics and advertising tools only if you allow them.
• Keep records and follow the law, including tax and accounting records, records of your agreement to my Terms and automatic renewal terms, responding to lawful requests, enforcing my Terms, and protecting my rights and the rights of others.
• Do anything else you agree to when I ask you.

What I won't do with it:

• I won't add you to a newsletter or marketing list. If you join the waitlist, I'll only email you about your website and your spot in line.
• I won't use your phone number for marketing calls or texts, and I won't send you automated texts. I use your number only to reach you about your project, like when an email isn't getting through or you've asked me to call.
• I won't upload your name, email address or phone number to Google, Meta or any other advertising platform to target ads at you.
• I won't use your information for a purpose that's materially different from the ones in this policy without telling you first and, where the law requires it, getting your permission.

5. Who I share it with

5.1 I don't sell your personal information

I don't sell your personal information for money, and I don't rent or trade the information you give me, like your name, email address and business details, to anyone. I don't give it to other companies so they can market their own products to you, and I don't sell sensitive personal data of any kind. There's one thing about advertising cookies that you should know about, which only happens if you allow it, and section 5.4 explains it.

5.2 Companies that help me run my business

I use a small number of well-known companies to run my site and my business. They handle personal information so they can provide their services to me, and they do it under their own terms and privacy policies. I only give them what they need for the job.

Swipe sideways to see the whole table.

I may change providers over time. If I add a provider that handles your personal information in a new way, I'll update this list before I start using it.

5.3 Other times I share information

• When you ask me to. For example, if you ask me to send your website files to a new web developer or host, I'll send them.
• On your website, for the public. The content you send me for your website, like your photos, story, hours and contact details, becomes public once your site goes live, because that's the whole point of a website. You'll see everything in your draft before your site launches.
• In my portfolio. Unless you tell me not to, I may show screenshots of your finished website, your business name and a link to your site in my portfolio. You can opt out anytime in your intake form, through my contact form or by replying to one of my emails, and I'll take your site out of my portfolio within 14 days. I won't publish a review or testimonial from you about my work without your permission.
• With professional advisers, like an accountant, bookkeeper or attorney, when I need their help and they have a duty to keep it confidential.
• For legal reasons, when I believe in good faith that I need to share it to comply with a law, court order, subpoena or other legal process, to protect the rights, property or safety of my business, my clients or anyone else, or to look into fraud, security problems or violations of my Terms.
• If my business changes hands. If Hawkins Holdings LLC or iBuildFreeWebsites is ever sold, merged or transferred, personal information may go to the new owner as part of that deal. The new owner would have to keep the promises in this policy for information collected under it, unless you agree otherwise, and I'll let clients know by email before it happens.

5.4 Advertising cookies and "sharing"

If you allow advertising cookies, Google and Meta collect information like cookie identifiers, your IP address, your device and browser details and the pages you view on my site. They may use it to show you ads, including my ads, on other websites and apps, and to measure how those ads perform. These companies may also collect information about your online activity over time and across different websites and apps, both on my site and elsewhere.

Some state privacy laws call this kind of ad tracking "selling" or "sharing" personal information, or "targeted advertising," even when no money changes hands. Those laws generally apply only to businesses that are much bigger than mine or that handle information about a very large number of people, but I'd rather be upfront with you about it. It only happens if you choose to allow advertising cookies, and you can stop it anytime by:

• clicking Cookie settings at the bottom of any page and turning off Advertising;
• turning on Global Privacy Control in your browser, which my site treats as an opt-out (see section 7); or
• using the opt-out tools that Google, Meta and the advertising industry offer, which are listed in my Cookie Policy.

Because these choices are saved in your browser, you'll need to make them on each browser and device you use.

6. Sensitive information

I don't ask for sensitive information, like health information, Social Security numbers, financial account numbers, precise location, or information about race, religion, sexual orientation, immigration status or biometrics, and I don't sell or share it. Some businesses naturally touch on these topics, like a church or a therapist's practice. If you choose to tell me something like that about your business, I use it only to build your website, and only the parts you approve end up on your site.

7. Cookies, Global Privacy Control and Do Not Track

Cookies. My site uses one essential item that remembers your cookie choice. Analytics cookies (Google Analytics) and advertising cookies (Google Ads and the Meta Pixel) only load when I've turned that tool on and you've clicked "Accept" or turned it on in Cookie settings, and when my site isn't using any of them, you won't see a cookie banner at all. If you click "Decline," or don't choose anything, they stay off, and my site works exactly the same either way. You can change your mind anytime with the Cookie settings link at the bottom of every page. My Cookie Policy has the details, including a list of each cookie.

