Privacy Policy

Information we collect

Two kinds: what you type, and what your browser sends on its own.

What you give us

The Lead System Audit form is the only place on this site that collects personal information. It asks for:

• Required: your name, your email address, and your current website
• Optional: business name, business type, phone number, primary market, which partnership you are interested in, and a message

The optional fields are genuinely optional — leaving them blank does not stop the form from submitting or change how we respond.

Your submission also carries a note about how you found us: the page on this site your visit started on, the site that referred you here (if any), and any campaign tags that were part of the link you clicked. It travels with your inquiry so we know which of our marketing actually brought you — it is not used to build a profile of you, and it goes nowhere except the same inbox as the rest of your submission.

That note is captured by a short script and held in your browser's session storage — not a cookie, and it clears when you close the tab — until you submit the form. If you arrived through a Google Ads click, it also includes Google's ad-click identifier (gclid). We capture that now so a submitted lead can eventually be matched back to the ad that produced it; that matching is not built yet, and nothing is sent to Google or any advertising account as a result of capturing it.

The form also contains one hidden field that no person can see or fill in. It exists to catch automated spam. If it is filled in, the submission is discarded and nothing is stored or emailed.

What your browser sends

Loading any page sends technical information to our host, Cloudflare, as part of delivering the page: your IP address, browser type and version, device type, the page you requested, and the referring URL. We do not combine this with form submissions or use it to build a profile of you.

When you submit the audit form, your IP address is briefly used to enforce a rate limit — a counter that blocks a single connection from flooding the form. That counter is stored for 15 minutes and then deleted automatically.

What analytics records

We use Google Analytics 4, loaded through Google Tag Manager, to understand how the site is used. It records the pages you view and in what order, the site or search that referred you (including campaign tags in the URL), your approximate location at city or region level, your browser and device type, how far down a page you scroll, and a short list of actions: clicking a link to another site, opening one of our proof PDFs, starting the audit form, submitting it successfully, and clicking a phone number, email address, or "request an audit" button. It records that the form was submitted, not what you typed — form contents go only to our inbox as described above.

Google Analytics 4 does not log or store your IP address; Google uses it momentarily to derive that approximate location and then discards it. Google Signals is switched off, so this data is not associated with a Google account. No Google Ads account is linked to this property, so nothing described here currently reaches an advertising account or builds an advertising profile of you. Analytics’ ads-personalization setting is turned on at the property level — a setting that only does anything once an advertising account is linked — because we expect to link a Google Ads account down the road; if we do, this section will be updated to say what that changes. There is no advertising pixel and no session recording on this site.

How we use it

Everything you submit is used for a short, specific list of things:

• Answering you. A form submission goes to our inbox, and Wes reviews your site before replying so the conversation is useful rather than discovery.
• Running your audit. We look at the website you gave us, its performance, its property search, its lead capture, and its search visibility, and write up what we find.
• Confirming receipt. An automated email tells you the submission arrived, so you are not left wondering.
• Keeping the site up and secure. Our host's logs help diagnose errors and block abuse.

We do not sell your personal information, and we never have. We do not share it with marketers, data brokers, or advertising networks, and we do not add you to a mailing list you did not ask for. We do not use it to train any machine learning model.

Calls, texts, and email

If you give us a phone number on the audit form, you are telling us we may call or text you about that request. That is the whole scope of it: a conversation about the audit you asked for. Standard message and data rates from your carrier may apply.

We do not run an SMS marketing program, an automated dialer, or a drip campaign, and we do not put your number on a list for later. To stop hearing from us, reply STOP to a text, say so on a call, or emailwes@engineflowlabs.com — any of the three works, and none of them requires a reason.

Leaving the phone field blank is a complete answer. We will reply by email instead.

Service providers

Three companies process data on our behalf in the course of running this site. This is the complete list, not a representative sample:

• Cloudflare — hosting, content delivery, and DNS. Cloudflare receives the IP address and request headers of every visit, and stores the short-lived form rate-limit counter described above.
• Resend — delivery of the two transactional emails the audit form sends: the notification to us and the confirmation to you. Resend processes the contents of those emails, which include what you entered on the form.
• Google Analytics and Google Tag Manager — the usage measurement described under "What analytics records." Tag Manager is the loader; Analytics is the only tool it loads. Google processes this data on our behalf under its standard analytics terms.
• Cloudflare Stream — hosts the video clips embedded in some Insights posts, at a Cloudflare address dedicated to our video library and separate from the address that serves the rest of this site. A post with a video shows its thumbnail automatically; loading it sends your IP address and request headers to Cloudflare Stream, the same way any image request does. The player itself loads only if you press play, which sends the same information again and starts playback. Cloudflare states publicly that its Stream player does not use cookies for tracking.

Each of these companies has its own privacy policy governing what it does with data on its end. We give each one only what it needs to do its job.

