Privacy Policy

1.1 Data Controller

Amity Website Design, operated by its principal owner on Martha's Vineyard, Massachusetts (“we,” “us,” or “our”), is the data controller responsible for personal data collected through this website (amitywebsitedesign.com, the “Site”) and through the provision of our professional services.

1.2 Scope

This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, who we share it with, and what rights you have. It applies to:

• Visitors to amitywebsitedesign.com;
• Prospective clients who contact us through our forms, phone, or email;
• Active and former clients of Amity Website Design;
• Any individual whose personal data we process in connection with our services.

This Policy does not apply to third-party websites we may link to. Those sites operate under their own privacy policies.

1.3 International Visitors

Our services are directed primarily at individuals and businesses in the Martha's Vineyard and greater Massachusetts area. If you are located outside the United States, including in the European Economic Area (EEA) or United Kingdom, your data will be processed in the United States and in Germany, where the server that runs the Site is located. By using our Site or services, you acknowledge this transfer. Where applicable, we extend data subject rights consistent with the GDPR as described in Section 11.

• Personal Data: Any information relating to an identified or identifiable natural person, such as name, email address, phone number, or IP address.
• Usage Data: Data collected automatically when you visit the Site, including IP address, browser type, pages visited, referring URL, and visit duration.
• Cookies: Small text files stored on your device by your browser at the direction of a website.
• Client Data: Personal or business data clients share with us in connection with project work.
• Credentials: Usernames, passwords, access tokens, API keys, or other authentication information.
• Service Providers: Third-party companies engaged by us to facilitate or support our services.
• Processing: Any operation performed on personal data, including collection, storage, use, disclosure, or deletion.

3.1 Contact Form & Inquiry Data

When you submit a contact form or otherwise contact us, we collect your name, email address, phone number (optional), business name (optional), the services you are interested in, budget and timeline (if you choose them), and your message. This data is used solely to respond to your inquiry and evaluate potential projects.

3.2 Usage & Analytics Data

When you visit our Site, data is automatically collected by our analytics tool (Section 6), including:

• IP address, used by Google Analytics only to estimate approximate location and never shown to us;
• Browser type, version, and device/operating system;
• Pages viewed, time on page, and navigation path;
• Referring URL (the page you came from);
• Approximate geographic location (city/region only, not precise);
• Interaction events (clicks, scroll depth, form submissions).

3.3 Client Project Data

Clients share business information, project briefs, content, and other materials necessary to complete work. We process this data solely to perform the agreed services. For client websites we host or maintain, see Section 8.2.

3.4 Credentials & Account Access

Clients sometimes share hosting, domain registrar, CMS, and other credentials to allow us to perform project work. See Section 9 for full disclosure of how we handle this sensitive data.

3.5 Communications Data

We retain records of email correspondence and project communications for the duration of the client relationship and as required for legal and accounting purposes. We do not record phone calls or video meetings unless everyone taking part has been told and has agreed first.

3.6 What We Do NOT Collect

We do not collect payment card numbers directly; all payment processing is handled by third-party processors (Section 8.3). We do not collect Social Security numbers, government IDs, biometric data, or health information. We do not knowingly collect data from individuals under 18.

4.1 No Sale of Data

We do not sell, rent, lease, or trade your personal data to any third party for their independent use, marketing purposes, or financial gain.

4.2 No Unsolicited Marketing

We do not send unsolicited marketing emails. Service-related updates to existing clients are sent only where necessary. You may opt out at any time by contacting us at the address in Section 16.

5.1 What Are Cookies

Cookies are small text files placed on your device by a website. They allow the site to recognize your browser and remember certain information. Browser “local storage” works in a similar way but stays on your device and is not sent to our server.

5.2 What the Site Uses

5.3 No Advertising or Cross-Site Tracking

We do not use advertising cookies, retargeting pixels (such as the Meta Pixel), or any other tool that tracks you across other websites.

5.4 No Cookie Banner

We do not currently show a cookie consent banner. The only non-essential cookies on the Site are the Google Analytics cookies above, and you can block them with the options in Section 6.4 or in your browser. If we ever add advertising or other non-essential tracking, we will update this Policy before it goes live and ask for consent wherever the law requires it.

