# Privacy Policy | Winston Digital Marketing What this site collects, which companies receive it, and how to make it stop. Written against the tags actually running on these pages. **Last reviewed:** September 19, 2026 > General information, not legal advice. This page describes how winstondigitalmarketing.com handles data as of the review date above. It is not a legal opinion and it does not replace advice from your own counsel. Items marked TO CONFIRM are questions we have not settled yet. We would rather flag them than guess. ## Who we are. Winston Digital Marketing, LLC ("Winston," "we," "us"), based in Brooklyn, New York. This policy covers the public website at winstondigitalmarketing.com. Work we do for a client under contract is governed by that contract, not by this page. Questions, requests, and complaints all go to [john@winstondigitalmarketing.com](mailto:john@winstondigitalmarketing.com). ## This site records your session. Most privacy policies bury this part, so it goes first. Microsoft Clarity runs on every page of this site (project ID yjzr7kp3aw). It records your visit and lets us play it back like a video, which is a very different thing from counting page views. What it captures: - Mouse movement and cursor position as you move around the page - Every click and tap, and where on the page it landed - Scrolling: how far you go, how fast, where you stop - Which pages you move between, how long you stay, and behavior signals Clarity labels rage clicks, dead clicks, and excessive scrolling - Device, browser, operating system, referring source, and approximate location derived from your IP address - Enough of the page content to rebuild what your screen looked like during the replay Microsoft stores the recordings. We watch them in the Clarity dashboard to find the places where the site confuses people. Clarity also builds heatmaps, which stack many visitors' clicks and scroll depth onto a single image of a page. What a replay cannot show is what you typed. Microsoft masks the contents of input boxes and drop-down menus in every masking mode, including the most permissive one, and says plainly that this cannot be customized. So the recording captures that you filled in the contact form, not what you put in it. The one form on this site posts to Mailchimp, and that submission is a separate thing from the replay: it is covered under [what you hand us directly](#what-you-hand-us) below. Our [data protection notice](/data-protection/) has the exact configuration. If you would rather not be recorded at all, read [how to opt out](#opt-out). Microsoft documents its side here: the [Clarity FAQ](https://learn.microsoft.com/en-us/clarity/faq), the [Clarity terms of service](https://clarity.microsoft.com/terms), and the [Microsoft Privacy Statement](https://privacy.microsoft.com/privacystatement). ## What you hand us directly. - **The free audit tool** at [/audit/](/audit/). The URL you type in. It goes to our own endpoint on Cloudflare Workers, which fetches that page, strips it down to the title, meta description, headings, structured data types, and roughly the first 4,000 characters of text, then sends that extract to a language model provider to be scored. Anthropic runs it by default, with NVIDIA as a fallback. Do not run the tool against a page you would not want read by a model provider. - **The full report request** on that same page. Your email address, plus the URL you audited and the score the tool returned. All three land in our Mailchimp audience as list fields. - **The newsletter form** at [/newsletter/](/newsletter/). Your email address, into the same Mailchimp audience. - **The contact form** at [/contact/](/contact/). A HubSpot embedded form. Whatever you type into it goes into our HubSpot CRM and stays there. - **The call booker** on the contact page. A HubSpot meeting scheduler. It takes your name, email, and the slot you choose, and puts the meeting on our calendar. ## What gets collected while you read. - **Google Tag Manager**, container GTM-N36WKNH, on every page. Tag Manager collects nothing by itself. It is a loader that runs whatever tags we configure in the container, and tags can be added there without touching this site's code. The current container inventory is in the [data protection notice](/data-protection/). - **Google Analytics 4**, loaded through Tag Manager. It receives page views, clicks on our buttons and links, outbound link clicks, scroll depth at 25, 50, 75, and 100 percent, form submissions, and the device and approximate location that ride along with them. Google explains its side at [Google business data privacy](https://business.safety.google/privacy/). - **Conscriba**, loaded from cdn.conscriba.com on most pages. A third-party analytics script that tracks visitor and AI agent traffic and can run A/B tests. On one of our prospect landing pages our own source comments call it a per-prospect tracking pixel. Vendor policy: [Conscriba privacy policy](https://conscriba.com/privacy). - **Plausible Analytics**, on roughly a quarter of the site's pages rather than all of them. Page views, referrer, country, and device type. No cookies, no cross-site identifier. [Plausible data policy](https://plausible.io/data-policy). - **Cloudflare**, our host and CDN, keeps standard request logs: IP address, user agent, URL, and timestamp, for delivery, caching, and blocking abuse. - **The audit rate limiter.** Our worker reads your IP address to cap the live audit at five runs per minute per visitor. That address sits in the worker's memory for about a minute and is written to no database. What is *not* here, in case a scanner tells you otherwise: there is no Meta pixel, no LinkedIn Insight Tag, and no TikTok pixel in this site's code. The facebook-domain-verification tag you will find in our page source is a domain ownership check for Meta Business Manager. It loads no script and sets no cookie. LinkedIn appears only as links to our profiles. ## Cookies. This site has no cookie banner. We know that is a gap. It does not mean nothing is being set. An earlier version of this page said the site used no cookies beyond strictly essential ones, and that stopped being true once Tag Manager, Analytics, Clarity, Conscriba, and the HubSpot embeds went on. This version corrects it. - **Strictly necessary.