Cookies and other storage

Google Analytics sets two first-party cookies — _ga and _ga_* — that hold a random identifier so repeat visits from the same browser are counted as one visitor rather than many. They last up to two years, are readable only by this site, and are not used for advertising. No other analytics, advertising, preference, or session cookies are set by us.

Outside our code, Cloudflare may set a strictly necessary cookie as part of protecting the site from bots and attacks. It is used for security, not to track you across sites, and it cannot be used to identify you to us.

Session storage. Separately from cookies, we use your browser's session storage to briefly hold the how-you-found-us note described under "Information we collect" above — the landing page, referrer, campaign tags, and Google ad-click identifier (gclid) if present. It never leaves your browser except as part of a form submission you choose to send, and it clears automatically when you close the tab.

Opting out. This site is built for real estate businesses in the United States and does not show a cookie banner. If you would rather not be measured, Google'sAnalytics opt-out browser add-on blocks Google Analytics everywhere, and any content blocker that filters googletagmanager.com stops the measurement script from loading here at all. The site works identically either way.

If we add any other tag, pixel, or cookie, this section will name it and what it records before it goes live.

Data on client websites

This policy covers engineflowlabs.com only. Websites we build and operate for our clients are governed by that client's privacy policy, not this one.

On a client's website we act as a service provider to the client: we configure the forms, analytics, and lead routing that the client owns, and we do not use that client's leads or visitor data for our own marketing, sell it, share it with other clients, or take it with us when an engagement ends. If you submitted a form on a real estate website we built and want your information removed, the fastest route is to contact that brokerage directly — though you can also email us and we will pass it on.

How long we keep it

• Audit requests that do not become a working relationship — up to 24 months from our last contact with you, then deleted. Real estate decisions have long timelines and a broker who is not ready in March is often ready the following year; 24 months is the outer bound of that being useful, not an indefinite hold.
• Clients and prospective clients in an active conversation — for the duration of the relationship, plus the period we need to keep ordinary business and tax records afterward.
• Email delivery logs and host logs — kept for whatever window Resend and Cloudflare apply as part of their own services. We do not extend those windows or export them.
• Form rate-limit counters — 15 minutes, deleted automatically.
• Analytics event data tied to a visitor identifier — 14 months in Google Analytics, then deleted automatically; aggregated reports persist without the identifier.

Ask us to delete your information sooner and we will. See below.

Your rights

Depending on where you live, you may have the right to:

• Get a copy of the personal information we hold about you
• Correct anything inaccurate or incomplete
• Have it deleted
• Opt out of your personal information being sold or shared for cross-context behavioral advertising — we do not do either, but the right to ask exists
• Have an authorized agent make a request for you

These rights are established by law for residents of California (CCPA/CPRA), Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), and a growing number of other states. We honor reasonable access, correction, and deletion requests from anyone who asks, regardless of where they live, because drawing a line at a state border would be a strange way to treat people.

Email wes@engineflowlabs.com with "Privacy Request" in the subject line. We will confirm you are who you say you are — so we are not handing your information to someone else — and respond within the time the applicable law allows, and usually a good deal sooner.

Children's privacy

This site is aimed at real estate business owners and is not directed to children. We do not knowingly collect personal information from anyone under 13. If you believe a child submitted information through our form, emailwes@engineflowlabs.com and we will delete it.

Data security

Practical measures, described plainly:

• The entire site is served over HTTPS, so what you submit is encrypted in transit.
• Form input is validated and length-limited on the server, not only in the browser.
• The form is rate-limited and screened for automated spam.
• API credentials are stored as secrets in our host's dashboard, never in the codebase.
• Access to submissions is limited to EngineFlow Labs personnel who need it — today, that is one person.

No system connected to the internet is perfectly secure, and we are not going to tell you otherwise. If you have reason to think your information reached the wrong place, tell us atwes@engineflowlabs.com and we will act on it.

Accessibility

We build to the Web Content Accessibility Guidelines (WCAG) 2.2, Level AA, and this site is held to the same standard we sell. In practice that means semantic structure, a real label on every form field, visible keyboard focus, touch targets of at least 44 pixels, and contrast ratios we calculate rather than eyeball. We verify by keyboard and with a screen reader on real devices, because automated scans catch only a fraction of what actually breaks for people.

What we do not claim: that this site is "ADA compliant." Legal compliance is a determination for a court, not a vendor, and accessibility work is never finished — the honest statement is the standard we build to, the method we verify it with, and an open line for the things we miss. We also do not install accessibility overlay widgets, here or on client sites.

If any part of this site is difficult or impossible for you to use, or you want information from it in a different format, contact us and we will get you what you need and fix what caused it:

Changes to this policy

We will update this policy when what we actually do changes — a new vendor, a new tool, a change in the law. Material changes come with a new "Last updated" date at the top of this page. We are not going to quietly broaden it and hope nobody rereads it.

Contact

Questions about this policy, or want to make a privacy request?