Global Privacy Control. Global Privacy Control (GPC) is a setting in some browsers and browser extensions that tells websites you don't want your personal information sold or shared. If your browser sends a GPC signal, my site treats it as your choice to decline analytics and advertising cookies, so neither one loads, and advertising cookies stay off on that browser for as long as the signal is on. If you'd like to help me improve my site, you can still turn on analytics yourself in Cookie settings.

Do Not Track. Some browsers can send a "Do Not Track" signal. Because there's no common standard for how websites should respond to it, my site doesn't change what it does when it receives one. Either way, my site doesn't load any analytics or advertising tools unless you choose to allow them.

8. How long I keep your information

I keep personal information only as long as I need it for the reasons in this policy.

When the time is up, I delete the information or change it so it can't be linked to you anymore. Deleted information can stay in backups or trash folders for up to 90 days before it's gone for good. I may keep something longer if the law requires it, or if I need it to resolve a dispute or legal claim, but only for as long as that need lasts.

9. How I protect your information

I take reasonable steps to protect your information, including:

• two-step verification on my Google, Square and hosting accounts and on the other accounts that hold your information;
• strong, unique passwords kept in a password manager;
• an encrypted computer that locks automatically when I step away;
• secure HTTPS connections (the padlock) on my site and the sites I host;
• keeping your information to myself and the companies listed in section 5.2, and not sharing my accounts with anyone; and
• deleting information when I no longer need it.

Square handles card and bank details, so I never have them. Still, no website, email account or computer is perfectly secure, and I can't promise that your information will never be accessed by someone who shouldn't have it. Regular email isn't a perfectly secure way to send things, which is another reason not to send me passwords or ID numbers.

If something goes wrong. If I learn of a security breach that affects your personal information, I'll notify you as the law requires, usually by email. For Florida residents, that means telling you as quickly as I reasonably can, and generally no later than 30 days after I determine that a breach happened or have reason to believe one did, unless the law allows a delay (for example, when law enforcement asks me to wait). When the law requires it, like when a breach affects 500 or more Floridians, I'll also notify the Florida Department of Legal Affairs, and I'll notify anyone else the law requires and follow the notice laws of other states for their residents. Even when the law doesn't require it, I'll let you know if I learn of a security problem that I reasonably believe could harm you.

10. Children

My site and services are for businesses and adults. You must be at least 18 to become a client. My site isn't directed to children under 13, and I don't knowingly collect personal information from them. If I learn that I've collected personal information from a child under 13, I'll delete it. If you're a parent or guardian and you think your child has sent me information, please contact me through my contact form.

11. Websites I build and host for clients

When I build or host a website for a client, that client owns the website and decides what it says and what it collects from its visitors. Here's how I handle that information:

• Forms on client websites. If I set up a contact form on a client's website, what visitors type into it is sent to the client. It passes through my hosting provider's systems, and I may be able to see it while I'm making sure the form works. Form submissions are kept in my hosting account for up to 90 days and then deleted, and the client gets a copy by email. I use them only to provide the form to the client, and I don't sell them or use them for my own purposes.
• Server logs. My hosting provider keeps the same kind of technical logs for client websites that it keeps for mine (see section 3.4).
• No tracking from me. I don't put my own analytics or advertising tools on client websites. The small credit link in the footer of client websites is an ordinary link, and it doesn't collect anything about the people who visit those sites.
• The client's responsibilities. Each client is responsible for its own website's privacy policy, cookie notice and legal compliance. Client websites shouldn't be used to collect health or medical information, Social Security numbers, financial account or card numbers, passwords, or information about children under 13, and I don't provide services designed for that kind of information.
• If you visited a client's website. If you have a question or request about information a client's website collected about you, please contact that business directly, since it's in charge of that information. If you contact me instead, I'll pass your request along to the client.

12. US-only services and where your information is handled

I'm based in Florida, and my services are only for businesses in the United States. I handle your information in the United States. The companies I use (listed in section 5.2) are US companies, but they may also store or process information in other countries where they or their own providers operate, under their own safeguards. If you visit my site from outside the United States, your information will be sent to and handled in the United States, where privacy laws may be different from the laws where you live.

