Privacy Policy.

1. Who we are; our role.

CodeStringers is the controller of personal information collected through the Site, meaning we determine the purposes and means of processing. Our headquarters are in Santa Cruz, California, USA. The service providers listed in Section 9 act as processors (or, where the law uses different terminology, equivalent service providers) on our behalf.

For questions about this Policy, contact our Privacy Office at privacy@codestringers.com.

2. Information we collect.

We collect personal information in these ways:

• Automatically, when you visit. Our hosting platform and its network provider process standard server information to deliver and secure the Site: IP address, browser and device type, approximate location derived from the IP address, the pages you request, the referring address, and the date, time and length of the visit.
• Through analytics, advertising and tracking tags and cookies. Google Analytics 4, the Google Ads tag and the Zoho tracker (Section 4) collect page views, navigation paths, clicks, session length, device and browser details, approximate location, the page that referred you, and, for the Zoho tracker, a visitor identifier that links your visits to a contact record once you identify yourself through a form or a tracked email link.
• Through our forms. When you send a consultation, partner, demo, press, newsletter or other form, we collect what you type (typically name, email address, phone number, organization, job title and your message) and what the form records about the visit: the page you used, the address you arrived from, and campaign labels (utm tags). In the regions where we ask for consent first (Section 4), the advertising click identifiers that ad networks add to a link (gclid, fbclid, li_fat_id, msclkid) are recorded only after you accept advertising cookies.
• Through booking. When you book a meeting, we and our scheduling provider collect your name, email address, phone number, company, the topic you enter and the time you choose.
• Through our chat. Section 5.
• Through meetings we record. Section 6.
• From public sources and business data providers. Section 7.
• Through our email. Our newsletter and sales emails record whether a message was opened and which links were clicked.

We do not want special categories of personal information (such as health, racial or ethnic origin, religious beliefs, biometric or sexual-orientation data) through the Site. Please do not put patient or health information into a form, the chat or a meeting.

3. How we use information and our lawful bases.

We use personal information for the purposes below. For visitors in the European Economic Area (“EEA”), the United Kingdom and Switzerland, we identify our lawful basis under Article 6 of the EU and UK General Data Protection Regulation (GDPR).

• Operate and secure the Site. Lawful basis: legitimate interests (a working, protected website).
• Answer your inquiry, chat or booking and follow up on it. Lawful basis: steps taken at your request before a contract, and legitimate interests (a business that answers people who write to it).
• Measure and improve the Site and our marketing. Lawful basis: where we ask first (Section 4), your consent; elsewhere, including in the EEA, the United Kingdom and Switzerland, our legitimate interests, with a notice and an opt-out that we honour at any time.
• Send you our newsletter and sales emails. We send them to people who completed a form on the Site, booked a meeting or registered with us, and to business contacts whose work email we obtained from a business-contact data provider (GetProspect). Lawful basis: your request or consent, and legitimate interests for follow-up on a business inquiry. You can stop them at any time (Section 13).
• Understand who we are talking to. We enrich the business details you give us from public sources (Section 7). Lawful basis: legitimate interests.
• Comply with law and respond to legal process. Lawful basis: legal obligation and, where applicable, legitimate interests.

Where we rely on legitimate interests, you have the right to object as described in Section 13.

4. Cookies, tags and tracking technologies.

What runs. Besides the cookies our host needs to serve the Site, the Site uses Google Analytics 4 and the Google Ads tag (both through Google’s tag), the Zoho Marketing Automation tracker (a Zoho PageSense script) and the Zoho SalesIQ chat widget. We do not run a Meta, LinkedIn or Microsoft advertising tag.

The Google Ads tag is an advertising tag. We use it to measure the results of our Google advertising and, when our campaigns run, to support remarketing to people who visited the Site. It sends information about your visit to Google. See Section 10.

The rule that depends on where you are.

