Privacy Policy

1. Who We Are

This website and the services described in this Privacy Policy are operated by AutomationsHQ ("AutomationsHQ," "we," "us," or "our"), based in New Hampshire, United States. AutomationsHQ is the data controller for personal data described in this Policy.

You can contact us about this Privacy Policy, or about any personal data we hold about you, at Charles@AutomationsHQ.io.

2. Our Role: Controller and Processor

AutomationsHQ acts in two different capacities, depending on whose personal data is involved:

• As a controller: For personal data we collect directly from website visitors, prospects, and consultation applicants (the data described throughout this Privacy Policy), AutomationsHQ is the controller. We decide why and how that data is processed, and this policy governs it.
• As a processor: When we deliver consulting services and, in doing so, access or process personal data contained within a client's own systems, records, or data (for example, a client's customer database or CRM), AutomationsHQ acts only as a processor on that client's behalf and instructions. That processing is governed by the Data Processing Agreement (DPA) between AutomationsHQ and the client, not by this Privacy Policy. If your personal data has been processed by AutomationsHQ in this capacity, please direct requests to the client organization that controls your data; we support our clients in responding to such requests under our DPA with them.

3. Information We Collect

At AutomationsHQ, we collect information in three ways: information you provide directly, information collected automatically through your use of our site, and information from email communications.

Information You Provide

• Name, email, phone, and company when you submit a consultation application
• Responses to diagnostic questions in our consultation form
• Email address when you subscribe to communications
• Any other information you voluntarily provide through forms on our site

Information Collected Automatically

When you visit our site, we automatically collect certain information using privacy-preserving methods:

• Page views: Which pages you visit and when
• Interactions: Button clicks, form interactions, and scroll depth on pages
• UTM attribution: How you arrived at our site (e.g., from a search engine, social media, or email campaign), captured from URL parameters
• Device category: Whether you are using a desktop, mobile, or tablet (no raw user-agent stored)
• Session identifier: A non-reversible hash derived from your IP address and the current date, used to group your activity within a single day (not a cookie)

What we do NOT collect: We do not use cookies for tracking. We do not store raw IP addresses (they are hashed with a daily rotating salt and cannot be reversed). We do not use browser fingerprinting. We do not use third-party tracking scripts (no Google Analytics, Facebook Pixel, etc.).

Email Tracking

When we send you emails (such as consultation follow-ups or reminders), those emails may contain:

• Open tracking pixel: A 1x1 transparent image that notifies us when you open the email
• Click tracking: Links in the email may be routed through our server so we can record which links you click

Email tracking is consent-gated. If you opt out (see Section 9), we immediately stop tracking opens and clicks for your contact record and cancel any pending automated emails.

4. How We Use Your Information

• Respond to your consultation requests and provide requested services
• Schedule and manage appointments
• Send follow-up emails, reminders, and confirmations related to your consultation
• Understand how visitors discover and interact with our site to improve our services
• Attribute consultations to the marketing channels that referred them (UTM analytics)
• Analyze aggregate email performance (open rates, click rates) to improve communications
• Comply with legal obligations

Legal Bases for Processing (GDPR Article 6)

For visitors and prospects located in the EEA, UK, or other jurisdictions that require a stated legal basis, we rely on the following bases for each purpose listed above:

• Responding to consultation requests and providing requested services: Necessary to take steps at your request prior to entering into a contract, and to perform that contract (Article 6(1)(b)).
• Scheduling and managing appointments: Necessary for the performance of a contract, or pre-contractual steps taken at your request (Article 6(1)(b)).
• Follow-up emails, reminders, and confirmations: Necessary to perform the service you requested (Article 6(1)(b)). Tracking whether those emails are opened or clicked relies on your consent (Article 6(1)(a)), which you can withdraw at any time (see Section 9).
• Understanding how visitors discover and interact with our site: Our legitimate interest in maintaining and improving our site (Article 6(1)(f)).
• UTM attribution: Our legitimate interest in understanding which marketing channels are effective (Article 6(1)(f)).
• Aggregate email performance analysis: Our legitimate interest in understanding whether our communications are effective (Article 6(1)(f)).
• Legal compliance: Necessary to comply with a legal obligation to which we are subject (Article 6(1)(c)).

Session-to-Contact Linking

When you submit a form on our site (such as a consultation application), we associate your browsing activity from that session -- including pages visited, buttons clicked, and scroll behavior -- with the contact information you provide. This helps us understand how you discovered our services and allows us to tailor our follow-up.

This linking only occurs for the session in which you submit the form. We do not track your activity across multiple days or browsing sessions. You can request deletion of all linked behavioral data at any time (see Section 9).

5. Data Protection

• Data encryption in transit (TLS 1.3)
• Encrypted data storage at rest
• Access controls and role-based authentication
• Regular security audits and updates
• IP addresses hashed with SHA-256 and daily rotating salt (not reversible)
• Raw tracking events automatically purged after 90 days

6. International Data Transfers

We store and process personal data on servers operated for us by our hosting provider. If you are located in the European Economic Area (EEA), the United Kingdom, or another jurisdiction that restricts transfers of personal data outside its borders, your personal data may be transferred to, stored in, or accessed from a country that has not been recognized as providing an adequate level of data protection, including the United States. When that happens, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, or another legally recognized transfer mechanism, to protect that data.