5.5 How to Manage Cookies

You can manage or disable cookies through your browser settings:

• Google Chrome
• Mozilla Firefox
• Apple Safari

6.1 What It Is

We use Google Analytics 4, a web analytics service by Google LLC, to see how visitors use the Site: which pages are visited, where visitors come from, and which device types they use. We use this only to improve the Site.

6.2 What GA4 Collects

• Pages visited, scroll depth, and navigation paths;
• Session duration and time on page;
• Traffic source (search, direct, social, referral);
• Approximate location (city/region only);
• Device, browser, and operating system;
• Clicks on our phone number, email address, and booking link, and the fact that a form was sent (not what you wrote in it);
• A randomly assigned ID stored in a cookie, which does not contain your name or contact details.

6.3 Cookies Set by GA4

6.4 Opting Out

• Install the Google Analytics Opt-out Browser Add-on;
• Block _ga cookies in your browser settings.

For more on how Google uses this data: How Google uses information from sites that use its services.

7.1 Contact and Project Forms

When you send one of our forms, its contents are delivered to our business inbox by Resend, an email delivery service, and kept in our email account (Google Workspace). We may also send one automatic confirmation email to the address you entered; it does not repeat what you wrote. Your details are not published anywhere or added to a mailing list.

We also keep a record of each inquiry so we can follow up and track the project: a client entry in Notion (our client list), a private notification to our team in Slack, and an encrypted copy of the form contents in Cloudflare R2 storage as a backup. Only we can see them, and they follow the retention periods in Section 10.

7.2 Spam Protection

Our forms use Cloudflare Turnstile to check that a real person is sending them. To do that, Cloudflare processes technical signals from your browser and your IP address under its own privacy policy.

7.3 Abuse Limits

To stop repeated or automated submissions, our server keeps a count of recent form submissions per IP address in memory for up to one hour. It is not written to a database or used for anything else.

7.4 Scheduling

If you choose to book a call, you are taken to Calendly, a separate scheduling service. What you enter there is handled under Calendly’s privacy notice.

We share personal data with the providers below only to the extent needed to run the Site and deliver our services. Each processes it under its own privacy policy.

8.1 Providers We Use

8.2 Hosting of Client Websites

When we host or maintain a client's website, any data about that website's visitors is processed on the client's behalf, as their service provider. The client's own privacy policy governs that data.

8.3 Payment Processing

We do not store, process, or access full payment card numbers at any time. Invoices and card payments are handled by Square, a PCI-DSS compliant payment processor.

8.4 Legal Disclosure

We may disclose personal data if required by law, court order, or government request, or if we believe in good faith such disclosure is necessary to: (a) comply with a legal obligation; (b) protect our rights or property; (c) prevent or investigate wrongdoing; or (d) protect the personal safety of users or the public.

9.1 What We May Access

To perform project work, we may request temporary access to: web hosting control panels (cPanel, Plesk), domain registrar accounts (GoDaddy, Namecheap, Cloudflare), CMS administrator accounts (WordPress, Shopify, Squarespace), FTP/SFTP servers, Google Search Console, Google Analytics, and Meta Business Suite. Access is requested only when required. For project work it lasts for that task; for clients on a hosting or maintenance plan it lasts for the life of the plan.

9.2 How We Handle Credentials

• Used solely for performing agreed project work;
• Never shared with unauthorized third parties;
• Stored in an encrypted password manager while we need them;
• Permanently deleted within five (5) business days of project completion or termination, or, for hosting and maintenance clients, of the end of their plan.

9.3 Liability Disclaimer

We expressly disclaim liability for security incidents arising from credentials shared via insecure methods, vulnerabilities in the client's own hosting environment, weak or reused passwords, or failure to change credentials after project completion. See Section 12 of our Terms and Conditions for full provisions.

9.4 Post-Project Password Change

We strongly advise all clients to change every password and access credential shared with us within five (5) business days of project completion. This includes hosting, domain registrar, CMS, and any API tokens provided.

