Web Business Development Privacy Policy

1. Who We Are and What This Policy Covers

Web Business Development ("WBDI," "we," or "us") is a web, search, cloud, and AI consultancy with its office at 1100 Caraway Ln., Las Vegas, NV 89144, USA. This Privacy Policy explains how WBDI handles personal information connected with:

• our website at www.webbusinessdevelopment.com (the "Site");
• emails, calls, and meetings with people who are considering or already using our services; and
• the professional services we provide, including website builds, search and AI visibility work, cloud hosting, automation, and training (the "Services").

"Personal information" means information that identifies a particular person or could reasonably be linked to one. This policy covers the personal information WBDI decides how to use. When we handle personal information inside systems we run for a client, that client's agreement with us controls instead, as Section 8 explains. Websites we link to, including Google's, follow their own policies.

This policy also serves as WBDI's notice at collection for personal information gathered through the Site.

2. Personal Data We Receive

We collect only what we need to reply to you, work with you, and run the Site. Depending on how you interact with us, that can include:

• Contact and identity details: who you are and how to reach you, such as your name, job title, employer, email address, phone number, and company website.
• What you tell us: the topic you pick on the contact form, your message, and anything you share by email, phone, video call, or in person, such as goals, budgets, or details about your current website.
• Client records: proposals, signed agreements, invoices, payment status, project communications, and the names and roles of the people we work with at each client.
• Technical data: IP address, browser and device type, operating system, pages requested, referring page, and the date and time of each visit, gathered automatically by our servers and, when analytics is switched on, by Google Analytics.
• Cookie data: identifiers stored by cookies and similar technologies, described in Section 13.

Where it comes from. Most of it comes straight from you. The rest comes from your browser or device; from services that support the Site, such as the spam score Google reCAPTCHA returns; from people who refer you to us; from public business sources, such as your company's website, when we prepare for a meeting you requested; and from clients who give us access to their systems.

California categories. In the terms the California Consumer Privacy Act uses, these fall under identifiers, customer records, commercial information, professional or employment-related information, and internet or network activity.

Information we do not want. The Site never asks for account passwords, payment card numbers, Social Security or other government ID numbers, health information, or other sensitive personal information, and WBDI does not use any that arrives to infer anything about you. Please leave it out of form messages and emails. If a project truly requires sensitive material, we will arrange a secure way to transfer it first.

3. Contact Form Messages and Email Delivery

The contact form asks for your name, your email address, the topic you need help with, and a message. Your phone number, company name, and website address are optional.

When you press send, the Site first checks the submission with Google reCAPTCHA (Section 4). If the check passes, the Site composes an email containing everything you entered plus the IP address the submission came from, and hands it to Twilio SendGrid, an email delivery service, which delivers it to the mailbox at contact@invertedsoftware.com. SendGrid handles the message on our behalf only to deliver it, and keeps delivery logs for a limited time under the data protection terms that govern the SendGrid account. Twilio's privacy notice covers the information Twilio handles for its own purposes.

Shared mailbox and accounts. That mailbox, and the SendGrid and Google Maps accounts behind the form and the map, are shared with Inverted Software, so Inverted Software can also access the messages you send us by form or email. The reCAPTCHA account that screens the form for spam is WBDI's own.

The Site itself does not save form submissions in a database. The copy we keep is the email in our inbox, handled as Section 15 describes. We include your IP address so we can spot spam and misuse.

If you email or call us instead of using the form, we receive your contact details and whatever you decide to share, and we treat that information the same way.

4. Google reCAPTCHA and Google Maps

Two Google services run on our contact page, and Google plays a different role in each.

Google reCAPTCHA v3

reCAPTCHA protects the contact form from spam and automated abuse without asking you to solve a puzzle. It runs in the background while the contact page is open and analyzes technical signals, such as your IP address, browser and device information, cookies, and how you interact with the page.

When you submit the form, our server sends Google the reCAPTCHA token together with your IP address and receives a score estimating whether a person sent the message. Messages with a low score are not delivered. If that happens to you, please email or call us instead.

