Privacy Policy

Who we are and what this covers

Exceptional Web LLC, a Nevada company, runs exceptionalweb.com. "We" and "us" on this page mean Exceptional Web LLC.

Under EU and UK law, we're the "controller" of the information described here: we decide how it's used, and we're responsible for it.

This policy covers this website, our forms, and our emails and calls with people who ask about our services.

It also covers business contacts we meet elsewhere: on LinkedIn or another professional network, or through an introduction.

It doesn't cover work we do inside a client's own systems. That work follows our agreement with the client, including a data processing agreement where one is needed.

Sites we link to have their own policies.

What we collect

It comes from three places: what you give us, what your browser sends when you visit, and what a platform shares when we meet there.

What you give us

• The start form: your name, your work email, your website (or just your company name), and which service you'd like help with.
• The service choices are Tracking, Analytics, Operations, AI Automation, Growth Leadership and Not sure.
• Optional: one line on what's going on.
• Only if you pick Growth Leadership: a rough annual revenue range. The form never asks for a phone number.
• With the form, we also record the page you came from, the site that sent you, any campaign tags in the link, and the service or package that link named.
• Your details are saved when you press "Next: Pick Your Time", before you choose a slot. If you don't book, a person emails you about finding one.
• The tracking Five Checks form: your name, email and website, what your site runs on, which checks you failed, and the number you trust least.
• If you like, your own figures too: orders or leads, GA4, Meta and match quality. Your score stays on the page, and your answers aren't sent to us until you press send.
• Our other self-check pages work the same way: your name, email, company or website, your answers, and anything else that page asks for, like team size or a rough spend range.
• Booking a call: your name, email, the time you pick and anything you add to the booking. If you ask us to add a colleague, we use their email for that invite only.
• Emails and calls: what you choose to tell us about your business. If we'd like to record or transcribe a call, we ask at the start. A no is fine.
• If you become a client: billing contact details and our invoices.

What your browser sends

On every visit: your IP address, browser and device type, the page asked for and the time. Our host, Vercel, uses this to deliver the page and block abuse.

Only with your yes to analytics: pages viewed, how you got here, approximate location (city or region), device type, and which buttons and forms you used. This goes to Google Analytics 4.

Only with your yes to advertising: the Meta pixel records visits, including the confirmation page after a form is sent, to measure our ads and show them to past visitors.

On pages with a form: Google reCAPTCHA v3 checks that you're a person, using how the page is used and device details, which it sends to Google.

What platforms share

If we've met on LinkedIn or another professional network, or through an introduction, we keep what you or the platform shared with us: name, company, role, profile details and our messages.

We don't ask for sensitive information (health, government IDs, precise location, financial account details) and we'd rather not receive it.

How we use it, and on what basis

Each use comes with its legal basis, the reason EU and UK law allows it.

• To reply to you, get ready for our conversation and send your written game plan, or to send one written reply to your self-check answers.
• If you send the start form but don't pick a time, we also use it to email you about finding one.
• You asked us to (steps before a contract), and our legitimate interest in answering business enquiries.
• To do the work if you become a client, and to invoice for it.
• Our contract with you. Legal duties, such as keeping tax records.
• To keep the site running and safe, and keep spam out of the forms.
• Our legitimate interest in a working, secure site.
• To see which pages help people and which don't.
• Your consent, given in the banner. You can take it back any time.
• To measure our ads and show them to people who've visited.
• Your consent, given in the banner. You can take it back any time.
• To follow up with business contacts we met on LinkedIn or another professional network, or through an introduction, until you tell us to stop. Filling in our forms never puts you on a follow-up list.
• Our legitimate interest in running our business. Say stop and we stop.
• To meet legal duties and protect our rights.
• Legal obligation, and our legitimate interest.

Some tools we use have AI features, for example to summarize call notes. A person reads anything before it's sent to you, and we don't let those tools train on what you send us.

No decision about you is made by software alone.

Cookies and your consent

On your first visit, a banner asks what you're OK with. Until you answer, only the banner and what the site needs to work load. No analytics cookies, no ad pixels.

• Accept all: analytics and advertising cookies and tags load.
• Reject all: only what the site needs to work. Nothing else loads, now or on your next visit.
• Choose: turn analytics and advertising on or off separately.
• Closing the banner without choosing counts as no.

If your browser sends a Global Privacy Control signal, we treat it as a no to advertising and to any sharing for ads. Your privacy choices will show that it was honored.

Google Tag Manager, which applies your answer to every other tag, loads on every visit. Google receives that request like any file your browser loads. It sets no cookies.

Google Analytics follows your answer through Consent Mode v2. Until you say yes, it sets no cookies and sends only a cookieless signal that a page was viewed, which can't recognize you from one visit to the next.

Your name, email and what you write go only to our internal systems. They're never added to page addresses or sent to analytics or ad platforms, not even hashed.

About the form itself, analytics and ad tools learn only that one was sent, and which service it was about. Only with your yes.

When you click from a service or package page to the start form, the page address carries that service's or package's name, and nothing about you.

We don't use session recording or heatmap tools on this site.

Change your mind any time with "Your privacy choices" at the bottom of every page. Turning something off stops it from then on. Your browser settings can clear cookies already set.

With your yes, Google and Meta may collect information about your activity over time and across other websites, under their own privacy policies.

Browsers' older "Do Not Track" setting has no agreed meaning, so the site doesn't respond to it. We do honor Global Privacy Control.

The banner runs on Cookiebot. Your answer is saved in your browser so we don't ask on every page.

The cookies and tags on this site

These are the cookies the site sets. You can change your answer any time with "Cookie Settings" in the footer.

Who else sees it

We don't sell your personal information. Nobody pays us for it, and we don't trade it. What you type into a form is never sold or shared for anyone else's use.

