Privacy Policy

1. Who we are and what this covers

Greenflow SEM (“we,” “us,” “our”) is a digital marketing agency based in San Diego, CA, United States, serving clients across the country. This policy explains what personal information we collect through https://www.greenflowsem.com (the “Site”), how we use and share it, how long we keep it, and the choices and rights you have. It applies to visitors and prospective clients. Work we do inside a client engagement, for example managing an advertising account, is governed by the client’s service agreement as well as this policy.

2. Information we collect

Information you give us

• Forms and booking: when you request an audit, book a call, take the marketing checkup or contact us, we collect what you enter, typically your name, email address, phone number, business name and website, the services you are interested in, your approximate budget and timeline, how you heard about us, and anything you write in a message field. Booking a call uses Google Calendar appointment scheduling, which collects the name and email you provide to it.
• Chat: what you type to the AI assistant on this Site, and any contact details you choose to share in the conversation.
• Client billing: if you become a client and pay online, payments are processed by Stripe. Your card details go directly to Stripe and never touch our servers.

Information collected automatically

• Usage data: pages visited, links and buttons used (for example a tap on our phone number), time on page, the page that referred you, approximate location at city level, and device and browser type. Collected by Google Analytics 4 with your consent where required, and by Vercel Web Analytics, which is cookieless and does not identify you.
• Technical data: IP address and request headers in server logs, used for security, rate limiting and spam prevention. Our forms use a signed security token and a Cloudflare bot check; the token holds no personal data.
• Advertising data: if you arrive from one of our own ads, an ad click identifier may be stored so we can measure that the ad led to an enquiry. This only happens when marketing cookies are allowed.

Information from other sources

If you contact us through a third-party profile such as Google Business Profile or Clutch, we receive what that platform passes on. We do not buy personal information from data brokers.

3. How we use it

• To answer your enquiry, prepare an audit or proposal, and schedule and hold calls.
• To grade and route enquiries internally, so a real person follows up with the right context.
• To send the plan or booking details you asked for.
• To run, measure and improve our own marketing, including understanding which pages and campaigns lead to enquiries.
• To keep the Site secure, prevent spam and abuse, and enforce our terms.
• To improve the Site’s content and performance.
• To comply with legal obligations and keep business records.

We do not sell your personal information, and we do not share it with third parties for their own marketing. We do not use automated decision-making that has legal or similarly significant effects on you.

For visitors in the European Economic Area, the United Kingdom and Switzerland, our legal bases are: your consent (analytics and marketing cookies, and the chat assistant); our legitimate interests in responding to enquiries, securing the Site and understanding how it is used; performance of a contract or steps before one (proposals, engagements); and legal obligations (records).

4. Cookies, analytics and your consent

Cookies are small files a website stores in your browser. We group ours into three categories. Necessary storage keeps the Site and its forms working and is always on. Analytics cookies help us see which pages help visitors. Marketing cookies measure our own advertising and support remarketing.

When you first visit, a banner lets you accept all cookies, reject the non-essential ones, or choose by category. Visitors from regions with opt-in rules (the European Economic Area, the United Kingdom and Switzerland) start with analytics and marketing off until they choose. Visitors elsewhere start with them on and can turn them off at any time. Your choice is stored for twelve months and applied through Google’s consent mode, so Google’s tags set no analytics or advertising cookies while a category is off. You can change your choice at any time using Privacy choices in the footer of every page.

Global Privacy Control: if your browser sends a Global Privacy Control signal, we treat it as a request to opt out of analytics and marketing cookies and apply it automatically. Because there is no common standard for “Do Not Track” signals, we do not respond to them separately from the choices described here.

The Site also uses your browser’s session storage, which is cleared when you close the tab, to keep a chat conversation open while you browse and to open the booking calendar after a form. None of this leaves your browser except as part of a message or form you choose to send.

You can also block or delete cookies in your browser settings, or use Google’s Analytics opt-out browser add-on. The Site works fully with non-essential cookies off.

5. The AI assistant and the free tools

The chat assistant on this Site answers questions about our services. Messages you send are processed by OpenAI to generate replies, under OpenAI’s API terms, which do not allow them to train their models on that data. Please do not share sensitive personal information in the chat. If you share contact details so we can follow up, the conversation summary reaches us the same way a form does, and this policy applies to it. The assistant is automated: its answers are informational and are not a quote or a contract. For a human, call (858) 201-8404.