• If we detect that you are in California, Florida, Pennsylvania or Illinois, or we cannot tell where you are, the analytics, advertising and Zoho tracking tags do not load, and their cookies are not set, until you choose Accept in the cookie banner.
• Everywhere else, including the EEA, the United Kingdom and Switzerland, those tags load when you arrive, under a notice, and you can switch them off at any time with Decline in the banner or the “Your Privacy Choices” link at the foot of every page.
• Everywhere, if your browser sends the Global Privacy Control signal, we treat it as a Decline of everything that is not essential: the analytics, advertising and Zoho tracking tags do not load, whatever the banner shows.

The banner is provided by Consentik, a Wix app. To tell where you are, the Site reads location information from our own host’s network edge (country and, in the United States, state); Consentik also looks up your approximate location, and for United States visitors it does so through the third-party service GeoJS, which receives your IP address (Section 9).

The cookies and similar technologies we know the Site sets, with how long each lasts when it is set:

• Essential. wixSession, client-session-bind and server-session-bind (Wix; session or short-lived): keep the Site working and protect it. __cf_bm (Cloudflare; 30 minutes): bot protection. _consentik_cookie and consent-policy (Consentik): remember your cookie choice.
• Analytics. _ga and _ga_KMTGKR0MG3 (Google Analytics; 400 days): tell visitors and sessions apart for aggregate reports. zabUserId (365 days), 836058474-_zldp and 836058474-_zldt (400 days), zpsCookieMeta (400 days) and zps-tgr-dts (Zoho tracker): tie visits to a contact record after you identify yourself and measure form and email attribution.
• Advertising. _gcl_au (Google; 90 days): conversion measurement for Google Ads. test_cookie (doubleclick.net; 15 minutes): checks that your browser accepts cookies.
• Chat. uesign (Zoho SalesIQ; 30 days) and LS_CSRF_TOKEN (Zoho SalesIQ; session): run the chat window. The chat widget loads on our pages for visitors in every region; it records a conversation only if you start one (Section 5).

You can also block or delete cookies in your browser settings, though the Site may then work less well. Google offers an opt-out add-on for Google Analytics, and Google’s ad settings control Google’s advertising cookies. We honour the banner, the footer link and the Global Privacy Control signal as described above.

5. Chat.

The chat on the Site is run by Zoho SalesIQ. Before your first message, the chat window shows this notice and a Start chat button: “This chat is recorded and stored by our chat provider, Zoho, and used by CodeStringers to answer you. By starting the chat you agree.” If you do not agree, do not start the chat; you can write to us through a form or at privacy@codestringers.com instead.

If you chat, Zoho receives and stores what you type, the name and email address you give, the page you were on, your IP address, device and browser details and approximate location, and a transcript of the conversation. We use it to answer you, to create or update a record for you in our customer system, and to follow up on your inquiry. We use the chat only for sales conversations. Chat transcripts are kept as described in Section 11.

6. Meeting recordings.

We hold sales meetings on Zoom and record them. A recording can include video, audio, a transcript, the meeting chat, captions and an AI-written summary produced by Zoom. We tell participants that the meeting is recorded and ask them to agree when they join. If you would rather not be recorded, tell us before the meeting and we will hold it without a recording.

After the meeting we copy the recording files into a restricted folder in our Google Workspace, and we send the transcript to an AI model (Claude, provided by Anthropic) to summarize it, to update the status of your inquiry in our customer system and, if you asked for one, to help draft a proposal. Recordings are kept as described in Section 11.

7. Lead enrichment from public sources.

When you send us a form or chat with us, we look up the business details you gave us so we know who we are talking to and can reply sensibly. The sources are your own submission, your company’s public website, public company registers (GLEIF and the United States SEC’s EDGAR system), and two business data providers: GetProspect (business contact and company data) and Bright Data (public web data, including company and professional-profile information from LinkedIn). We may add to your record a job title, seniority, company details, a city and postal code, a short summary and a note, and we may use an AI model to classify the inquiry; we do not send your email address or phone number to the model.