• These services run parts of the business for us. Each sees what it needs for its job, under terms that limit what it can do with it:
• Hosting: Vercel serves the site and handles form submissions.
• Analytics and tags: Google Analytics 4 and Google Tag Manager, with your consent for analytics.
• Site tracking: ActiveCampaign, with your consent for analytics.
• Spam protection: Google reCAPTCHA. Google's Privacy Policy and Terms of Service apply.
• Consent banner: Cookiebot.
• Our internal systems: the database, email, calendar, video call and messaging tools where your enquiry lands and where we work on it.
• Ask and we'll send the current list of providers by name.

With your consent, Meta also uses what its pixel sees under its own policies, for example to show you ads on other sites.

Some US state laws call this "sharing" for cross-context behavioral advertising, or "targeted advertising". Say no in the banner, or send a Global Privacy Control signal, and it doesn't happen.

We may also disclose information when the law requires it, to protect our rights or someone's safety, or to a buyer if the business is ever sold. This policy would still apply to it.

How long we keep it

• Enquiries and self-check answers that don't turn into a project: up to 24 months after we last heard from you, then deleted.
• Clients: for as long as we work together, then as long as tax and accounting law requires, usually 7 years for invoices.
• Google Analytics data: 14 months, then Google deletes it.
• Server logs: kept by our host for its standard period.
• Call recordings and transcripts, if you agreed to one: 90 days, unless they become part of a project.
• Ask us to delete something sooner and we will, unless the law makes us keep it. If so, we'll tell you what and why.

How we protect it

The site runs on HTTPS, and form submissions are checked for spam before anything is stored.

Only people who need it for the work can see it, and the accounts that hold it use two-step sign-in.

No system is perfectly secure. If a breach puts your information at risk, we'll tell you, and the authorities, as the law requires.

Your rights and choices

You can ask for any of these, wherever you live. Some laws make them your right. We offer them to everyone.

• See it: what we have about you, where it came from, and who we've shared it with. We can send a copy you can take elsewhere.
• Fix it: correct anything wrong or out of date.
• Delete it: we remove it, unless the law makes us keep something.
• Stop it: take back your consent in "Your privacy choices", tell us to stop following up, or object to anything we do on our legitimate interest.
• Opt out of ads: we don't sell. Reject advertising in the banner, or use Global Privacy Control, to opt out of sharing and targeted advertising.
• Pause it: ask us to stop using it while a question about it is sorted out.

Email services@exceptionalweb.com with "Privacy" in the subject, and tell us what you'd like.

We'll confirm it's you by writing to the email address we have for you. We only ask for what we need to do that.

We confirm we got your request within 10 business days and answer within 45 days. If we need more time, we'll tell you why. For EU and UK requests, within one month.

Someone can ask on your behalf as your authorized agent. We'll need your signed permission, and we may check with you directly.

If we turn a request down, reply to our answer to appeal. We'll look again and answer within 60 days, and tell you how to contact your state attorney general if you still disagree.

Asking costs nothing and doesn't change how we treat you.

You can also complain to your local data protection authority. We'd like the chance to put it right first.

For California residents

This part gives the details the California Consumer Privacy Act (as amended by the CPRA) asks for. It covers the last 12 months.

• Identifiers: name, email, IP address, online identifiers. From you and your browser. Disclosed to our service providers, and to Meta with your consent.
• Professional information: company, role, website and what you tell us about your business. From you and from platforms where we met. Disclosed to our service providers.
• Internet activity: pages viewed, how you arrived, form use. From your browser, with consent. Disclosed to Google and ActiveCampaign, and to Meta with your consent.
• Approximate location from your IP address, never precise location. From your browser. Disclosed to our host and Google.
• Commercial information, if you become a client: services bought and invoices. From you and our records. Disclosed to our service providers.
• Audio or transcripts, only if you agree to a recorded call. From you. Disclosed to our service providers.

The purposes are the ones in "How we use it". Retention is in "How long we keep it".

We don't collect sensitive personal information as the CCPA defines it.

We don't sell personal information. With your consent, the Meta pixel may count as "sharing" identifiers and internet activity for cross-context behavioral advertising.

To opt out, reject advertising in "Your privacy choices", or turn on Global Privacy Control. We don't knowingly sell or share information about anyone under 16.

We don't give personal information to other companies for their own direct marketing.

• Your rights to know, delete, correct, opt out of sale and sharing, and not be treated differently are in "Your rights and choices".

For Nevada residents

We don't sell covered information as Nevada law defines it. You can still send an opt-out request to services@exceptionalweb.com, and we'll respond within 60 days.

Other US states

Residents of Virginia, Colorado, Connecticut, Texas, Oregon and other states with privacy laws have similar rights. The steps in "Your rights and choices" work for you too.

Children

This site is for businesses, and for people 18 or older, as our Terms say. We don't knowingly collect information from anyone younger.

If you think a child has sent us something, tell us and we'll delete it.

If you're outside the US

We're in the US, and so are most of our providers. If you contact us from the EU, the UK or elsewhere, your information is handled in the US.

Where a provider moves EU or UK data to the US, we rely on its EU-US Data Privacy Framework certification (with the UK extension), or on Standard Contractual Clauses.

Ask and we'll tell you which safeguard covers which provider.

Changes to this policy

When we change this policy, we update the date at the top.

If a change affects information we already have, we'll note it at the top of this page for 30 days and email the people it affects, if we're in touch with them.

Ask and we'll send you an earlier version.

Questions, or a request

Email services@exceptionalweb.com. Put "Privacy" in the subject line.

If anything here doesn't match what you see the site do, tell us. Checking that is our line of work, and we'd rather hear it from you first.