The marketing checkup and the requests you send through our forms are reviewed by a person and answered through the contact details you provide.

6. Who we share information with

We share personal information only with the service providers needed to run the Site and respond to you. Each processes data on our instructions under its own privacy commitments, and each is in the United States unless noted.

• Vercel hosts the Site and provides cookieless web analytics.
• Resend delivers form submissions and confirmations by email.
• Google provides Google Analytics 4, Google Ads measurement, and the appointment calendar used to book calls.
• OpenAI generates the chat assistant’s replies.
• Cloudflare provides the bot check on our forms.
• Stripe processes client payments.
• Sanity stores the Site’s page and blog content (no visitor data).
• Our own lead dashboard and automation tools receive a copy of each enquiry so we can track and follow up on it.

We may also disclose information when the law requires it, to protect our rights or safety, or as part of a business transfer, in which case this policy continues to apply.

7. Advertising and measurement

We advertise our own services on Google. With marketing cookies allowed, Google Ads measurement lets us see that an enquiry followed one of our ads, and remarketing lets us show our ads to people who visited the Site. We do not run advertising on this Site for anyone else, and we never share your form or chat contents with advertising platforms. Google explains its use of data at How Google uses information from sites that use its services.

8. How long we keep information

• Enquiries and leads: for as long as we may reasonably follow up and for our business records, then deleted or anonymized. If you ask us to delete an enquiry sooner, we do.
• Client records: for the duration of the engagement and as required for tax, accounting and legal purposes.
• Chat conversations: in your browser only until you close the tab; a summary reaches us only if you share contact details.
• Analytics data: under Google Analytics’ retention settings, then aggregated or deleted.
• Server logs: a short period for security and troubleshooting.

9. Your privacy rights

Wherever you are, you can ask us to tell you what personal information we hold about you, correct it, delete it, or stop using it for marketing. Send the request through our contact form or call (858) 201-8404. We will verify that the request comes from you, usually by replying to the email address on file, and respond within the time the law allows. We never treat you differently for exercising a privacy right.

California residents

Under the California Consumer Privacy Act as amended by the California Privacy Rights Act, you have the right to know the categories and specific pieces of personal information we collect, the sources, our purposes, and the categories of third parties we share it with; the right to delete; the right to correct; the right to opt out of the sale or sharing of personal information; the right to limit the use of sensitive personal information; and the right to non-discrimination. We do not sell personal information and do not collect sensitive personal information through the Site. To the extent analytics or advertising cookies could be considered “sharing” for cross-context behavioral advertising, you can opt out with the cookie banner, the Privacy choices link in the footer, or a Global Privacy Control signal, which we honor. You may use an authorized agent to make a request; we will ask for proof of the authorization.

Residents of other US states

If you live in a state with a comprehensive privacy law, such as Colorado, Connecticut, Virginia, Texas or Oregon, you have similar rights to access, correct, delete, and opt out of targeted advertising and sale. Use the same contact methods. If we decline a request, we will explain why and how to appeal.

Visitors in the EEA, the UK and Switzerland

You have the rights of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent at any time without affecting earlier processing. You also have the right to lodge a complaint with your local data protection authority. Because we are in the United States, your information is transferred there; we rely on your consent and on contractual protections with our providers for those transfers.

10. Children

The Site is for businesses and is not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with information, contact us and we will delete it.

11. Security

The Site is served over HTTPS, form submissions travel encrypted, our forms carry a signed security token and a bot check, and access to enquiry information is limited to the people who need it to respond to you. No method of transmission or storage is completely secure, but we take measures appropriate to the sensitivity of the data we handle.

12. Visitors outside the United States

We operate from the United States and our providers process data there. By using the Site from elsewhere, you understand that your information will be transferred to and processed in the United States, where privacy laws may differ from those in your country. The protections in this policy apply wherever the data is processed.

13. Links to other sites

The Site links to client websites, review platforms and other third-party sites, and embeds Google’s appointment calendar. Those sites and services have their own privacy practices, which we do not control.

14. Changes to this policy

We may update this policy from time to time. Changes will be posted on this page with a new effective date, and material changes will be noted prominently or communicated to clients directly.

15. How to contact us

Questions about this policy or about your information? Reach us through the contact form or call (858) 201-8404. Greenflow SEM, San Diego, CA, United States.