13. Your choices and rights

13.1 Requests anyone can make

No matter where you live in the United States, you can ask me to:

• show you the personal information I have about you, or send you a copy of it;
• correct information that's wrong or out of date;
• delete your personal information;
• take you off the waitlist, which also stops my reminder and position emails;
• leave your website out of my portfolio; and
• stop sending you emails that aren't required for a service you've signed up for (see section 14).

You can also change your cookie choices anytime with the Cookie settings link at the bottom of every page.

How to ask. Send me a request through my contact form, reply to one of my emails, or mail me at the address in section 1. To protect your information, I'll make sure the request really comes from you, usually by confirming it with the email address I already have for you. I won't ask for more information than I need to do that.

When I'll respond. I'll respond within 45 days. If I need more time, I'll tell you why within those 45 days, and I'll respond within another 45 days. I don't charge for requests.

Someone asking for you. You can have someone else make a request for you if you give them written permission. I may still need to confirm the request with you directly.

When I might not be able to delete everything. I may need to keep some information even after you ask me to delete it, like records the law requires me to keep (such as tax records and records of your agreement to automatic renewal terms), information I need to finish something you've asked me to do, and information I need to prevent fraud, keep my services secure or deal with a legal claim. If I keep something, I'll tell you what and why. Information on a client's live website is controlled by that client, so I'll pass requests about it along to them. Also, if you ask me to delete information I need to build your website or take care of its hosting, I won't be able to keep doing that work.

13.2 State privacy laws

Several states, including California, Colorado, Connecticut, Oregon, Texas and Virginia, have privacy laws that give residents rights like knowing what information a business has about them, correcting it, deleting it, getting a copy of it, and opting out of targeted advertising, sales of their information and certain kinds of profiling. Those laws generally apply only to businesses that are much bigger than mine or that handle information about a very large number of people, but I'll honor these kinds of requests from anyone in the United States, as described in section 13.1, as far as I reasonably can. You can opt out of targeted advertising on my site anytime using the steps in section 5.4.

• Appeals. If I turn down a request, you can ask me to reconsider by replying to my decision. I'll respond to your appeal within 45 days and explain what I decided.
• Nevada residents. I don't sell covered information as Nevada law defines it. If you're a Nevada resident and want to send an opt-out request anyway, use my contact form, and I'll respond within 60 days.
• California residents. I don't share personal information with other companies for their own direct marketing.
• No penalty for using your rights. I won't charge you more, give you a lower level of service or treat you differently because you made a privacy request.

14. Emails from me

My emails come from my own Gmail account, and I'm the one who sends them. Here's what to expect:

• Waitlist and project emails. These include the link to my intake form, reminders at 3, 7, 14 and 30 days if you haven't finished it (and then I stop), waitlist updates every two weeks, emails about your build and drafts, and the email that tells you your website is done.
• Billing and service emails for hosting clients, like receipts, renewal reminders, notices about price changes, payment reminders and cancellation confirmations. Some of these are required by law, so I'll keep sending them while you have an active hosting plan with me.
• No marketing lists. I don't send newsletters, and I won't add you to any marketing list. If that ever changes, I'll only send newsletters to people who ask for them.

Every automated email I send, like waitlist updates and reminders, will say who it's from, have an honest subject line and include my mailing address. To stop any email that isn't required for a service you have with me, just reply with "stop," and to leave the waitlist, reply with "remove me." I'll honor your request right away, and always within 10 business days. My emails don't contain tracking pixels, and I don't track whether you open them or which links you click.

15. Links to other websites

My site links to other websites, like the sites in my portfolio, Google Forms and Square. Those websites have their own privacy policies, and I'm not responsible for how they handle your information. I'd encourage you to read their policies before you give them any information.

16. Changes to this policy

I may update this policy from time to time. When I do, I'll change the "Last updated" date at the top. If I make a material change, like using your information in a new way or sharing it with a new kind of company, I'll post a notice on my site before the change takes effect, and I'll email clients and people on my waitlist. I won't apply a material change to information I collected before the change without your permission. If you'd like to see an earlier version of this policy, ask me and I'll send it to you.

17. Contact me

If you have any questions about this policy or how I handle your information, or if you'd like this policy in a different format, like large print, please reach out:

• Contact form: the contact form at the bottom of my homepage
• Email reply: reply to any email I've sent you
• Mail: Hawkins Holdings LLC, Attn: Privacy, {{MAILING_ADDRESS}}