** Cloudflare may set a security cookie that separates humans from bots. Nothing on the public site requires a login, so we set no session cookie of our own. - **Analytics and session replay.** Google Analytics 4, Microsoft Clarity, and Conscriba each set their own identifiers so a return visit can be recognized as a return visit. Plausible sets none. - **Marketing and CRM.** The HubSpot form and meeting scheduler set HubSpot's visitor tracking cookies, which connect a form fill back to the pages that visitor read first. A current inventory of individual cookie names and lifetimes is TO CONFIRM. The list will come out of a real scan of the site. ## How to opt out. Three routes, strongest first. - **Block the scripts.** Browser tracking protection in Firefox, Safari, or Brave, or any content blocker, stops Clarity, Analytics, Conscriba, and Plausible before they load. This is the only method that prevents collection instead of cleaning up after it. - **Use Google's opt-out add-on.** [Google's browser add-on](https://tools.google.com/dlpage/gaoptout) turns off Google Analytics on every site you visit, not just this one. - **Email us.** Write to [john@winstondigitalmarketing.com](mailto:john@winstondigitalmarketing.com) and we will do it by hand: delete what we hold, take you out of the Mailchimp audience and the HubSpot CRM, and delete the Clarity recordings we can identify. One limit: Clarity recordings are not filed under your name. If you ask us afterwards to delete your session, we may not be able to find it. Tell us the page and roughly when you visited and we will try. ## Do Not Track and Global Privacy Control. This site does not currently detect a Do Not Track header or a Global Privacy Control signal and change its behavior automatically. Wiring that up is on the list. Until it ships, email us and we will apply your request manually across every system named here. ## Your rights, and how to use them. Whatever jurisdiction you are in, we will handle these four requests: - **Access.** Ask what we hold about you and we will tell you, system by system. - **Correction.** Tell us something is wrong and we will fix it. - **Deletion.** Ask us to delete and we will delete, apart from records we have to keep for tax, accounting, or a live legal claim. - **Opt out.** Ask us to stop analytics, stop marketing email, or both. Send the request to [john@winstondigitalmarketing.com](mailto:john@winstondigitalmarketing.com). Include the email address you used on the site, and if it concerns a recording, the page and rough time you were there. We will confirm we received it and tell you what we did about it. Our target turnaround is TO CONFIRM. We do not sell personal information for money. Some state privacy laws define sharing broadly enough to cover analytics and advertising tags, so if you want those stopped for you specifically, the opt-out routes above are how. This page describes rights we will honor. It does not claim certification or formal compliance under the GDPR, the CCPA, or any other regime. ## Why we are allowed to process any of this. - **Because you asked for something.** You typed a URL into the audit tool, so we run the audit. You filled in the contact form, so we reply. - **Because running the business needs it.** Server logs, rate limiting, and basic analytics keep the site up and show us which pages bring in work. We keep that proportionate. - **Because you said yes.** Marketing email goes only to people who subscribed, and every send carries an unsubscribe link. - **Because the law requires it.** Tax and accounting records for paid work. ## How long we keep it. Set out system by system in the [data protection notice](/data-protection/), including the ones where the retention setting is still TO CONFIRM. We are not going to print a number here that our vendor settings do not match. ## Where your data ends up. Winston is in the United States, and so is every vendor named on this page. If you visit from outside the US, your data is transferred to and processed in the United States under US law, which may protect you less than your home country does. Cloudflare's network is global, so a request may be served from an edge location near you before anything reaches a US system. If you are in the EU, UK, or Switzerland and need a transfer mechanism documented for your own records, write to us and we will tell you what each vendor offers. ## Everyone who receives data from this site. - **Microsoft**, for Clarity. Session recordings and heatmaps. - **Google**, for Tag Manager and Analytics 4. Page views and interaction events. - **Conscriba**. Visitor and AI agent traffic, behavior tracking, A/B tests. - **Plausible**. Cookie-free page view counts. - **HubSpot**. Contact form submissions and meeting bookings. This is our CRM. - **Intuit Mailchimp**. Newsletter and audit report email addresses. This is our email list. - **Cloudflare**. Hosting, CDN, and request logs. - **Anthropic**, or NVIDIA as a fallback. The extracted text of a page you submit to the audit tool, and nothing else. Never your email address. We do not sell data to any of them, and we do not pay any of them to build a profile of you across other websites. Each vendor's own policy is linked in the [data protection notice](/data-protection/). ## Children. This site is aimed at businesses. It is not directed at children, and we do not knowingly collect information from anyone under 13. If you think a child sent us something, email us and we will delete it. ## Updates. We update this policy when we change how we handle data, and when an audit finds that the page and the site have drifted apart. That is what produced this version. The review date at the top reflects the most recent pass. ## Related. [Data protection notice](/data-protection/), the operational detail behind this page. [Terms of service](/terms/), which covers the site, the free audit, and the paid products. ## Contact. Anything on this page: [john@winstondigitalmarketing.com](mailto:john@winstondigitalmarketing.com).