When data is no longer needed, it is permanently deleted from active systems. Physical documents containing personal information are destroyed in a manner that renders them unreadable, consistent with Massachusetts M.G.L. c. 93I.

Depending on your location and applicable law, you may have the following rights. We respond to verified requests within 30–45 days.

11.1 How to Exercise Your Rights

Email info@amitywebsitedesign.com with the subject line “Privacy Rights Request.” Include your name, contact information, and a description of the right you wish to exercise. We may verify your identity before processing. No fee for reasonable requests.

11.2 California Residents (CCPA / CPRA)

California residents have rights under CCPA as amended by CPRA, including the right to know, delete, correct, opt out of sale/sharing, and non-discrimination. As a small business, we may fall below mandatory CCPA thresholds, but we extend these rights as a matter of good practice. To submit a “Do Not Sell or Share My Personal Information” request, contact us at info@amitywebsitedesign.com. We do not sell personal data or share it for cross-context behavioral advertising.

11.3 EEA / UK Residents (GDPR)

EEA and UK residents have additional rights under GDPR / UK GDPR including rights of access, rectification, erasure, restriction, portability, and objection. You also have the right to lodge a complaint with your national supervisory authority. Legal bases for our processing are described in Section 4.

11.4 Massachusetts Residents

Massachusetts residents have rights under M.G.L. c. 93H. In the event of a qualifying data security breach, we will notify affected individuals, the Massachusetts Attorney General, and the Office of Consumer Affairs and Business Regulation as required by law.

Our Site and services are not directed to individuals under the age of 18. We do not knowingly collect personal data from minors. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at info@amitywebsitedesign.com immediately. Upon verification, we will promptly delete the information. We comply with the Children's Online Privacy Protection Act (COPPA).

13.1 Measures We Take

We implement reasonable administrative, technical, and physical safeguards consistent with industry standards and Massachusetts 201 CMR 17.00, including:

• SSL/TLS encryption (HTTPS) for all data transmitted between your browser and our Site;
• Encrypted password management tools for storing client credentials during projects;
• Access to personal data limited to authorized personnel on a need-to-know basis;
• Regular review of data handling practices.

13.2 Limitations

No method of Internet transmission or electronic storage is 100% secure. While we use commercially reasonable means to protect your data, we cannot guarantee absolute security. You transmit data to us at your own risk.

13.3 Breach Notification

In the event of a qualifying data security breach under M.G.L. c. 93H, we will notify affected Massachusetts residents, the Attorney General, and the Office of Consumer Affairs without unreasonable delay. Where a breach involves Social Security numbers, we will offer 18 months of free credit monitoring as required by Massachusetts law. Where we only store or maintain personal information for a client (for example on a website we host), we notify that client, who as the owner of the information gives the notices the law requires, and we help them do it.

If Amity Website Design is involved in a merger, acquisition, or asset sale, your personal data may be transferred to the acquiring entity as part of that transaction. We will provide notice via a prominent Site announcement or email before data becomes subject to a materially different privacy policy. Any successor entity will be bound by this Policy unless you are notified of changes and given an opportunity to object.

Prospective purchasers may review aggregate, anonymized business information during due diligence under a binding NDA. No client names, personal data, or project-specific details will be disclosed to prospective purchasers without prior written consent, except as required to complete an actual acquisition by a qualified successor who assumes all obligations under this Policy.

Our Site may contain links to third-party websites for informational purposes. This Privacy Policy applies only to our Site and services. We have no control over and assume no responsibility for the content or privacy practices of any third-party site. We encourage you to review the privacy policy of every site you visit.

16.1 Updates

We may update this Privacy Policy to reflect changes in our practices or legal requirements. All changes are reflected in the Effective Date at the top of this page.

16.2 Governing Law

This Policy is governed by the laws of the Commonwealth of Massachusetts. Disputes are resolved in the courts of Dukes County, Massachusetts, consistent with our Terms and Conditions.

16.3 Contact

For any questions, concerns, or privacy rights requests regarding this Policy: