Privacy Policy

What this page covers

This explains what information Bob's Webworks collects through this website, why, who else touches it, how long I keep it, and how to ask me to access, correct or delete it. Bob's Webworks is a name that Virtual Ventures, LLC operates under, and when I say "I" or "me" below, I mean that business and its owner, Bob. This policy covers this website. Client projects have their own data-handling terms in the Services Agreement.

What I collect, and when

Browsing the site doesn't ask you for anything. There are no visitor accounts or logins. I only collect personal information when you choose to give it to me in one of these places:

The free project assessment form. If you fill it out, I get exactly what you type: your name, email address, business type, current site status, estimated page count, the features you check off, a budget range, a timeline, and anything you add in the optional details box.

The cancel and help pages. Clients can cancel a Care Plan or ask a question using their email and Customer ID. I collect the email and ID you enter, the reason you pick for cancelling, anything you add in the optional note, and the time of your request. I use the request time to keep my 48-hour cancellation promise.

The booking page and reschedule form. After a payment, the confirmation page lets you book a kickoff call through Cal.com, which collects the name, email and time you enter. If you can't find a time, a small form there sends me your name, email and message instead.

Payments. If you pay an invoice or start a Care Plan, you pay through PayPal. I receive a confirmation with the details I need to run your account: your name and email as PayPal gives them to me, what you paid for, the amount, the date and a transaction or subscription ID.

Separately, two things happen in the background without you typing anything. Every page loads a cookieless visit counter (see "Cookies and tracking"), and the assessment, cancel and help forms use a bot check called Cloudflare Turnstile, which looks at technical signals from your browser, such as your IP address, to tell people from automated scripts. Your light or dark mode choice is also remembered in your own browser. That setting stays on your device and isn't sent to me.

How I use it

I use what you send me for one purpose: to understand your project and follow up with an estimate or a conversation, and, if you become a client, to run the project, bill you and support your site. I don't use it for a newsletter list, advertising, profiling or any automated decision-making about you.

Where it goes, and who else sees it

Assessment form submissions are delivered by an automated process running on Microsoft Azure, which emails them to my inbox. That inbox is hosted by Zoho Mail. The email, and any reply thread that follows, is where an inquiry lives. The same process also saves your name, email, estimated tier and form answers in my private admin system (described below) so I can remind myself to reply and don't lose track of your inquiry.

To keep my promises on time, the admin system can also add a reminder to my own Google Calendar. A reminder holds a title and short note, such as a client's name and what I owe them, and it's only ever visible to me. Google processes it under its own privacy policy.

If someone becomes a client, I keep a record in a private admin system, also hosted on Microsoft Azure, that only I can sign in to. It holds the basics needed to run the work: name, email, a Customer ID I assign to each client, the project or plan, its stage, amounts and payment records, and any cancellation or help requests you send me. I may also note a prospective client there while we're talking, so I don't lose track of the conversation.

These companies handle data only to make the site, the form, the booking and the payments work: Microsoft (hosting and the form's delivery process), Zoho (email), Cloudflare (the site's network, the visit counter and the Turnstile bot check), PayPal (payments), Cal.com (booking) and Google (my calendar reminders). They are service providers, and each has its own privacy policy that applies to what it handles. Beyond that, I do not share, rent or sell your information to anyone, for marketing or anything else.

How long I keep it

For inquiries that never turn into a project, I aim to delete or archive the emails no later than 24 months after our last contact, and I'll delete a specific submission sooner whenever you ask (see "Your privacy rights"). If an inquiry becomes a client project, the records for that project are kept for as long as the work and billing relationship continue, and afterward for as long as tax or legal rules require me to keep things like invoices. Anything covered by the Services Agreement follows the retention terms in that agreement.

