← Back home

— legal

Privacy Policy

Version 5 · Effective 2026-10-13

1. Who We Are

TheSiteNerds LLC ("we," "us," "our") is a New York limited liability company providing website design, development, and hosting for local businesses and nonprofits.

Contact for privacy matters:

This policy covers:

  • The public website at thesitenerds.com, including its contact form
  • Websites we build and host on behalf of clients, only to the extent we process personal data as a service provider — in that case, the client is the controller (see Section 9)

2. What We Collect

2.1 Information you give us

  • Contact form submissions: name, email address, and message. Sent to our inbox by email; there is no database behind this website, so nothing you submit is stored on it.
  • Correspondence: anything you choose to include when you email or call us.
  • Project content: brand assets, copy, images, access credentials, and similar material you share during a project, subject to the confidentiality obligations in our agreement.

2.2 Information collected automatically

  • Server logs: our host records IP address, user agent, timestamps, and requested resources. Used for security, debugging, and uptime. We do not aggregate, export, or analyze these.
  • Analytics (Cloudflare Web Analytics): page views, the page visited, referring site, country, device type, browser, and page-load timings. It is cookieless — it stores nothing on your device, assigns you no identifier, and cannot follow you to other websites. We see totals, not people.

2.3 Information we do NOT collect

  • Payment or card details — this website takes no payments
  • Accounts or passwords — there is nothing to log into
  • Social Security numbers
  • Sensitive personal data (health, race, religion, sexual orientation) unless a specific project explicitly requires it, in which case we address it in the project-specific agreement
  • Biometrics

3. How We Use Information

We use information to:

  • Respond to inquiries and arrange calls
  • Design, build, launch, and host the website we agreed to
  • Provide support and make changes you ask for
  • Monitor security, prevent abuse, and debug issues
  • Communicate about your project and anything materially affecting it
  • Comply with legal obligations (tax, accounting, contract records)

We do not:

  • Sell your personal information
  • Use your information for cross-context behavioral advertising
  • Share your information with third parties for their own marketing
  • Add you to a mailing list because you used the contact form

4. Legal Bases (EU/UK visitors)

Where the GDPR or UK GDPR applies, our legal bases are:

  • Contract: to provide services you request
  • Legitimate interests: to run and secure the website, respond to inquiries, and operate the business
  • Consent: where we rely on it
  • Legal obligation: accounting, tax, and record-keeping

5. Who We Share With

We share personal information only with the following service providers, and only to the extent each needs it to do its job:

  • Cloudflare — hosting, content delivery, and the cookieless analytics described in Section 2.2
  • Resend — delivers contact-form submissions to our inbox
  • Zoho Mail — our email provider, and therefore the destination for anything you send us
  • GitHub — source control for the projects we build

We also share with:

  • Professional advisors (our attorney and accountant), under professional-confidentiality obligations
  • Legal authorities when required by valid legal process, or to protect our rights, users, or the public
  • A successor entity if we sell or restructure the business; you will be notified and your data will remain subject to this policy

If a specific project requires a provider not listed here — a scheduling tool, an e-signature service, a payment processor for paid custom work — we will name it in that project's agreement before it is used.

We do not share information with advertisers, data brokers, or unrelated third parties.

6. How Long We Keep It

  • Contact form submissions: up to 2 years from receipt as email, unless the inquiry becomes a client relationship
  • Project and client records: for the duration of the engagement plus 6 years after it ends, aligned with NY tax and contract-record retention
  • Invoices and payment records, where a project is paid: 7 years (tax/accounting)
  • Server logs: retained by our host on its own schedule, typically days; we keep no separate copy
  • Analytics: aggregate totals only, retained by Cloudflare on its own schedule; because the data identifies no one, there is nothing in it to delete on request

After retention periods end, we delete or anonymize the data.

7. Cookies

This website sets no cookies. It is static HTML with no accounts and no sessions, and the analytics in Section 2.2 are cookieless by design — so there is nothing to store on your device and no cookie banner to dismiss.

Our host may set a short-lived cookie for security purposes, such as distinguishing automated traffic from real visitors. Any such cookie is strictly necessary, is not used to build a profile of you, and is not shared with anyone.

We do not use advertising, retargeting, or cross-site tracking cookies.

8. Your Rights

Depending on where you live, you may have the right to:

  • Access the personal information we hold about you
  • Correct inaccurate information
  • Delete personal information, subject to legal retention obligations
  • Port your information to another provider
  • Object to or restrict certain processing
  • Withdraw consent where processing is based on consent
  • Lodge a complaint with a supervisory authority (EU/UK) or your state attorney general (applicable US states)

How to exercise: email privacy@thesitenerds.com. We respond within 30 days. We may verify your identity before acting on a request.

California (CCPA/CPRA): we do not sell or share personal information as those terms are defined under California law. You have the additional right to know categories of information collected, categories of third parties we share with, and to non-discrimination for exercising your rights.

EU/UK (GDPR/UK GDPR): our contact for data-protection questions is the email above. We have not appointed a separate DPO. Legal bases are in Section 4.

9. Client-Hosted Sites (Processor Role)

For websites we build and host on behalf of clients, the client is the controller of end-user personal data collected via that site. We act as a processor/service provider under our agreement with them. End users of a client site should consult that client's own privacy policy. We will assist the client in responding to end-user data requests per the applicable contract.

10. Security

We implement reasonable technical and organizational measures: encrypted transport (HTTPS), least-privilege access, credentials held in a password manager rather than in code, multi-factor authentication on administrative accounts, and dependency patching. This website's own attack surface is small by construction — static files, no database, and a single form endpoint. No system is perfectly secure. We will notify affected individuals and authorities of any security incident involving personal data within the timeframes required by applicable law.

11. Children

Our services are directed to businesses and nonprofits. We do not knowingly collect personal information from children under 13. If we learn we have, we will delete it. Contact us at the privacy email above if you believe this has happened.

12. International Transfers

We are based in the United States. If you visit from outside the US, your information will be transferred to the US and processed by US-based service providers. We rely on Standard Contractual Clauses or equivalent safeguards where required.

13. Changes to This Policy

We may update this policy. The "Effective" date at the top reflects the latest version. Material changes will be communicated via email to active clients and via a notice on thesitenerds.com at least 14 days before they take effect.

14. Text Messages

If you call a business that uses our service and the call is not answered, you may get a text reply from that business. You may get up to 16 messages per conversation, plus one review request after a paid invoice. Message and data rates may apply. Reply STOP to stop or HELP for help. We do not sell or share mobile numbers with third parties for marketing.

15. Contact

← Back to thesitenerds home