The information comes from public or business sources, not from you. You can ask us what we hold about you and where it came from, and you can ask us to delete it or to stop contacting you (Section 13).

8. Email.

We email our newsletter, and sales follow-ups, to people who submitted a form on the Site, booked a meeting or registered with us through Zoho, and to business contacts whose work email we obtained from a business-contact data provider (GetProspect). Our marketing and sales emails come from CodeStringers, carry our postal address and a way to opt out, and track opens and clicks through Zoho. To stop them, use the unsubscribe link, reply STOP, or write to privacy@codestringers.com; we will honour it within 10 business days and keep a record of it so that we do not email you again.

9. Who receives personal information.

We use the following service providers. Each handles personal information on our behalf under its own terms and contractual commitments; we list them because they receive personal information in the ordinary course, and we will update this list when we add or remove one.

• Wix.com, Ltd. (Israel and the United States): hosts the Site, serves our pages and content, and processes standard server information.
• Cloudflare, Inc. (United States and its global network): content delivery and attack protection that Wix uses; it receives your IP address and the requests you make.
• Google LLC (United States): Google Analytics 4, the Google Ads tag, YouTube videos we embed, Google Fonts for the cookie banner’s font where it is requested, and Google Workspace (our email, calendar and document storage).
• Consentik (a Wix app): the cookie banner, your recorded choice and a log of the choice with its region and time.
• GeoJS (get.geojs.io): receives the IP address of a United States visitor and answers with an approximate location, for the cookie banner.
• Zoho Corporation (United States and India): our customer system, form and booking handling, the Marketing Automation tracker and email, the SalesIQ chat, our knowledge site and project tools.
• Zoom Video Communications, Inc. (United States): meetings, recordings, transcripts and Zoom’s AI summary.
• Anthropic, PBC (United States): the Claude AI model that summarizes meeting transcripts and classifies inquiries, as described in Sections 6 and 7.
• Slack Technologies, LLC (United States): our internal messages, which can include the name, company and email address of a person who contacted us.
• GetProspect: business contact and company data (Section 7).
• Bright Data Ltd.: public web data, including professional-profile information (Section 7).
• Bill.com, LLC (United States): invoicing and payment details of clients and their billing contacts.
• HeyGen Technology Inc.: produces our videos from scripts and images we supply, which can include names and business details.
• GitHub, Inc. (United States): source control and review of the code that runs the Site and our systems.

Links from the Site to other websites (for example our LinkedIn page) are not service providers; those sites’ own policies apply, and we do not control them.

10. Advertising, “sale” and “sharing”.

We do not sell personal information for money. Because the Google Ads tag runs on the Site, information about your visit goes to Google for advertising purposes; where a law counts that as “sharing” personal information for cross-context behavioral advertising, this is it. In the regions where we ask first, the tag does not load until you accept. In every region you can stop it with Decline, the “Your Privacy Choices” link or the Global Privacy Control signal. We do not use sensitive personal information to infer your characteristics, and we do not knowingly sell or share the personal information of people under 16.

11. Data retention.

We keep personal information only as long as needed for the purposes above. We do not yet apply automatic deletion dates to every system, so the periods below are what we aim for and what we do on request:

• Server logs. Held by Wix and Cloudflare under their own retention policies.
• Analytics data. Held by Google under the retention setting of our Google Analytics property; aggregate reports remain for as long as Google keeps them.
• Cookies. For the lifetimes in Section 4, unless you delete them first.
• Forms, chat transcripts, enrichment notes and email history. Kept while they are needed to answer you and keep a reasonable business record, typically up to 24 months after our last contact, and then deleted or anonymized, unless a longer period is required by law or you become a client.
• Meeting recordings, transcripts and proposals. Kept for the sales relationship and our business records. We delete them on a verified request.
• Client-engagement records. For the engagement and the period required by the applicable agreement, tax law and professional-records rules (typically up to seven years after it ends).
• Backups. Overwritten in normal rotation, typically within 90 days.