Your privacy rights

California's CCPA/CPRA privacy-rights law legally applies only to larger businesses (see "The legal frameworks behind this policy" below), and Bob's Webworks doesn't meet that threshold. Even so, I extend the same core rights to everyone who contacts me, wherever you live, because it's the right thing to do and costs me nothing extra:

Right to know and access: ask what information I have tied to your name or email.
Right to correct: ask me to fix anything inaccurate.
Right to delete: ask me to delete your information. I will, unless I'm legally required to keep specific records, such as invoices for tax purposes.
Right to opt out of sale or sharing: not applicable in practice, since I never sell or share your information in the first place.
No retaliation: I won't charge you differently or refuse to work with you because you used any of these rights.

To use any of them, email [email protected] from the address you used (or tell me enough to identify your submission) and say what you'd like. I'm a one-person business without an automated request portal, but I aim to respond within 45 days, which matches the CCPA window even though that isn't legally required for a business my size.

Cookies and tracking

This site uses Cloudflare Web Analytics to see aggregate traffic, like which pages get visited. It is cookieless: it sets no cookies, doesn't fingerprint your device and doesn't follow you across other websites. It reports anonymous page-view numbers and can't identify you, and Cloudflare doesn't get your name or email from it. I use no advertising pixels, no Google Analytics and no other tracking scripts.

Two pages load third-party tools that work differently. The Care Plans and confirmation pages load PayPal's checkout, and the confirmation page loads the Cal.com booking calendar. Those companies can set their own cookies or collect their own data while you use them, under their own policies, and I don't control that. If you never open those pages, none of it loads.

Do Not Track: because I don't track individual visitors across other sites over time, there's no cross-site tracking for a "Do Not Track" signal to switch off, so the site doesn't respond differently to it.

Payments

Payments run entirely through PayPal's own secure checkout, for project invoices and Care Plan subscriptions alike. I never collect, see or store your full card number, bank account number or other payment credentials. That information goes straight to PayPal and is covered by PayPal's own privacy policy and security standards. I keep the basic transaction records described above for bookkeeping and tax purposes.

Children's privacy

This site and its forms are for business owners and adults arranging web development services, not children. It isn't directed at children under 13, and I don't knowingly collect personal information from anyone under 13, consistent with the federal Children's Online Privacy Protection Act (COPPA). If I learn that a child under 13 has sent me information, I'll delete it promptly.

Security

The site is served over HTTPS, and it runs on reputable providers (Microsoft Azure, Cloudflare, Zoho, PayPal) that maintain their own security programs. The admin system that holds client records is private and requires me to sign in, and I use two-factor authentication on the accounts that control the site. Even so, no method of transmission or storage over the internet is 100% secure, and I can't guarantee absolute security.

The legal frameworks behind this policy

CalOPPA (California's Online Privacy Protection Act) is the baseline this policy is built to satisfy. It applies to essentially any commercial website that collects personal information from California residents, with no minimum size, revenue or traffic threshold, so it clearly applies here.

CCPA/CPRA (California's Consumer Privacy Act and Privacy Rights Act) legally applies only to businesses that cross at least one of three thresholds: roughly $26.6 million or more in annual gross revenue (the inflation-adjusted 2026 figure), buying, selling or sharing the personal information of 100,000 or more California consumers or households a year, or earning 50% or more of annual revenue from selling or sharing personal information. Bob's Webworks, a one-person freelance business, meets none of these, so CCPA/CPRA doesn't legally require compliance. I offer CCPA/CPRA-style rights above anyway, since it costs nothing when I don't sell data in the first place.

GDPR (the EU's General Data Protection Regulation) generally applies to businesses that intentionally offer goods or services to, or monitor, people in the EU, EEA or UK. I'm a U.S. business serving U.S. small-business clients and I don't market to people there, so my exposure is low, though not zero. If someone in the EU contacts me, I'll still honor the protections in this policy for them. Because the exposure is minimal, I haven't built formal GDPR machinery like an EU representative or a data protection officer, which would be out of proportion for a business this size.

Changes to this policy

If this policy changes, the "last updated" date above will change too, and material changes, such as starting to share data with a new type of third party, will be reflected here before they take effect. Continuing to use the site after an update means you accept the revised policy.

Contact

Virtual Ventures, LLC, d/b/a Bob's Webworks. Email [email protected].