Privacy policy

Information you provide. Depending on how you interact with us, we may collect:

• Your name, email address, telephone number, and business contact details.
• Information about your business, services, goals, website needs, and support preferences.
• Intake answers, appointment information, and correspondence.
• Materials you provide for a project, such as website content, photographs, logos, documents, and other uploaded files.
• Your marketing preferences, including whether you ticked “Don’t send me marketing emails.” on our intake, and any requests you make about your information.

Please avoid submitting passwords, payment-card details, or sensitive personal information through general intake forms or project materials.

Information collected through technology. PostHog processes page views, clicks, scrolling, navigation, device and browser information, approximate location derived from an IP address, error reports, and privacy-masked session recordings. For visitors detected in the EU or UK, this starts only after they allow analytics. Our hosting, form, scheduling, and other service providers may also process technical information such as IP addresses, browser and device information, access times, and interactions with their services. Cookies and similar technologies are described in Section 8.

We use information to:

• Respond to inquiries and assess project requests.
• Prepare, build, deliver, and support websites and related services.
• Schedule appointments and communicate about projects.
• Maintain business and client records.
• Understand how visitors use the website, diagnose problems, and improve its pages and intake journey.
• Send marketing emails and manage subscription preferences.
• Learn from project examples and improve our internal processes, AI agents, prompts, and workflows, as described in Section 5.
• Protect our systems, address disputes, and meet applicable legal obligations.

We use outside services to operate our business. Depending on the activity, information may be processed through:

We also use email, file-storage, and collaboration services to communicate with you and manage projects.

Our website may pass your name and email address from the intake process to Acuity to help prefill appointment details.

Providers process information under the terms and privacy arrangements applicable to their services. Some processing may occur for their own purposes, as described in their privacy notices. Our use of outside providers does not remove our responsibilities under applicable law.

When you submit our free-website intake, we add you to our Mailchimp marketing list unless you tell us not to. We use the list to send occasional emails with resources, offers, and updates from Pursuit of Calling.

The intake says this right above the submit button: “When you submit, we’ll also send you occasional emails with resources, offers, and updates from Pursuit of Calling. You can unsubscribe anytime.”

You can say no:

• When you submit the intake: tick the box below that notice, “Don’t send me marketing emails.” We won’t add you to our marketing list, and we keep a record of your choice with your intake.
• Any time after that: use the unsubscribe link in any marketing email, or email thomas.carney@pursuitofcalling.com.

Unsubscribing stops marketing emails. You’ll still receive the emails needed for your request, such as booking confirmations and messages about your project.

When you opt out, we keep a minimal record of that choice so we don’t add you back by mistake.

How we measure our emails. Our marketing emails contain a tiny tracking image (a “pixel”) and tracked links. When you open an email or click a link, Mailchimp records it, along with your approximate location and information about your device. We use this to see which emails are useful. Unsubscribing stops it, and blocking images in your email app limits open tracking.

We may retain project materials, including materials from websites that are declined or never launched, for internal learning and improvement.

These activities include reviewing past work, developing reference examples, and improving our own AI agents, prompts, instructions, and development workflows.

Before we keep any material as an example, or send it to an AI tool for this work, we:

• replace business names, owner and staff names, logos, photos of people, testimonials, and any distinctive details that could identify the client with placeholders;
• remove contact details and file metadata, such as EXIF data in photos and document properties; and
• keep no link between the example and the client record.

These steps make it hard to tell whose project an example came from, but they can’t guarantee that no one could ever recognize it. Someone who knows a business well might spot a detail we missed. So we keep de-identified examples private and review them every year. The identifiable originals are kept only for the periods in Section 6.

This section covers learning and improvement. When we build your own website, the AI and development tools we use work with the content you give us for that project.

Retained website examples are hosted on separate test domains through Netlify, with access restricted to our team. They are not intended as public portfolio entries or public client websites.

We may submit selected project materials to outside AI tools for the purposes described above. These tools may include Claude and Claude Code from Anthropic, ChatGPT and Codex from OpenAI, Lovable, and other AI or development services we select over time. Where a provider offers account settings that limit its use of what we submit, such as settings that keep our submissions out of model training, we use them. Restricting access to a hosted example does not prevent information separately submitted to an AI provider from being processed by that provider.

We may add or replace providers performing these functions. We will update our disclosures when appropriate and provide additional notice or obtain permission where required before materially changing how we use personal information.

We keep information for these periods:

Archived records remain identifiable and are covered by these limits.

Declining a proposed website doesn’t delete its materials straight away; they follow the two-year limit above unless you ask us to delete them sooner.

If you ask us to delete your information, we will, even before these periods end, except where the law requires us to keep something.

You can contact thomas.carney@pursuitofcalling.com to ask about your information, request corrections or deletion, or raise a privacy concern.