Since April 2, 2026, Google has acted as our service provider for reCAPTCHA, the role data protection laws call a processor. Google handles reCAPTCHA data on our behalf, under the Google Cloud terms and data processing addendum that govern the reCAPTCHA account, and only to provide, maintain, and secure the service.

Google Maps

The contact page shows our office on a Google map. To keep the page light, the map loads only when you scroll close to it; older browsers that cannot detect scrolling position load it with the page. Once the map loads, your browser connects to Google, which receives your IP address and standard browser information and may use cookies or similar technology under its own policies. The written address and directions link on that page work without loading the map.

Unlike reCAPTCHA, the map is not run on our behalf. Google decides for itself how to use what it receives through the map, including to provide and improve its products, as the Google Privacy Policy explains.

5. Website Analytics (Google Analytics 4)

WBDI may use Google Analytics 4 ("GA4"), a Google service, to see in aggregate which pages people visit, how they arrive, and where the Site could work better. As of the Last Updated date at the top of this page, GA4 is switched off and no analytics tag loads on the Site. We will update this section before switching it on. When active, GA4 uses first-party cookies and similar technology to record information such as:

• the pages you view and the site or search that referred you;
• your device and browser type;
• your approximate location, which Google derives from your IP address; and
• actions such as clicking or tapping our phone number, email address, or call-to-action buttons, or completing the contact form.

GA4 never receives the content of your form message.

When GA4 runs, we use it for measurement only. We do not turn on Google's advertising features for the Site, such as Google signals or ads personalization, and we do not combine analytics data with your name or email address. You can block analytics cookies in your browser or install Google's Analytics opt-out browser add-on. Google describes its own handling of this data in its explanation of how it uses information from sites that use its services.

6. Server Logs, Hosting, and Page Resources

The Site runs on cloud infrastructure from third-party hosting providers. Like nearly every website, those servers automatically record technical details about each request: IP address, date and time, the page or file requested, the referring page, your browser's user-agent string, and the response the server returned. Our application also logs events such as whether a form submission passed the reCAPTCHA check, with its score. These logs do not contain the text of your message.

We use logs to keep the Site running, diagnose errors, gauge traffic, and detect attacks or abuse. Our hosting providers store them for us under agreements that restrict how they may use the data.

Fonts and code libraries. Pages on the Site load typefaces from Google Fonts, and style sheets, scripts, and icon files from the jsDelivr content delivery network. When your browser fetches those files, the provider receives your IP address and basic browser details, which it handles under its own privacy terms.

7. Why We Use Personal Data and Our Legal Bases

WBDI uses personal information for the purposes below. If you are in the European Economic Area (EEA) or the United Kingdom, the GDPR and UK GDPR require us to name a legal basis for each purpose, so each item lists one.

• Answering inquiries and preparing reviews or proposals you request. Basis: steps you ask us to take before entering a contract, and our legitimate interest in responding to business inquiries.
• Delivering, managing, and billing for Services. Basis: performance of our contract with you or your employer, and legal obligations such as tax and accounting rules.
• Keeping the Site and our systems secure, including filtering spam, preventing fraud, and investigating misuse. Basis: our legitimate interest in security.
• Understanding and improving the Site through server logs and, when it is active, analytics. Basis: legitimate interests, or your consent where the law requires consent for analytics cookies.
• Sharing news about our services. If we send this kind of email, we do so only where the law permits, every message includes a way to unsubscribe, and we honor that choice. Basis: consent, or legitimate interests where the law allows business contacts to be emailed without it.
• Meeting legal duties and protecting rights, including answering lawful requests, enforcing agreements, and establishing or defending legal claims. Basis: legal obligation and legitimate interests.

Where we rely on legitimate interests, we have weighed them against your rights and freedoms, and you can object as Section 16 describes. We will not start using personal information for a new purpose that conflicts with these without telling you first and, where required, asking for your consent.

8. Data We Process for Clients

Much of WBDI's work happens inside systems that belong to our clients: websites and online stores we build or host, forms and analytics we configure, automations we connect to a client's CRM or accounting software, and AI assistants that draw on a client's documents. Those systems often hold personal information about the client's own customers, staff, or visitors.

