Privacy
Privacy Policy
What we collect, why we collect it, and the choices you have. Written to be read, not to hide behind.
Effective date: September 18, 2026. Last updated: September 18, 2026.
This policy explains how PostFound ("we", "us"), a web design and local SEO business in Chino Hills, California, handles information about people who visit our website or get in touch with us. If anything here is unclear, email us at hello@postfound.com and we will explain it plainly.
Notice at collection
This is the short version, in the shape California law asks for: what we collect, where it comes from, why, and how long we keep it. We do not sell personal information, we do not share it for cross-context behavioral advertising, and we do not collect sensitive personal information.
| Category | Examples | Where it comes from | Why we collect it | How long we keep it |
|---|---|---|---|---|
| Identifiers | Name, email address, phone number, business name, website address, IP address, the Google Ads click identifier from the link you arrived on, the Google Analytics client id from your browser | You, your browser, Google (the click identifier), Cloudflare (the IP address) | To reply and schedule, to prevent spam and abuse, to measure whether our ads work | Form details: 24 months, unless you become a client. IP address stored with a form: 90 days |
| Commercial information | The service you asked about, an appointment time, notes you add | You | To reply and to schedule the call | 24 months, unless you become a client |
| Internet activity | Pages viewed, the site or search that referred you, browser and device type; on an ad landing page, how long the page stayed open and how many times you scrolled, tapped or typed | Your browser, our hosting provider | To see which pages help visitors, to measure our ads, to detect invalid ad clicks | Ad landing log: 90 days. Analytics: see the retention section below |
| Approximate location | City and region derived from your IP address (never a precise location) | Cloudflare, our hosting provider | Visit notifications to the owner, invalid-click detection | Notification chat: kept until cleared, at most a few months. Ad landing log: 90 days |
| Inferences | An automated-traffic score our hosting provider assigns to a visit on an ad landing page | Cloudflare | Invalid-click detection | 90 days |
Information you give us
When you submit a form, request an audit, or schedule a call, we collect what you type into it. Depending on the form, that can include your name, business name, email address, phone number, website address, the type of business you run, what you are looking to improve, and any message or appointment details you provide. We ask only for what we need to reply to you and prepare for a conversation. If you give us a website address, we may fetch and review that site to prepare for the call, and for the law firm audit we run an automated review of it as soon as you submit the form.
Information collected automatically
When you visit the site, our hosting provider records standard technical information: your IP address, the pages you request, the site or search that referred you, and general details about your browser and device. Our providers derive an approximate location, such as city and region, from your IP address. We use this to keep the site working and to detect and limit spam and abuse.
When you submit one of our forms, we store your IP address with it to prevent spam and abuse (the booking dialog stores none). It is removed after 90 days.
When you arrive from a Google ad, we record the click identifier from the link, your IP address, the network your connection belongs to, your approximate city and region, your browser type, an automated-traffic score from our hosting provider, how long the page stays open and how many times you scroll, tap or type. We use this only to detect invalid or fraudulent ad clicks, to exclude those sources from our ads, and to document refund requests to Google. It runs on the ad landing pages regardless of your cookie choice, because the clicks it catches are not made by people who consent to anything, and it is deleted after 90 days.
While measurement is on (see the next section), a visit to any page sends the page, the referring site and your approximate city and region to the owner as an instant notification, so we know when the site is being read. Nothing in that message identifies you, and the messages are cleared from the notification chat within a few months.
Cookies and similar technologies
| Name | Set by | What it does | Lasts |
|---|---|---|---|
| pf_consent | This site | Remembers your cookie choice (necessary) | 12 months |
| pf_click | This site | Stores the Google Ads click identifier from the link you arrived on, so a later inquiry can be matched to that ad (ad measurement) | 90 days |
| _ga, _ga_* | Google Analytics | Tells visits and sessions apart (analytics) | Up to 2 years |
| _gcl_* | Google Ads | Conversion measurement (ad measurement) | 90 days |
| ph_* | PostHog | Product analytics: which pages and buttons are used (analytics). We do not record your session. | Up to 1 year |
| pf-call-booked | This site (browser storage) | Remembers that you booked a call so we stop asking (necessary) | Until the call |
| pf_visit | This site (session storage) | One visit notification per visit, not one per page | Until you close the tab |
In the United States, analytics and ad measurement run unless you turn them off. Turning them off takes one click: "Reject" on the notice you see on your first visit, or "Cookie settings" at the bottom of every page. Turning them off stops Google Analytics, Google Ads measurement and PostHog, and removes the cookies they set. We treat a Global Privacy Control signal from your browser the same way, without asking. Your choice is kept for 12 months, then we ask again.
In the United Kingdom and the European Economic Area we ask before any analytics or ad measurement cookie is set and nothing loads until you choose. Most browsers also let you block or delete cookies yourself.
