Privacy policy.

This is the SWS privacy policy in plain English. We collect what we need to do the work, we don't sell your data, we delete it on request. That's the short version.

Who we are

Dominic Stroder, doing business as Stroder Web Services, runs a business out of Del City, Oklahoma that builds and looks after websites for small businesses and helps small businesses with their computers. Contact: [email protected] · (405) 458-0864.

What we collect

We collect information in these situations:

• Intake forms. If you submit our intake form for a website project, we collect the business and project information you give us. Your name, business name, contact info, services, brand notes, photos and assets, and similar items needed to build your site.
• Other forms on this site. The contact form, the free site audit, the service agreement signature, the store quote and checklist request forms, the computer support request form, and the website revision form. We get what you type in, such as your name, business name, email, phone, website address and message, plus any photos or files you attach. The computer support form and the free site audit's live check also record the IP address they were sent from.
• Payments. Payments are processed by Stripe. We do not store your credit card number. Stripe sends us your name, email, and the amount paid; their privacy policy applies to how they handle the card data.
• Email correspondence. If you email us or reply to our outreach, we keep that thread for our records and to provide service.
• Calls and texts. If you call or text (405) 458-0864, we keep your number, your messages, and any voicemail or photo you send, so we can reply and quote the work.
• The client portal. If you sign in, we keep your email address and the requests and messages you send there, and we log which portal pages you open and when. If you choose to set a password, we keep only a coded (hashed) form of it. If you turn on portal notifications, we keep the push address your browser gives us and your browser type, and those notifications travel through your browser maker's push service.
• Referrals. If you arrive through a client's referral link, we note the visit (the time, your browser type, and a coded (hashed) form of your IP address) so we can credit that client if you sign up. If a client refers you to us by name, they may give us your name and contact details.
• Forms on websites we built for our clients. We run the contact forms on some of our clients' websites. When you use one, your message is emailed to that business, you get a short confirmation email, and Dominic gets a phone notification with your name, contact details and the start of your message.

We use Plausible Analytics, which we self-host, to see which pages get visited. It is privacy-friendly by design: it sets no cookies, collects no personal data, and does not track you across sites. There is nothing to opt out of, because it does not track individual people. It also counts clicks on our email address links, so we can tell when someone emails us instead of using a form.

How we use it

• To build, launch, and maintain your website.
• To communicate with you about your project, billing, and ongoing support.
• To send the occasional update related to your account (renewal reminders, security notices, monthly SEO reports if you're on a retainer).
• To improve our service and our site.
• To screen form submissions for spam and scams.

We do not sell your data or share it for advertising. The outside services that receive it, and what each one gets, are listed below.

Services we use

Here is each outside service we use to run the business and what it receives.

Payments, email and forms

• Stripe. Payment processing. Your card and billing details go into Stripe's secure checkout (on our price builder page or a Stripe payment link), and we never see your card number. Stripe's code on our price builder page also collects device and browsing signals that Stripe uses to prevent fraud.
• Resend. Sending transactional email (form notices and confirmations, welcome notes, client portal sign-in links, review links, "your site is live" notifications, monthly reports). It receives the recipient's address and the content of the email.
• web3forms. Delivers our website revision form. It receives what you enter on that form, including any files you attach, and forwards it to us by email.
• rdap.org. When you use a business email address on one of our forms, we look up the public registration record for that email's domain (the part after the @) to help spot scams. The lookup goes to rdap.org, which may pass it on to the domain's own registry. Only the domain name is sent.

Hosting, security, records and backups

• Cloudflare. DNS, CDN, and domain registration on your behalf, in your name. Every visit to this site and to the client portal passes through Cloudflare, which sees your IP address and browser details in order to deliver pages and block attacks. Our site forms and checkout run on Cloudflare Workers, and an offsite copy of our backups is stored with Cloudflare R2 for 30 days.
• GitHub. Our private code repository. Along with our code and site files, it holds copies of our client records (names, business and contact details, and project and billing details) and our notes and draft messages for businesses we have contacted or plan to contact.
• UptimeRobot. Checks that our clients' websites are up. It receives the website address, nothing about visitors.

Google

• Google Workspace. Our business email runs on Google, so emails you send us are stored there.
• Google Voice. Our business number, (405) 458-0864, runs on Google Voice, so calls, voicemails and texts to it pass through Google.
• Google Search Console. If you're on an SEO retainer, we connect to your GSC property to read search performance data.
• Google Places and PageSpeed Insights. We look up public business listings on Google Maps and test website speed with Google's tools. They receive business names, cities, and website addresses, including the address you enter in our free site audit.

Messages and alerts

• Meta (Facebook Messenger). Some of our outreach messages are sent through Facebook Messenger, so those messages and any replies pass through Meta.
• Discord. We use it for internal alerts. Alerts about new leads, messages and replies post there, and can include names, contact details, message excerpts, photo links and drafted replies.