In that work, the client decides why and how the information is used, and WBDI handles it only to provide the agreed Services, following the client's documented instructions. Privacy laws call WBDI a "processor" under the GDPR and UK GDPR, and a "service provider" or "processor" under U.S. state laws, when it acts in this role. The client agreement and any data processing agreement (DPA) we sign govern this processing; this policy does not.

Under those agreements, WBDI:

• does not sell client data or use it for its own purposes;
• limits access to the people working on the engagement; and
• returns or deletes the data when the work ends, as the agreement directs.

If you are a customer or employee of one of our clients and want to exercise a privacy right, please contact that business directly. If you write to WBDI instead, we will pass your request to the client and help them respond.

9. AI Providers in Client Work

Some engagements use AI models from providers such as OpenAI, Anthropic, Google, or Microsoft, or open-weight models such as Llama and Mistral running in a cloud account or on servers the client controls. When client information passes through those models:

• WBDI never trains or fine-tunes an AI model on client data unless the client gives written permission.
• We choose business plans and settings that keep submitted data out of the provider's model training and that limit how long the provider retains it, wherever the provider offers those options.
• We tell the client which providers an engagement will use, normally in the proposal or statement of work, and we give notice before adding or switching one, so the client can review each provider's terms first.
• Access is limited to the people and systems that need it for the engagement.

Free visibility reviews. To see how AI assistants and search engines describe your business, we enter its name, its website address, and typical customer questions into those public tools. We keep your contact details and the rest of your message out of those prompts.

WBDI does not use the content of contact form messages or inquiry emails to train AI models. We also do not make decisions about website visitors, based solely on automated processing, that produce legal or similarly significant effects. The reCAPTCHA score described in Section 4 only decides whether a form message gets through, and you can always reach us by email or phone.

10. Who Receives Personal Data

WBDI does not rent or trade personal information. We disclose it only in these situations:

• Service providers that handle information for us under contract: Twilio SendGrid for contact form email, Google for reCAPTCHA spam checks and, when it is active, analytics, our cloud hosting providers, and the email, file-sharing, video meeting, project management, accounting, and payment tools we use to run the business. Ask us and we will tell you which providers currently hold your information.
• Inverted Software, which shares the mailbox and the SendGrid and Google Maps accounts the Site relies on, as Section 3 explains, and so can access contact form messages, inquiry emails, and privacy requests emailed to WBDI.
• Google and jsDelivr, which receive technical data when our pages load Google Maps, Google Fonts, or jsDelivr-hosted files, as Sections 4 and 6 describe. They apply their own privacy policies.
• AI model providers used in client engagements, under the safeguards in Section 9.
• Professional advisers, such as lawyers, accountants, and insurers, who owe us confidentiality.
• People you ask us to work with, such as your current web developer, marketing agency, or hosting company.
• Legal and safety reasons: to comply with a law, court order, or lawful government request, or to protect the rights, property, or safety of WBDI, our clients, or others, including when we investigate fraud or a security incident.
• Business changes: if WBDI merges, is acquired, raises financing, or sells some or all of its assets, personal information may pass to the new owner, which must keep honoring this policy for that information.

11. Selling, Sharing, and Targeted Advertising

WBDI does not sell personal information, and it does not share personal information for cross-context behavioral advertising. Here, "sell" and "share" have the meanings given in the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA). Nor do we sell personal information or process it for targeted advertising under the other U.S. state privacy laws. We have not done any of these things in the last 12 months.

Since WBDI sells and shares no one's personal information, it has no actual knowledge of selling or sharing information about consumers under 16. The Site carries no advertising, retargeting pixels, or social media tracking tags.

12. Nevada Residents

Nevada Revised Statutes Chapter 603A gives Nevada consumers the right to direct the operator of a website not to sell covered information the operator has collected about them. WBDI does not sell covered information as that law defines it. You may still submit an opt-out request by emailing contact@invertedsoftware.com with "Nevada Opt-Out" in the subject line. We will verify the request, keep a record of it, and reply within the time the statute allows.

