Privacy Policy

1.1 Data Controller

Amity Website Design, operated by its principal owner in Martha's Vineyard, Massachusetts (“we,” “us,” or “our”), is the data controller responsible for personal data collected through this website (amitywebsitedesign.com, the “Site”) and through the provision of our professional services.

1.2 Scope

This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, who we share it with, and what rights you have. It applies to:

• Visitors to amitywebsitedesign.com;
• Prospective clients who contact us through our forms, phone, or email;
• Active and former clients of Amity Website Design;
• Any individual whose personal data we process in connection with our services.

This Policy does not apply to third-party websites we may link to. Those sites operate under their own privacy policies.

1.3 International Visitors

Our services are directed primarily at individuals and businesses in the Martha's Vineyard and greater Massachusetts area. If you are located outside the United States — including in the European Economic Area (EEA) or United Kingdom — your data will be transferred to and processed in the United States. By using our Site or services, you acknowledge this transfer. Where applicable, we extend data subject rights consistent with the GDPR as described in Section 11.

• Personal Data: Any information relating to an identified or identifiable natural person — such as name, email address, phone number, or IP address.
• Usage Data: Data collected automatically when you visit the Site, including IP address, browser type, pages visited, referring URL, and visit duration.
• Cookies: Small text files stored on your device by your browser at the direction of a website.
• Client Data: Personal or business data clients share with us in connection with project work.
• Credentials: Usernames, passwords, access tokens, API keys, or other authentication information.
• Service Providers: Third-party companies engaged by us to facilitate or support our services.
• Processing: Any operation performed on personal data, including collection, storage, use, disclosure, or deletion.

3.1 Contact Form & Inquiry Data

When you submit a contact form or otherwise contact us, we collect your name, email address, phone number, business name, website URL (if provided), and message content. This data is used solely to respond to your inquiry and evaluate potential projects.

3.2 Usage & Analytics Data

When you visit our Site, data is automatically collected by our analytics tools (Sections 6 & 7), including:

• IP address (anonymized by default in Google Analytics 4);
• Browser type, version, and device/operating system;
• Pages viewed, time on page, and navigation path;
• Referring URL (the page you came from);
• Approximate geographic location (city/region only — not precise);
• Interaction events (clicks, scroll depth, form submissions).

3.3 Client Project Data

Clients share business information, project briefs, content, and other materials necessary to complete work. We process this data solely to perform the agreed services.

3.4 Credentials & Account Access

Clients sometimes share hosting, domain registrar, CMS, and other credentials to allow us to perform project work. See Section 9 for full disclosure of how we handle this sensitive data.

3.5 Communications Data

We retain records of email correspondence and project communications for the duration of the client relationship and as required for legal and accounting purposes.

3.6 What We Do NOT Collect

We do not collect payment card numbers directly — all payment processing is handled by third-party processors (Section 8.3). We do not collect Social Security numbers, government IDs, biometric data, or health information. We do not knowingly collect data from individuals under 18.

4.1 No Sale of Data

We do not sell, rent, lease, or trade your personal data to any third party for their independent use, marketing purposes, or financial gain.

4.2 No Unsolicited Marketing

We do not send unsolicited marketing emails. Service-related updates to existing clients are sent only where necessary. You may opt out at any time by contacting us at the address in Section 16.

5.1 What Are Cookies

Cookies are small text files placed on your device by a website. They allow the site to recognize your browser and remember certain information. Disabling certain cookies may affect Site functionality.

5.2 Cookie Categories We Use

5.3 How to Manage Cookies

You can manage or disable cookies through your browser settings:

• Google Chrome
• Mozilla Firefox
• Apple Safari
• Microsoft Edge

6.1 What It Is

We use Google Analytics 4, a web analytics service by Google LLC. GA4 helps us understand how visitors interact with our Site — which pages are most visited, where visitors come from, and how they navigate. This information helps us improve Site content and user experience.

6.2 What GA4 Collects

• Pages visited, scroll depth, and navigation paths;
• Session duration and time on page;
• Traffic source (organic search, direct, social, etc.);
• Approximate location (city/region only);
• Device, browser, and operating system;
• A randomly assigned, anonymized Client ID stored in a cookie — this does not identify you personally.

6.3 Cookies Set by GA4

6.4 Opting Out

• Install the Google Analytics Opt-out Browser Add-on;
• Block _ga, _gid, and related cookies in your browser settings.

For more on how Google uses this data: How Google uses information from our site.

7.1 What It Is

We use the Meta Pixel, a tracking tool provided by Meta Platforms, Inc. It allows us to measure the effectiveness of any advertising campaigns we run on Facebook and Instagram, and to understand actions taken on our Site.

7.2 What It Collects

• Pages visited and actions taken (form submissions, button clicks);
• IP address, browser type, and device information;
• HTTP headers (referring URL, page URL);
• Facebook cookie data — if you are logged into Facebook in the same browser, Meta may be able to link this data to your Facebook profile.

7.3 Cookies Set by Meta Pixel

7.4 Opting Out

• Facebook Ad Settings — adjust your ad preferences;
• Block _fbp, _fbc cookies and cookies from facebook.com in your browser;
• Use NAI Opt-Out Tool.

We share personal data with third parties only to the extent necessary to operate and deliver our services. All third parties are prohibited from using your data for any other purpose.

8.1 Analytics & Marketing

8.2 Web Hosting

Our Site is hosted on servers provided by our web hosting provider. The hosting provider may process certain technical data (server logs, IP addresses) in the course of providing hosting services, subject to their own privacy policy.