Visitors detected in the EU or UK can allow, refuse, or change PostHog analytics at any time through “Analytics choices” in the website footer. Refusing analytics does not limit the website or intake.

Depending on the law that applies, you may also have rights to access or receive a copy of your information, restrict or object to certain uses, withdraw consent, or complain to a relevant privacy regulator.

We may need to verify your identity before responding. We will handle requests within the time required by applicable law.

Some information may need to be retained where the law permits or requires it—for example, to meet legal obligations, address legal claims, or maintain a minimal record of your marketing opt-out. Where an exception applies, we will explain it as required.

Our own pages use PostHog for website analytics and privacy-masked session replay. PostHog stores an anonymous browser identifier in local storage and a cookie named like ph_<project>_posthog. Netlify uses the country associated with a visitor’s connection to decide whether to show the EU and UK analytics choice; the page receives only the yes-or-no result. PostHog remains off for those visitors unless they choose “Allow analytics.” When you finish the intake, your name and email address are held in that browser tab’s history, not in a cookie or browser storage, so the booking page can pass them to Acuity.

Some pages load services from other companies. They may receive technical information, such as your IP address and browser details, when they load, even if you don’t submit anything. Some store small items in your browser:

• PostHog (after permission for EU and UK visitors). Measures page views, clicks, scrolling, and navigation and creates session recordings so we can understand where the site works or causes problems. It also records page errors and the browser console messages they leave, so we can fix what broke. This data reaches PostHog through an address on this website. PostHog stores an anonymous browser identifier in local storage and a cookie named like ph_<project>_posthog. All form inputs are masked in recordings. We block the intake email shown on the scheduling page and the scheduler itself, which carries your name and email address, never identify a visitor by email, and never send intake answers. PostHog cannot see inside the cross-origin Tally or Acuity frames.
• Google Fonts (every page). Delivers our fonts from Google’s servers. Google receives your IP address and browser information. We found no cookies.
• YouTube (only after you press play on a testimonial video). Nothing loads from YouTube until you press play. The video then plays in YouTube’s privacy-enhanced mode (youtube-nocookie.com). YouTube receives your IP address and browser information and may store small items in your browser to play the video and measure viewing.
• Tally (the intake page). Runs the intake form. Tally saves a form-session ID and a respondent ID in your browser’s local storage, and may keep your unsent answers there so you can pick up where you left off. When you submit, Tally checks your IP address to prevent duplicate submissions. It also counts form views and sends error reports to its error-monitoring service, Sentry.
• Acuity Scheduling / Squarespace (the booking page after the intake). Runs the scheduler and sets a cookie that keeps track of your booking session for about 30 days. The scheduler also loads:
  • Google reCAPTCHA, to block spam and abuse. It stores small items in your browser and may collect information about your device and how you use the page.
  • Stripe’s fraud-prevention tool. It sets a cookie on stripe.com that lasts about a year and can see the scheduler’s web address, including the name and email we pass to it.
  • Fonts from Adobe.
  • Sentry, for error reports.

Browser controls may let you restrict cookies and site data, although doing so can affect how the intake form and scheduler work.

Analytics controls. Visitors detected in the EU or UK may refuse PostHog or withdraw permission later through “Analytics choices” in either website footer. Our website does not respond to browser Do Not Track signals. Turning on that setting alone does not stop PostHog analytics or session recording. Browser controls can clear or restrict cookies and local storage, although doing so may make separate visits appear unrelated. You may contact us through the address in Section 7 with an analytics privacy request.

We operate in the United States, and our providers may process information in other countries. Privacy laws there may differ from those where you live. Section 9 explains how this applies to visitors in the EU and UK.

If the EU General Data Protection Regulation (GDPR) or the UK GDPR applies to you, we rely on these legal bases:

• Contract and steps before a contract: handling your inquiry and intake, scheduling your call, and delivering your project.
• Legitimate interests: keeping business records, protecting our systems, doing the de-identified improvement work in Section 5, and sending marketing emails to applicants who didn’t opt out. You can refuse marketing when you sign up and in every marketing email, and if you object, we remove you.
• Legal obligation: keeping tax and accounting records.
• Consent: running PostHog analytics and privacy-masked session replay for visitors detected in the EU or UK after they choose “Allow analytics.” They can withdraw that consent at any time through the website footer.

When information from the EU or UK goes to our US providers, they rely on their own transfer mechanisms, such as the EU-US Data Privacy Framework or standard contractual clauses.

We use access restrictions for private project environments and limit access to client information to people who need it for the relevant work. No internet transmission or storage system can be guaranteed completely secure.

We may update this policy as our services, providers, and information practices change. The dates at the top of this page show when this version took effect and when it was last updated. Where required, we will give additional notice and obtain any necessary consent before applying material changes.

Contact us at thomas.carney@pursuitofcalling.com with questions about this policy.