Google Ads and conversion measurement
When you submit a form or book a call with measurement on, we tell Google Ads and Google Analytics that a conversion happened, so we can see which ads bring real inquiries. With Google's enhanced conversions, a hashed (SHA-256) copy of the email address or phone number you entered is sent to Google so it can match the conversion to the ad click. Under Google's advertising data terms it may use that copy only to provide measurement to us, not to build advertising profiles of you or to share it with other advertisers. We use no remarketing and no personalized advertising. Our own server also reports the conversion directly to Google, with measurement on, so that an ad blocker does not hide a real lead from us; with measurement off, it sends nothing.
How we use your information
- To respond to your inquiry and schedule or prepare for calls.
- To provide, deliver, and improve the services you ask us about.
- To understand how the site is used so we can make it better.
- To measure whether our advertising works.
- To detect invalid clicks on our ads and to document them to Google.
- To notify the owner instantly of a new inquiry, a booking, and, with measurement on, a visit.
- To protect the site against spam, abuse, and security problems.
- To meet legal, accounting, and record-keeping obligations.
We do not sell or rent your personal information, and we do not share it for cross-context behavioral advertising. We will not add you to a marketing list from a form submission without telling you.
Calls and text messages
When you give us a phone number on one of our forms, you agree that we may call, text, or email you about the request you submitted. We use your number to reply to that request and to arrange a call, not for marketing campaigns, and it is never shared or sold for anyone else to contact you. Mobile phone numbers and text-message consent are never shared with third parties or affiliates for marketing purposes.
Message and data rates may apply, and message frequency varies. Reply STOP to any text to stop receiving them, or HELP for help. You can also ask us to stop calling or texting at any time by emailing hello@postfound.com. Consent to be contacted about your request is never a condition of buying anything from us, and any consent to marketing texts would be separate, optional, and asked for on its own.
Who receives it
We share information with a small number of providers who operate parts of our business on our behalf, and only so they can provide those services to us:
- Cloudflare hosts the website, delivers our notification email, protects it from abuse, and derives the approximate location and automated-traffic score described above.
- Turso hosts the database that stores inquiries, bookings and the ad landing log.
- Google LLC provides Google Analytics, Google Tag Manager and Google Ads measurement, with measurement on.
- PostHog, Inc. provides product analytics, with measurement on. Its servers are in the United States.
- Telegram delivers the instant notifications to the owner: new inquiries and bookings, and, with measurement on, visits. Those messages are cleared within a few months.
- Our email provider, which holds the notification copies of inquiries and bookings.
Some of these providers store data outside the United States. We may also disclose information if the law requires it, or to protect our rights, safety, or property. Google and PostHog may collect information about your activity on this site through their cookies; we do not permit them to use it to follow you across other sites for advertising.
How long we keep it
| What | How long |
|---|---|
| Inquiries and bookings that did not become a client | 24 months, then the personal details are removed from the record |
| Client records | For the engagement and the record-keeping period that follows it |
| IP address stored with a form | 90 days |
| Ad landing log (invalid-click detection) | 90 days |
| Notification messages | Cleared from the notification chat within a few months; email copies with the inquiry |
| Google Analytics | Event data for the property's retention setting, at most 14 months |
| PostHog | The provider's retention setting for our project |
| Backups | Our database provider's rolling backups, which age out on their schedule |
You can ask us to delete your information sooner; see your rights below.
How we protect it
We take reasonable technical and organizational measures to protect the information we hold, including encrypted connections and access limited to the people who need it. No website or system can be guaranteed completely secure, so we cannot promise absolute security, but we take it seriously and act quickly if something looks wrong.
Your choices and rights
You can ask us for a copy of the information we hold about you, ask us to correct or delete it, or ask us to stop using it. If you live in California you have, in particular, the right to know what we collect and why, the right to delete, the right to correct, the right to opt out of any sale or sharing (we do neither, and the cookie controls above switch measurement off), and the right not to be treated differently for exercising these rights. If you are in the United Kingdom or the European Economic Area, the General Data Protection Regulation gives you similar rights.
To make a request, email hello@postfound.com or call (909) 579-2627. We respond within 45 days. We may verify that the request comes from you by replying to the email address or phone number you gave us, and we will not treat you differently for asking. Someone you authorize may make a request for you if they can show that authorization.
Do Not Track and Global Privacy Control
We honor Global Privacy Control signals as a request to turn off analytics and ad measurement in that browser, without asking. We do not respond to the older "Do Not Track" browser setting, which has no agreed meaning.
Children
Our website and services are meant for businesses and are not directed to children under 13. We do not knowingly collect information from children. If you believe a child has given us information, contact us and we will delete it.
Links to other sites
Our site may link to websites we do not control. This policy does not cover those sites, and we are not responsible for their privacy practices.
Changes to this policy
We may update this policy as our business or the law changes. When we do, we update the dates at the top of this page, and for a material change we post a notice on this page for 30 days.
Contact us
Questions, requests, or complaints about privacy can go to hello@postfound.com or (909) 579-2627. We reply within one business day.