8.3 Payment Processing

We do not store, process, or access full payment card numbers at any time. Payments are handled directly by PCI-DSS compliant third-party processors, which may include:

• Stripe — Privacy Policy
• PayPal — Privacy Policy
• Square — Privacy Policy

8.4 Legal Disclosure

We may disclose personal data if required by law, court order, or government request, or if we believe in good faith such disclosure is necessary to: (a) comply with a legal obligation; (b) protect our rights or property; (c) prevent or investigate wrongdoing; or (d) protect the personal safety of users or the public.

9.1 What We May Access

To perform project work, we may request temporary access to: web hosting control panels (cPanel, Plesk), domain registrar accounts (GoDaddy, Namecheap, Cloudflare), CMS administrator accounts (WordPress, Squarespace), FTP/SFTP servers, Google Search Console, Google Analytics, and Meta Business Suite. Access is requested only when required and only for the duration of that specific task.

9.2 How We Handle Credentials

• Used solely for performing agreed project work;
• Never shared with unauthorized third parties;
• Stored using best-effort encrypted tools during the project;
• Permanently deleted within five (5) business days of project completion or termination.

9.3 Liability Disclaimer

We expressly disclaim liability for security incidents arising from credentials shared via insecure methods, vulnerabilities in the client's own hosting environment, weak or reused passwords, or failure to change credentials after project completion. See Section 12 of our Terms and Conditions for full provisions.

9.4 Post-Project Password Change

We strongly advise all clients to change every password and access credential shared with us within five (5) business days of project completion. This includes hosting, domain registrar, CMS, and any API tokens provided.

When data is no longer needed, it is permanently deleted from active systems. Physical documents containing personal information are destroyed in a manner that renders them unreadable, consistent with Massachusetts M.G.L. c. 93I.

Depending on your location and applicable law, you may have the following rights. We respond to verified requests within 30–45 days.

11.1 How to Exercise Your Rights

Email info@amitywebsitedesign.com with the subject line “Privacy Rights Request.” Include your name, contact information, and a description of the right you wish to exercise. We may verify your identity before processing. No fee for reasonable requests.

11.2 California Residents (CCPA / CPRA)

California residents have rights under CCPA as amended by CPRA, including the right to know, delete, correct, opt out of sale/sharing, and non-discrimination. As a small business, we may fall below mandatory CCPA thresholds, but we extend these rights as a matter of good practice. To submit a “Do Not Sell or Share My Personal Information” request, contact us at info@amitywebsitedesign.com. We honor Global Privacy Control (GPC) signals where technically feasible.

11.3 EEA / UK Residents (GDPR)

EEA and UK residents have additional rights under GDPR / UK GDPR including rights of access, rectification, erasure, restriction, portability, and objection. You also have the right to lodge a complaint with your national supervisory authority. Legal bases for our processing are described in Section 4.

11.4 Massachusetts Residents

Massachusetts residents have rights under M.G.L. c. 93H. In the event of a qualifying data security breach, we will notify affected individuals, the Massachusetts Attorney General, and the Office of Consumer Affairs and Business Regulation as required by law.

Our Site and services are not directed to individuals under the age of 18. We do not knowingly collect personal data from minors. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at info@amitywebsitedesign.com immediately. Upon verification, we will promptly delete the information. We comply with the Children's Online Privacy Protection Act (COPPA).

13.1 Measures We Take

We implement reasonable administrative, technical, and physical safeguards consistent with industry standards and Massachusetts 201 CMR 17.00, including:

• SSL/TLS encryption (HTTPS) for all data transmitted between your browser and our Site;
• Encrypted password management tools for storing client credentials during projects;
• Access to personal data limited to authorized personnel on a need-to-know basis;
• Regular review of data handling practices.

13.2 Limitations

No method of Internet transmission or electronic storage is 100% secure. While we use commercially reasonable means to protect your data, we cannot guarantee absolute security. You transmit data to us at your own risk.

13.3 Breach Notification

In the event of a qualifying data security breach under M.G.L. c. 93H, we will notify affected Massachusetts residents, the Attorney General, and the Office of Consumer Affairs without unreasonable delay. Where a breach involves Social Security numbers, we will offer 18 months of free credit monitoring as required by Massachusetts law.

If Amity Website Design is involved in a merger, acquisition, or asset sale, your personal data may be transferred to the acquiring entity as part of that transaction. We will provide notice via a prominent Site announcement or email before data becomes subject to a materially different privacy policy. Any successor entity will be bound by this Policy unless you are notified of changes and given an opportunity to object.

Prospective purchasers may review aggregate, anonymized business information during due diligence under a binding NDA. No client names, personal data, or project-specific details will be disclosed to prospective purchasers without prior written consent, except as required to complete an actual acquisition by a qualified successor who assumes all obligations under this Policy.

Our Site may contain links to third-party websites for informational purposes. This Privacy Policy applies only to our Site and services. We have no control over and assume no responsibility for the content or privacy practices of any third-party site. We encourage you to review the privacy policy of every site you visit.

16.1 Updates

We may update this Privacy Policy to reflect changes in our practices or legal requirements. All changes are reflected in the Effective Date at the top of this page. For material changes, we will provide at least 14 days' notice to active clients by email where practicable.

16.2 Governing Law

This Policy is governed by the laws of the Commonwealth of Massachusetts. Disputes are resolved in the courts of Dukes County, Massachusetts, consistent with our Terms and Conditions.

16.3 Contact

For any questions, concerns, or privacy rights requests regarding this Policy: