Privacy policy

01Who we are

This policy describes how Bizup LLC (Business Up LLC, a limited liability company formed in the State of Washington, registered at 550 Broadway, Seattle, WA 98122) handles information collected through this website.

If you have a question about anything in this policy, the contact details are at the bottom of the page.

02What we collect

Information you give us. When you submit an enquiry form, email us, message us on WhatsApp or call, we receive what you choose to send — typically your name, email address, company name, an indication of budget and project type, and whatever you write in the message.

Information collected automatically. Our hosting records a standard server log of each request: IP address, browser and device type, the page requested, and the page you arrived from. That log is how the site is kept running and how abuse is investigated. It is not joined to anything you send us.

We do not ask for, and have no reason to collect, payment card numbers, government identifiers or health information through this website.

03Why we use it

• To reply to your enquiry and to prepare a proposal.
• To deliver and support work you have engaged us to do.
• To understand which pages are useful, so we can improve the site.
• To keep the site secure and to investigate abuse.
• To meet record-keeping and tax obligations that apply to the business.

We are a United States business and this site is aimed at businesses in Washington State and the wider Pacific Northwest. Where a visitor is covered by the GDPR or UK GDPR: enquiries and proposals rest on steps taken at your request before entering a contract, client work on performance of that contract, and the server log on our legitimate interest in keeping the site running and secure. Analytics run on consent, and on nothing else: the tag is not loaded at all until you accept it, and declining leaves the site working exactly as it did.

04Cookies and analytics

This site runs Google Analytics 4, and only if you agree to it. Until you answer the banner, no request is made to Google at all — the script is not fetched, no cookie is set and no “cookieless ping” is sent. Decline and that stays true permanently; the site behaves identically either way.

If you accept, Google Analytics sets two cookies in your browser — `_ga` and `_ga_<id>` — which distinguish one browser from another so that two page views can be recognised as one visit. They expire after two years, or sooner if you clear them. We use this to see which pages are read and which are ignored. We have turned off the automatic page-view tag and send one per page ourselves, because the site navigates without full page loads and Google would otherwise record only the page you arrived on.

We advertise with Google, and if you accept the banner the same tag feeds that. Google Signals is on, which means Google may set its own advertising cookies through the tag, recognise you across devices while you are signed in to a Google account, and add you to a remarketing audience — so you may later see our ads on other sites. We also record a `generate_lead` event when a form is successfully sent, which tells us and Google Ads that an enquiry arrived; it carries which form was used and nothing you typed into it.

We also advertise on Facebook and Instagram, so with your consent the Meta pixel runs alongside Google’s tag and does the same job for those platforms: it sets cookies, and it can add you to an audience that later sees our ads there.

One part of the Meta setup deserves spelling out, because it is not visible in your browser. When a form is successfully sent, this server reports the enquiry to Meta directly as well — Meta calls it the Conversions API. It sends your email address and your name HASHED, meaning converted into an irreversible string before they leave our server, which is what Meta requires and means no readable personal data is transmitted. It also sends your IP address and browser user-agent, which are not hashed. The purpose is to tell Meta that an advert produced an enquiry; it happens only if you accepted the banner, and declining stops it as surely as it stops the pixel.

What we still do not do: we assign no user ID, and we neither sell your information nor share it for anyone else’s advertising. Google truncates IP addresses before storing them. There is no third-party measurement code on this site other than the Google and Meta tags described here.

If none of that appeals, decline the banner. Nothing is loaded, no cookie is set, no audience is built, and the site behaves exactly the same.

Separately from analytics, one entry is kept in your browser’s session storage to stop the opening animation replaying on every page, and one to remember your answer to the cookie banner so it stops asking. Neither holds an identifier and neither is sent anywhere.

What we do have is the server log described above, and whatever Google Search Console reports about the searches that lead here. Search Console measures Google’s own search results rather than your visit, and it sets nothing on this site.

An earlier version of this page said that if analytics were ever added, this section would say so and name the tool before the tag went live. That is what this revision is. The tool is Google Analytics 4, operated by Google LLC.

The same earlier version promised that any banner would arrive in the same release as the tag and would default to off. Both held. Accept and decline are given equal prominence, declining takes one click, and you can change your mind at any time by clearing this site’s data in your browser, which makes the banner ask again.

05Who we share information with

We do not sell personal information, and we do not share it for cross-context behavioural advertising.

We do use service providers to run the business, and they process information on our behalf under contract: Hostinger, which hosts the site and delivers the enquiry forms; SMTP2GO, which delivers the emails those forms generate; our email provider, which carries the resulting correspondence; Google LLC and Meta Platforms, which receive analytics and advertising data, but only if you have consented to it; and WhatsApp, owned by Meta, if you choose to message us there, on Meta’s terms rather than ours. Invoicing and payment are handled by our accounting provider and never through this website.

We may disclose information where the law requires it, or to establish or defend a legal claim.

06How long we keep it

Enquiries that do not become projects: 24 months from our last contact with you, then deleted.

Client project records, including contracts and invoices: 7 years after the end of the engagement, which is the window the record-keeping and tax rules that apply to us require.

Server logs: 90 days. Google Analytics data, where you have consented to it: 14 months, which is the shortest retention Google offers, after which event-level data is deleted and only aggregate reporting remains.

07Your choices and rights

You can ask us what information we hold about you, ask us to correct it, or ask us to delete it. Write to the address at the end of this page and we will respond within one working day.

Depending on where you live you may have additional statutory rights, for example under the California Consumer Privacy Act or the GDPR. Rather than work out which regime covers you, we extend the same three to everyone who asks, wherever you are: tell us what we hold, correct it, or delete it. Email the address at the end of this page. We will not charge you, we will not ask you to create an account, and we will not treat you differently for asking.

You can withdraw your consent to analytics at any time by clearing this site’s data in your browser, which deletes the stored answer and makes the banner ask again. Declining has no effect on anything else: no feature is withheld and nothing is degraded.

You can unsubscribe from any marketing email using the link in that email.

08How we protect information

The site is served over HTTPS. Access to enquiry data and client systems is limited to the people who need it, and we keep software and dependencies current.

No method of transmission or storage is completely secure, and we do not claim otherwise. Please do not send passwords, card numbers or other sensitive credentials through a web form or email.

09Children

This site is intended for business audiences and is not directed at children. We do not knowingly collect information from anyone under 13, the threshold set by the Children’s Online Privacy Protection Act. If you believe a child has provided us with information, contact us and we will delete it.

10Where information is handled

We are based in the United States, and our service providers may process information in the United States or elsewhere. If you contact us from outside the United States, your information will be handled in the United States.

We do not target the EEA or the UK, but we do occasionally work with clients there. Where we do, information reaches the United States under the European Commission’s Standard Contractual Clauses, which our hosting and analytics providers both operate under. If you would prefer your data stayed in your own region, tell us before the work starts and we will say honestly whether we can arrange that.

11Changes to this policy

We update this policy when our practices or the tools we use change. The effective date at the top of the page tells you which version you are reading. Material changes will be flagged on this page.

8 October 2026: Google Analytics 4, Google Ads measurement and the Meta pixel with its server-side Conversions API were added, behind a consent banner that defaults to off. The cookies and analytics section, the list of processors and the retention windows were all rewritten to match. Before this date the site set no cookies and ran no analytics of any kind.