Research and drafting

• Anthropic. An AI service we use when we draft messages, reports and documents. What passes through it can include form messages, emails, texts and photos you send us, your project intake details, and public information about your business.
• Serper and Brave Search. Search services we use for local SEO research and ranking checks. They receive search terms, which can include a business name, a city, keywords, or a device model number from a repair request.
• Bright Data. A web access service we use for business research. It receives the addresses of the business websites and Facebook pages we look up.

Outside files some of our pages load

• Client portal. Portal pages load a styling script from Tailwind CSS (cdn.tailwindcss.com) or fonts from Google Fonts, depending on the page.
• Visibility reports and plan pages. Our visibility reports load map code from unpkg.com and map images from OpenStreetMap. Our custom plan pages load fonts from Google Fonts.
• Demo and preview pages. Some of our demo and preview pages load fonts from Google Fonts and stock photos from Unsplash or LoremFlickr.

Each of these services sees the IP address and browser details of anyone who opens those pages. The rest of this site loads none of them.

Run on our own servers

Plausible Analytics (visit counts) and ntfy (Dominic's phone notifications) run on our own servers, as do the main systems that store your project files, form messages, portal activity and our client records. Copies of our client records are also kept in our private GitHub repository, listed above. Nothing in these systems goes to an outside company except through the services listed above.

Beyond the services above, and the business you contact through a form on its own website, we do not sell, rent, or share your data with any other party. We will only disclose data if legally required (subpoena, valid court order, etc.).

How long we keep it

We keep client project files (intake data, brand assets, build artifacts) for as long as you are an active or recently-active client (within the last 24 months). After that, we periodically purge old project data unless you ask us to keep it. Email correspondence is kept indefinitely unless you ask us to delete it. Stripe billing records are kept per Stripe's policies and tax law (typically 7 years for tax records).

Form messages, computer support requests, lead records, portal activity, referral visits and preview view records have no automatic expiry. We keep them until we delete them, and we will delete yours when you ask. Dominic's phone notifications stay on our notification server for 7 days. When we delete something, older copies can remain in our backups until those backups roll off, and in the change history of our GitHub repository; our offsite backup copies are deleted after 30 days.

Your rights

You can:

• Ask what data we have on file about you.
• Ask us to correct or update it.
• Ask us to delete it (subject to tax-record retention requirements where applicable).
• Opt out of any non-essential email by replying to it, or, on our outreach emails, by clicking the unsubscribe link in the footer.

Email [email protected] and we'll respond within 5 business days.

Cold outreach

If you received an unsolicited email, text, or Facebook message from us, we found your business contact details in public places: your Google Maps listing, your business website, your business's public Facebook page, or public search results. Emails sent from our outreach mailing system include an unsubscribe link. Click it once and we take you off our list. You can also reply "stop" or "unsubscribe" to any message from us, and we will take you off our list.

Preview sites and reports we send

Sometimes we build a free preview website, a custom plan page, or a visibility report for a business and send the owner a link. Those pages contain a tiny invisible image that tells us when the page is opened. Each time it loads, we record which page it was, the time, and your browser's user agent (the line that names your browser and device type). We do not store your IP address with it.

If we have already sent you the link, the first open each day is noted on your record in our contact list and Dominic gets a notification, and it may shape when and how we follow up. Opens that look like link previews or automated checks are logged but set aside. Turning off image loading in your browser blocks it, and you can ask us to delete these records at any time.

Cookies

Our analytics tool, Plausible, is cookieless, so browsing this site sets no analytics cookies. We use no advertising or retargeting cookies. Here is what you may see:

• Security. Cloudflare may set a cookie named cf_clearance, which records that your browser passed its automated bot check.
• Referrals. If you arrive through a client's referral link, we set a cookie named sws_via for 90 days, and save the same value in your browser's storage, so we can credit that client if you sign up. It holds only the referring client's link name.
• Client portal. If you log into the client portal, that uses a standard sign-in cookie to keep you signed in.
• Checkout. Our price builder page loads Stripe's checkout, which may set its own cookies for fraud prevention under Stripe's cookie policy.
• Your settings. Your light or dark mode choice is saved in your browser's local storage and is never sent to us. Our intake and agreement pages also note in your browser when you have already submitted them.

You can block cookies in your browser settings. The public pages of this site still work without them; the client portal needs its sign-in cookie to keep you signed in.

Children

Our service is for businesses. We do not knowingly collect data from anyone under 13. If we learn that we have, we will delete it.

Changes

We may update this policy occasionally. Material changes will be reflected by a new "Last updated" date at the top of this page, and we will notify active clients by email if the change affects them.

Contact

Stroder Web Services
Dominic Stroder, Owner
Del City, Oklahoma
[email protected]
(405) 458-0864