Privacy Policy

There are only two ways we end up with information about you: you send it to us on purpose, or it is recorded automatically as part of serving you the page.

When you submit the contact form, we receive the name you type, your email address, the project type you select, an optional budget range, and whatever you write in the message field. Those fields are for scoping a project. Please do not put account numbers, passwords, or confidential documents into them.

If you email us directly, we have your address and whatever your message contains, for as long as it stays in the inbox.

If you run the free website audit, we keep the web address you tested and the scores Google returned for it, so we can follow up if you ask us to. If you use the price estimator and choose to send it, the items and totals you picked travel with your message.

Automatically, our hosting provider records ordinary request information: IP address, browser and device type, the page requested, the referring page, and a timestamp. Your IP address is also used, as a salted hash that changes daily, to rate-limit the contact form and the audit so they cannot be abused. The address itself is never written to our database.

With your permission (see "Your visit, if you accept" below), we also record how you use the site itself. Without that permission, nothing in that section is recorded.

We do not ask for, and do not want, payment card numbers, government identifiers, health information, or precise location data.

Contact form submissions are used to reply to you and to scope the work you asked about. That is the whole purpose. You will not be added to a mailing list because you asked a question.

Automatically collected information is used to keep the site online, diagnose errors, and understand which pages people actually read so we can write better ones.

We do not sell personal information, rent it, or hand it to advertisers. There is no advertising network, retargeting pixel, or data broker relationship attached to this site.

On your first visit a small panel asks whether we may see how you use the site. If you choose Accept, the site records: the pages you open and in what order, how long you stay on each and how far down you scroll, the page or search engine that sent you here and any campaign tags in the link, the kind of device, browser, operating system, screen size and language you use, the country and region you are visiting from, and the things you do on the site — the buttons you press, a website audit you run, an estimate you build, a live preview you open, or a message you send.

To tell one visit from the next, the site stores a random identifier in your browser (local storage, not a cookie). It is a string of random characters; it is not your name, your email, or anything derived from your device. A second random identifier marks the current tab session.

If you then send us a message through the contact form, that random identifier is stored with your message. That lets us see the path a client took before reaching out — which pages they read, where they came from — so we can understand what helped. It is only ever used by the studio, for that purpose.

This recording is done by this site and stored in our own database. No analytics company, advertiser or data broker receives it. There is no Google Analytics, no Meta pixel, and no advertising tracker on this site.

If you choose Essentials only, none of the above is recorded. The free audit, the price estimator and the contact form all work exactly the same. We treat the Global Privacy Control signal from your browser as Essentials only without asking.

You can change your choice at any time from "Privacy choices" in the footer of every page. Withdrawing consent stops recording immediately and forgets the identifier in your browser; to have what was already recorded deleted, email us with the request and we will do it.

Separately, the site uses Vercel Analytics and Vercel Speed Insights, which count page views and measure page speed in aggregate, without cookies and without following you between websites.

We keep the list of companies that touch your data as short as we can, and each one is here because the site needs it to function.

Vercel hosts the site, delivers the pages, keeps server logs, and provides the aggregate analytics described above. Resend delivers the notification email generated by the contact form. Neon stores contact form submissions, website audits and, if you accepted, the record of your visit, in the database behind our internal console. Google PageSpeed Insights runs the free website audit when you ask for one: the address you type is sent to Google to be tested. Our own email provider holds the resulting message the same way it holds any other email we receive.

Each of these processes information on our behalf under its own terms and privacy policy. We share the minimum needed for the provider to do its job, and none of them are permitted to use what you sent us for their own marketing.

We may also disclose information where the law genuinely requires it, or where it is necessary to investigate abuse of the site. If that ever happens we will tell you unless we are legally prevented from doing so.

The public pages of this site do not set cookies to track you, profile you, or serve advertising.

The site does use your browser's local storage for a few small things: your privacy choice from the panel described above, so you are not asked again; whether you have seen the welcome panel, so it does not reappear for a month; and, only if you accepted, the random visit identifier. None of these are sent to anyone but this site, and clearing your browser data removes them all.

The only cookie the site sets is a session cookie in the private admin area, which exists solely to keep the studio signed in while managing inquiries and projects. Visitors never encounter it.

If that ever changes, this policy will be updated before the change goes live, not after.

Contact form submissions stay in our email and in the internal inquiry inbox for as long as they are useful to the conversation and to our record of what work was discussed. Inquiries that never became a project are cleared out periodically.

Website audits stay in the console for as long as they are useful for follow-up and are cleared periodically; the list holds at most the most recent five hundred.

The record of your visit, if you accepted, is kept for thirteen months, so a season can be compared with the same season a year before, and is then deleted automatically. The studio can also delete any visitor's record, or all records older than a chosen period, at any time.

Server logs and aggregate analytics are retained on our hosting provider’s standard schedule, which we do not control and which is measured in a short window rather than indefinitely.

If you would rather we not keep your submission at all, say so and we will delete it. See the section on your choices below.

The site is served over HTTPS. Contact form input is validated and sanitized before it is stored or emailed, the form and the audit are rate-limited against automated abuse, and the internal console sits behind an authenticated area that only the studio can reach. Visit records hold no name, email or IP address, so even on their own they do not identify you.

No method of transmitting information over the internet is completely secure, and we are not going to claim otherwise. What we can say is that we collect little, keep it in few places, and do not pass it around.

Depending on where you live, you may have the right to ask what information we hold about you, to correct it, to receive a copy, or to have it deleted.

You do not need to know which law applies to you in order to ask. Email sahil@elementwebco.com and tell us plainly what you want done. We will take reasonable steps to confirm you are who you say you are, and then do it.

There is no charge for this, and asking will not change how we treat you or affect a project we are working on together.

This site is written for business owners and is not directed at children. We do not knowingly collect information from anyone under 13.

If a child has sent something through the contact form, email us and it will be deleted.

When this policy changes, the "last updated" date at the top of the page changes with it. Meaningful changes — new information collected, a new company handling it — will be described rather than quietly folded in.

Questions about this policy, or a request about your information, go to sahil@elementwebco.com. That address reaches the founder, Sahil Sandhu, directly.

Element Web Company operates out of Kalamazoo, Michigan, and works with clients across Southwest Michigan and nationally. We do not publish a mailing address on this site; email is the fastest and most reliable way to reach us.