12. International data transfers.

We are headquartered in the United States and primarily store personal information there. Our providers operate globally distributed infrastructure, so personal information may be processed in countries other than your own, including countries that have not been found to give an adequate level of data protection by the European Commission or the United Kingdom. Where EU or UK GDPR requires it, transfers are protected by Standard Contractual Clauses, the UK International Data Transfer Addendum or an equivalent mechanism in the provider’s own terms. Our services are directed at businesses in the United States; if you use the Site from elsewhere, your information is transferred to and processed in the United States and other countries where our providers operate.

13. Your choices and rights.

How to opt out.

• Cookies, analytics and advertising: Decline in the banner, the “Your Privacy Choices” link at the foot of every page, or the Global Privacy Control signal from your browser.
• Chat: do not start the chat; if you did, ask us to delete the conversation.
• Email: the unsubscribe link, a reply of STOP, or privacy@codestringers.com.
• Recordings: tell us before the meeting.

Your rights. Depending on where you live and the law that applies, you may have the right to know what personal information we hold about you and where we got it, to access a copy, to correct it, to delete it, to restrict or object to certain processing (including direct marketing), to receive it in a portable form, to withdraw consent, to opt out of the sharing of your information for advertising, and not to be subject to a solely automated decision with significant effects (we make none). We will not treat you worse for using these rights.

We are a small company and are not currently a “business” as the California Consumer Privacy Act defines it. We still honour the choices and rights above for every visitor, wherever you live.

How to exercise your rights. Email privacy@codestringers.com. We will confirm that we received your request within 10 business days and respond within 45 days (we may extend this once by 45 more days, and will tell you why), or within a shorter period where the law requires. We may need information from you to verify your identity. We fulfil verified requests free of charge, except where a request is manifestly unfounded or excessive. You may authorize an agent to act for you, subject to verification.

Right to complain. You may lodge a complaint with your supervisory authority: in the EEA, the data-protection authority in your country; in the United Kingdom, the Information Commissioner’s Office (ico.org.uk); in California, the California Privacy Protection Agency or the Attorney General; in other states, the state Attorney General. We would appreciate the chance to address your concern first.

14. Security measures.

We protect personal information with encryption in transit (HTTPS with HSTS), a managed secret store for credentials, and review and approval before changes to the Site are released. We use multi-factor authentication where we have confirmed it is turned on, and we are confirming it on our other business systems; our Digital Security page says which. No method of transmission or storage is completely secure. For more, see our Digital Security page.

15. Breach notification.

If we become aware of a personal-data breach that affects the security of personal information we process, we will notify affected individuals and the relevant supervisory authorities to the extent and within the timeframes the law requires, including, under EU and UK GDPR, notification to the competent authority within 72 hours of becoming aware. We will tell you what happened, the categories of information involved and what we are doing about it.

16. Automated decision-making and profiling.

We use an AI model to summarize meetings and classify inquiries (Sections 6 and 7); its output updates our records and drafts documents. We make no decision about you based solely on automated processing that has legal or similarly significant effects.

17. Children’s privacy.

The Site is not directed to children under 13 (or under 16 in the EEA and the United Kingdom), and we do not knowingly collect personal information from children. If you believe a child has given us personal information, contact us and we will delete it.

18. Changes to this Policy.

We may update this Privacy Policy. When we do, we will revise the “Effective” date at the top of this page. For material changes, such as new categories of personal information or new purposes, we will give reasonable notice on this page, typically 30 days, before the change takes effect. Clarifying changes are effective on posting. The version effective 9 September 2026 is replaced by this one.

19. Contact us.

Questions, requests or complaints about this Policy or your personal information:

Privacy Office, CodeStringers
privacy@codestringers.com
Consultation form