13. Cookies, Global Privacy Control, and Other Signals

Cookies are small text files a website asks your browser to store. The Site keeps them to a minimum:

• Necessary cookies set by the Site: a security cookie that protects the contact form against cross-site request forgery, and a short-lived cookie that tells the thank-you page a message was just sent. Neither follows you to other websites.
• Google reCAPTCHA uses cookies and similar technology on Google's own domains to tell people from bots while the contact page is open.
• Google Maps may use cookies or browser storage once the map on the contact page loads.
• Analytics cookies, first-party cookies whose names begin with "_ga," are set only if GA4 is switched on. Before that happens, we will add a way for visitors in the EEA, the UK, and anywhere else the law requires consent to accept or refuse them.

The Site does not set advertising cookies or any cookie that tracks you across other websites. You can block or delete cookies in your browser settings. Blocking necessary cookies may stop the contact form from working; if it does, you can email us instead.

Tracking by other companies. Google, which provides reCAPTCHA, Google Maps, and Google Fonts on our pages, may be able to connect the technical data it receives with your activity on other websites that use its services, as its own terms describe. No advertising network or social media platform collects that kind of information through the Site.

Global Privacy Control. If your browser or a browser extension sends a Global Privacy Control (GPC) signal, WBDI honors it as your choice to say no to selling, sharing, and targeted advertising, both for that browser and for any record we can reasonably link to it. Since we do none of those things, the Site looks and works the same, but the preference is respected and you do not need to take any further step.

Do Not Track. Browser "Do Not Track" settings have no agreed meaning, so the Site does not change its behavior when it receives one.

14. How We Protect Personal Data

WBDI protects personal information with technical and organizational measures that fit the sensitivity of the data, including:

• HTTPS encryption on every page of the Site, enforced with HTTP Strict Transport Security;
• multi-factor authentication on email, hosting, and administrative accounts;
• regular software updates and security patches for the servers and applications we manage;
• access to inquiries and client data limited to people who need it for their work and who are bound to keep it confidential;
• service providers whose contracts or published terms include security and confidentiality commitments; and
• monitoring for suspicious activity, and a defined process for responding to incidents.

No website, email system, or cloud service can be made perfectly secure, so WBDI cannot promise that information will never be accessed without permission. If a security incident affects personal information we control, we will notify affected people and regulators when and as the law requires. For client data, we notify the client as its agreement specifies, so it can meet its own obligations.

Passwords, API keys, and other credentials do not belong in the contact form or in ordinary email. When a project needs access to one of your accounts, we will set up a safer route, such as adding WBDI as a user with its own login.

15. How Long We Keep Personal Data

WBDI keeps personal information only as long as it serves the purpose it was collected for, plus any period the law requires. The right period depends on the type of record, so we apply these criteria:

• Inquiries that do not become projects: kept while the conversation is active and for a reasonable follow-up period, then deleted during periodic reviews of our inbox.
• Client and billing records: kept for the length of the relationship and afterward for as long as tax, accounting, and legal record-keeping rules and limitation periods require.
• Server and security logs: kept for short periods suited to troubleshooting and security, and longer only when needed to investigate a specific incident.
• Analytics data: kept according to the retention setting chosen in Google Analytics, after which Google deletes the visit-level data.
• Data processed for a client: kept for the period the client agreement sets, then returned or deleted as that agreement directs.
• Privacy requests and opt-outs: kept as long as needed to honor them and to show that we complied with the law.

We may keep information longer when the law requires it or when it is needed to resolve a dispute or defend a legal claim.