You may request more information about the safeguards we use for international data transfers by contacting us (see Section 15).

7. Privacy-Focused Analytics

Our analytics system is self-hosted and privacy-first. We do not use any third-party analytics services. Our approach:

• No cookies for tracking or analytics
• No browser fingerprinting
• No cross-site tracking
• No raw IP storage (hashed with daily rotating salt)
• No third-party data sharing
• No advertising pixels or retargeting
• Bot traffic automatically detected and excluded from metrics
• Session identifiers reset daily (not persistent across visits)

8. Cookies and Local Storage

Authentication Cookies (Strictly Necessary)

Our admin portal uses essential cookies to maintain logged-in sessions. These are classified as "strictly necessary" under GDPR and are exempt from consent requirements:

• Access Token (httpOnly, secure): 15-minute session authentication
• Refresh Token (httpOnly, secure): 7-day session renewal
• CSRF Token: Cross-site request forgery protection

All cookies are httpOnly (not accessible to client-side scripts), secure (HTTPS only), and first-party only (not shared with third parties).

Local Storage (UTM Attribution)

When you arrive at our site via a link with UTM parameters (e.g., from a social media post or email campaign), we store the attribution data in your browser's localStorage:

• First-touch attribution: The first campaign source that brought you to our site (retained for 30 days)
• Last-touch attribution: The most recent campaign source (overwritten on each visit with UTM parameters)

This data stays in your browser and is only sent to our server if you submit a consultation form. It is not a cookie and cannot be read by third parties. You can clear it at any time via your browser's developer tools (Application > Local Storage).

No Tracking Cookies

We do not use analytics cookies, advertising cookies, or any third-party cookies.

9. Your Rights

Under GDPR, CCPA, and other applicable privacy regulations, you have the following rights:

• Right to access: Request a copy of all personal data we hold about you
• Right to rectification: Request correction of inaccurate data
• Right to erasure: Request deletion of your personal data, including all behavioral tracking data, email tracking events, and contact records
• Right to object: Object to processing of your data for analytics purposes
• Right to opt-out of email tracking: Click the unsubscribe link in any email to immediately stop all email tracking and cancel pending automated emails
• Right to data portability: Request your data in a machine-readable format
• Right to lodge a complaint: If you are located in the EEA or UK, you have the right to lodge a complaint with your local data protection supervisory authority if you believe our processing of your personal data violates applicable law

California Privacy Rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), gives you the following additional rights:

• Right to know: Request disclosure of the categories and specific pieces of personal information we have collected about you, and the purposes for which we use it
• Right to delete: Request deletion of personal information we have collected from you, subject to certain exceptions
• Right to correct: Request correction of inaccurate personal information we maintain about you
• Right to opt out of sale or sharing: We do not sell, rent, or trade your personal information, and we do not share it for cross-context behavioral advertising (see Section 11). There is currently nothing to opt out of, but you may still submit a request and we will confirm this in writing
• Right to limit use of sensitive personal information: We do not collect sensitive personal information as defined by the CCPA/CPRA beyond what you voluntarily provide through a consultation form, and we use any such information only as necessary to provide the services you requested
• Right to non-discrimination: We will not deny you goods or services, charge you a different price, or provide a different level of service because you exercised any of your CCPA/CPRA rights

How to Exercise Your Rights

• Unsubscribe from emails: Click the "Unsubscribe" link in any email (processed instantly)
• Delete tracking data: Contact us at the address below and we will delete all tracking events, email engagement data, and behavioral data linked to your contact record
• Access or export data: Contact us at the address below

We will respond to all data rights requests within 30 days.

10. Email Communications

We send emails only to contacts who have submitted a consultation form or otherwise opted in to communications. Our emails comply with:

• CAN-SPAM (US): Every email includes an unsubscribe mechanism, honored instantly
• CASL (Canada): Emails sent only with implied consent (you requested a consultation) or express consent
• RFC 8058: One-click unsubscribe via List-Unsubscribe header, supported by Gmail, Yahoo, and other major providers
• GDPR (EU): Email tracking is consent-gated and can be revoked at any time

When you unsubscribe, we immediately: set your tracking consent to "denied," cancel all pending automated emails, and stop recording open/click events for your contact.

11. Third-Party Services

We do not share your personal information with third parties except:

• When required by law or legal process
• With service providers who assist in operating our platform (under strict confidentiality agreements)
• With your explicit consent

We do not sell, rent, or trade your personal information. We do not use third-party analytics, advertising, or tracking services.

12. Data Retention

• Consultation records: Retained for 2 years after your last interaction
• Contact records: Retained until you request deletion
• Raw tracking events: Automatically purged after 90 days
• Aggregated analytics: Retained indefinitely (contains no personal data)
• Email tracking events: Purged after 90 days; aggregated daily stats retained
• UTM attribution data: Retained with your contact record until deletion is requested

13. Children's Privacy

Our services are not directed to individuals under 18 years of age. We do not knowingly collect personal information from children.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the updated policy on this page with a revised "Last updated" date. Continued use of our site after changes constitutes acceptance of the updated policy.

15. Contact Us

If you have questions about this Privacy Policy, wish to exercise your data rights, or want to request deletion of your data, please contact us:

Email: Charles@AutomationsHQ.io
Subject line: Privacy Request - [Your Name]