This policy explains what information Bob's Webworks (operated by Virtual Ventures, LLC) collects through this website, why, how long it's kept, and how to ask us to access, correct, or delete it. It covers this marketing site only. Client projects have their own data-handling terms in their Services Agreement.
The only place this site asks you for personal information is the free project assessment form. If you fill it out, we collect exactly what you enter: your name, your email address, your business type, your current site status, an estimated page count, the features you check off, a budget range, a timeline, and anything you type into the optional "anything else" field. We don't collect this information anywhere else on the site, and there's no account or login system here to sign up for.
Separately, every page on this site loads a page-view analytics beacon (see "Cookies and tracking" below) that logs aggregate visit statistics. It is not tied to your name or email unless you've also submitted the form.
Form submissions are used for one purpose: to understand your project and follow up with an estimate or a conversation about your website. We don't use it for anything else: no newsletter list, no advertising, no profiling, no automated decision-making about you.
When you submit the assessment form, it's delivered by an automated process running on Microsoft Azure, which emails the submission directly to the business owner's inbox. We do not maintain a customer database, CRM, or spreadsheet of leads. The email itself, and whatever reply thread follows, is the only place your submission lives. Microsoft (as our hosting/email-delivery infrastructure) and Cloudflare (as our analytics provider, described below) process data only on our behalf, strictly to make the site and form work. They are service providers, not parties we share your information with for their own purposes. Beyond that, we do not share, rent, or sell your information to any third party, for marketing or anything else, full stop.
Because submissions live only in email, not in a database, retention in practice means how long that email is kept. As a matter of policy, we aim to delete or archive assessment-form emails no later than 24 months after your last contact with us if no project results from the inquiry, and we'll delete a specific submission sooner any time you ask (see "Your privacy rights" below). If a submission turns into a client project, records relevant to that project are then governed by the retention terms in the Services Agreement instead.
California's CCPA/CPRA privacy-rights law legally applies only to larger businesses (see "The legal frameworks behind this policy" below). Bob's Webworks doesn't meet that threshold. Even so, we extend the same core rights to everyone who contacts us, regardless of where you live, because it's the right thing to do and costs us nothing extra:
Right to know / access: ask what information we have tied to your name or email.
Right to correct: ask us to fix inaccurate information.
Right to delete: ask us to delete your information; we will, unless we're legally required to keep specific records (e.g., invoices, for tax purposes).
Right to opt out of sale or sharing: not applicable in practice, since we never sell or share your information to begin with; you don't need to opt out of something we don't do.
No retaliation: we won't charge you differently or refuse to work with you because you exercised any of these rights.
To exercise any of these, email hello@bobswebworks.com from the address you used (or tell us enough to identify your submission) and describe what you'd like. As a one-person business we don't have an automated request portal, but we aim to respond within 45 days, consistent with CCPA's standard response window, even though that window isn't legally required for a business our size.
This site uses Cloudflare Web Analytics to see aggregate traffic like which pages get visited. It is cookieless: it does not set any cookies, does not fingerprint your device, and does not track you across other websites. It only reports anonymous, aggregate page-view metrics; it cannot identify you personally, and Cloudflare does not receive your name or email from this analytics beacon. We use no advertising pixels, no Google Analytics, and no other tracking scripts.
Do Not Track: because we don't track individual visitors across third-party sites over time, there's no cross-site tracking for a "Do Not Track" browser signal to turn off, so this site does not respond differently to DNT signals.
We plan to add client invoicing/billing to this site. When that launches, all payments will be handled entirely by the third-party processor's own secure checkout: PayPal, Google Pay, or Apple Pay. We will never directly collect, see, or store your full card number, bank account number, or other sensitive payment credentials; that information goes straight to the processor and is governed by its own privacy policy and security standards. We may keep basic transaction records (amount, date, what was paid for) for our own bookkeeping and tax purposes.
This site and its assessment form are intended for business owners and adults arranging web development services, not children. It is not directed at children under 13, and we do not knowingly collect personal information from anyone under 13 (consistent with the federal Children's Online Privacy Protection Act, COPPA). If we learn that a child under 13 has submitted information, we'll delete it promptly.
Because assessment-form submissions go straight to a single email inbox rather than into a database or CRM, there's a small footprint of stored data to protect in the first place. This site is served over HTTPS, and we rely on reputable infrastructure providers (Microsoft Azure, Cloudflare) that maintain their own security programs. That said, no method of transmission or storage over the internet is 100% secure, and we can't guarantee absolute security.
CalOPPA (California's Online Privacy Protection Act) is the baseline this policy is built to satisfy. It applies to essentially any commercial website that collects personal information from California residents, with no minimum size, revenue, or traffic threshold, so it clearly applies to us.
CCPA/CPRA (California's Consumer Privacy Act / Privacy Rights Act) legally applies only to businesses that cross at least one of three size thresholds: roughly $26.6 million or more in annual gross revenue (the inflation-adjusted 2026 figure), buying/selling/sharing the personal information of 100,000+ California consumers or households a year, or earning 50%+ of annual revenue from selling or sharing personal information. Bob's Webworks, a one-person freelance business, meets none of these, so CCPA/CPRA does not legally require us to comply. We've chosen to voluntarily offer CCPA/CPRA-style rights above anyway, as the strictest reasonable and safest approach, since it costs us nothing given that we don't sell data in the first place.
GDPR (the EU's General Data Protection Regulation) generally applies to businesses that intentionally offer goods/services to, or monitor, people located in the EU/EEA/UK. We're a U.S. business serving U.S. small-business clients and don't market to or intentionally collect information from people there, so our GDPR exposure is low. It isn't zero: if someone in the EU voluntarily contacts us, we'll still honor the protections in this policy for them, but because our exposure is minimal, we haven't built out formal GDPR machinery like an EU representative or a data protection officer, which would be disproportionate for a business of this size.
If this policy changes, the "last updated" date above will change too, and material changes (such as starting to share data with a new type of third party) will be reflected here before they take effect. Continued use of the site after an update means you accept the revised policy.
Virtual Ventures, LLC, d/b/a Bob's Webworks ยท hello@bobswebworks.com