16. Your Rights Under U.S. State Laws, the GDPR, and the UK GDPR

Many U.S. states, including California, now have consumer privacy laws, and people in the EEA and the United Kingdom have rights under the GDPR and UK GDPR. Depending on where you live, these laws may give you some or all of these rights:

• Access: ask whether WBDI holds personal information about you and get a copy, along with where it came from, why we use it, and who receives it.
• Correction: ask us to fix information that is wrong or incomplete.
• Deletion: ask us to erase information, unless we must keep it to meet a legal duty, complete a transaction you asked for, or defend a claim.
• Portability: receive the information you gave us in a commonly used electronic format that you can move elsewhere.
• Opt-outs: opt out of the sale of personal information, targeted advertising, and profiling used for decisions that produce legal or similarly significant effects. WBDI does none of these, but you may still ask.
• Restriction and objection (GDPR and UK GDPR): ask us to limit how we use your information in certain situations, or object to uses based on our legitimate interests, including direct marketing.
• Withdrawing consent: where we rely on consent, you can withdraw it whenever you like. Doing so does not affect anything that happened before.
• Equal treatment: WBDI will not deny you service, charge you a different price, or give you lower quality because you used a privacy right.
• Complaints: you can complain to your state attorney general and, in California, contact the California Privacy Protection Agency. In the EEA or the UK, you can complain to the data protection authority where you live or work; in the UK, that is the Information Commissioner's Office.

Some rights have exceptions, for example when a request would reveal another person's information or when the law requires us to keep a record. If we cannot fully meet a request, we will tell you why.

17. Making a Request or an Appeal

To use any of these rights, email contact@invertedsoftware.com with "Privacy Rights Request" in the subject line, call +1 (818) 262-8552, or send a letter to our office (Section 21). Please name the right you want to use and the name, email address, or phone number we should search for.

• Verification: before we share or delete anything, we confirm the request came from you, usually by replying to the email address in our records or by matching details you provide. We use verification details only to confirm your identity and prevent fraud.
• Authorized agents: someone you choose may make a request for you with your signed permission or a valid power of attorney. We may still confirm your identity with you directly.
• Timing: we respond within the time the law that applies to you allows. Under most U.S. state privacy laws that is 45 days, which can be extended once when reasonably necessary; under the GDPR and UK GDPR it is one month, which can be extended for complex requests. If we need more time, we will tell you why.
• Cost: requests are free. If a request is plainly unfounded, repetitive, or excessive, we may decline it or charge a reasonable fee where the law allows, and we will explain our decision.
• Appeals: if WBDI turns down your request and your state gives you a right to appeal, reply to our decision with "Appeal of Privacy Decision" in the subject line. We will review the appeal and send a written answer with our reasons within the time your state's law allows. If we deny the appeal, we will explain how to contact your state attorney general.

Requests about information WBDI processes for a client are handled as Section 8 explains.

18. Children and Teens

The Site and Services are meant for businesses and adults, and the Site is not directed to anyone under 18. WBDI does not knowingly gather personal information from children under 13. If a parent or guardian thinks a child has sent us personal information, please contact us and we will delete it.

19. Processing in the United States

WBDI is a U.S. company. The Site, our business systems, and most of our service providers store and process information in the United States. If you contact us from another country, your information will be transferred to and handled in the U.S., where privacy laws may differ from those where you live.

When the GDPR or UK GDPR requires a safeguard for personal information leaving the EEA or the United Kingdom, WBDI relies on an appropriate mechanism, such as Standard Contractual Clauses adopted by the European Commission, the International Data Transfer Addendum issued by the UK Information Commissioner, or a provider's certification under the EU-U.S. Data Privacy Framework and its UK Extension. You can ask us which safeguard applies to a particular transfer.

20. Updates to This Policy

WBDI will revise this policy when our services, providers, or legal requirements change. The current version always appears on this page, and the "Last Updated" date at the top shows when it last changed. If a change materially affects how we use personal information you have already given us, we will give notice in a prominent way, such as a notice on the Site or an email, before the change applies to that information, and we will ask for consent where the law requires it.

21. Questions and Contact Details

For questions about this policy or WBDI's privacy practices, or to use any of the rights above, contact:

• Mail: Web Business Development (WBDI), 1100 Caraway Ln., Las Vegas, NV 89144, USA
• Email: contact@invertedsoftware.com
• Phone: +1 (818) 262-8552
• Hours: Monday to Friday, 9 AM to 5 PM Pacific

The rules for using the Site and working with WBDI are in our Terms of Service.