Privacy Policy

1. Information We Collect

a. Information You Provide Directly

We collect personal information that you voluntarily provide when you interact with our Site, including:

• Contact form submissions — your name, email address, phone number, company name, and any message content you submit through our contact or inquiry forms (processed via GoHighLevel, our CRM platform).
• Newsletter subscriptions — your email address when you subscribe to receive our marketing communications.
• SMS/text message consent — your phone number and opt-in consent when you agree to receive text messages from us.
• Cookie consent preferences — your choices regarding which categories of cookies you allow on our Site.

b. Information Collected Automatically

When you visit our Site, certain information is collected automatically, including:

• Analytics data — page views, click events, scroll depth, time spent on pages, referring URLs, UTM campaign parameters, and session identifiers.
• Device and browser information — device type, operating system, browser type and version, screen resolution, and viewport dimensions.
• Network information — your IP address is collected and cryptographically hashed before storage. We do not store raw IP addresses.
• Session recordings and heatmaps — Microsoft Clarity may record anonymized user sessions, including mouse movements, clicks, and scrolling behavior. This data collection requires your consent via our cookie banner.

2. SMS/Text Messaging

By opting in to SMS, you agree to receive marketing text messages from Groundwork Studio LLC. Message frequency varies. Message & data rates may apply. Reply STOP to unsubscribe.

a. How We Use SMS Data

When you opt in to receive text messages, we use your phone number solely to send you the SMS communications you have consented to, such as marketing messages, appointment reminders, service updates, and promotional offers. We do not use your phone number or SMS consent data for any purpose unrelated to the messaging program you opted into.

b. SMS Consent Is Not Required for Purchase

Consent to receive SMS/text messages is not a condition of purchasing any goods or services from Groundwork Studio LLC. You may engage our services without opting in to text messaging.

c. How to Opt Out of SMS

You can opt out of receiving text messages at any time by replying STOP, CANCEL, or UNSUBSCRIBE to any message you receive from us. After opting out, you will receive a single confirmation message and will no longer receive text messages from us unless you opt in again. To receive help, reply HELP to any message or contact us at omar@groundworkstudio.co.

d. No Sharing of SMS Data with Third Parties

We do not share, sell, rent, or disclose your phone number, SMS consent, or any data collected through our SMS messaging program with any third parties for their own marketing purposes. Your SMS opt-in information will only be used by Groundwork Studio LLC to deliver the messages you have consented to receive.

3. How We Use Your Information

We use the information we collect for the following purposes:

• To respond to your inquiries — when you submit a contact form or reach out via email or phone, we use your information to respond and follow up.
• To send marketing communications — with your consent, we may send newsletters, updates, and promotional materials. You may opt out at any time.
• To improve our website — we analyze aggregate analytics data to identify usability issues, understand user behavior, and optimize our Site.
• To analyze performance — we monitor page load times, Core Web Vitals, and other technical metrics.
• To generate aggregate reports — we compile anonymized, aggregate data about Site usage trends that do not identify individual users.
• To protect our Site — we use rate limiting, origin validation, and other security measures to prevent abuse.
• To deliver and improve our services — when you engage Groundwork Studio as a client, we use your information to provide, manage, and continuously improve the services described in your service agreement.

3a. Data Processing by Service

When you engage Groundwork Studio for any of our services, the following describes what data is collected, accessed, or processed in connection with each service. This applies to clients only — not to general Site visitors.

Website Design & Development

We collect and process business information you provide (name, address, phone, service area) for inclusion in your website. We may access your domain DNS, Google Analytics, and Google Search Console to deploy and configure your site. Login credentials are stored in encrypted password management and never in plain text.

Search Engine Optimization (SEO)

We access your Google Business Profile, Google Search Console, and Google Analytics 4 to manage your campaign. We process keyword data, ranking data, and competitor analysis — none of which includes personal information about your customers. We access your website CMS to publish landing pages and content.

Google Business Profile & Local SEO

We access your Google Business Profile as a Manager to post updates, respond to Q&A, monitor reviews, and report on profile performance. We do not access your Google account credentials directly — access is granted through Google's official manager system.

Paid Advertising & Local Service Ads

We access your Google Ads, Meta Business Manager, and Local Service Ads accounts as a manager. We view and configure audience targeting, campaign data, and conversion tracking. We install tracking tags on your website. Ad spend flows directly between you and Google/Meta — we never process or hold ad spend funds.

Content Marketing

We access your website CMS to publish blog content. For email campaigns, we access your subscriber list via GoHighLevel to deliver campaigns. Your subscriber list is used solely for campaign delivery and is not shared with third parties.

Reputation Management

We collect and store completed job contact information (name, email, phone) you provide in GoHighLevel for the purpose of sending review request campaigns to your customers. This data is used solely for review request delivery and is not shared with third parties. We also access your Google Business Profile and other review platforms to monitor review activity.

Social Media Marketing

We access your Facebook Business Manager, Instagram Business Account, and LinkedIn Company Page as a manager or editor. We post content, view analytics, and (at the Authority tier) respond to comments and messages on your behalf. We do not access personal social media accounts.

AI Search Optimization (GEO)

We access your website CMS to implement schema markup and content updates. We run queries on publicly accessible AI platforms (ChatGPT, Perplexity, etc.) to monitor brand visibility. No customer personal data is accessed or processed for this service.

Branding & Visual Identity

We collect business information through a discovery questionnaire (business name, service area, target client profile). No customer personal data is accessed or stored for branding projects.

AI Setup & Consulting

We access your CRM, scheduling, and website platforms as a manager to configure automation workflows. AI tools used in your implementation may process customer lead data (name, phone, email, service request) through platforms such as GoHighLevel and Anthropic. We will disclose all platforms used and their data terms before implementation begins.

AI Voice Assistants (upcoming)

When available, this service will process caller phone numbers, call recordings, and caller-provided information (name, service request, address) through the AI voice platform. A separate consent disclosure will be provided to every caller at the start of each AI-handled call. We will update this Privacy Policy to include specific platform details before this service launches.

Shopify Account Management (upcoming)

When available, this service requires a signed Data Processing Addendum (DPA) before engagement. As a data processor, Groundwork Studio accesses your Shopify store — including customer names, email addresses, order history, and shipping data — solely to deliver this service. We never access payment card data (processed by Shopify Payments directly). Customer data is not shared with third parties. We will update this Privacy Policy and execute a DPA before this service launches.

Strategy & Coaching

We collect business information shared during sessions (revenue, goals, market challenges) and store session notes internally for use in ongoing coaching relationships. This information is kept confidential and is not shared with third parties.

4. Third-Party Services

We use the following third-party services that may collect information about you when you visit our Site or communicate with us:

• Google Analytics 4 — website traffic analysis and audience insights. Google Privacy Policy
• Microsoft Clarity — session recordings, heatmaps, and behavioral analytics. Microsoft Privacy Statement
• Vercel Analytics — Core Web Vitals monitoring and real-user performance measurement, processed by Vercel per their privacy policy.
• GoHighLevel — our CRM platform used to process contact form submissions and manage client communications and workflows.
• Resend — our email delivery service for transactional and marketing emails.
• Google Ads and Meta Advertising — we may use Google Ads conversion tracking and Meta (Facebook/Instagram) advertising pixels to measure campaign effectiveness and serve relevant advertisements to users who have visited our Site. These tools may track your online activity across websites. You may opt out of interest-based advertising at aboutads.info or networkadvertising.org.
• Artificial Intelligence Tools— we use third-party AI services (including but not limited to Anthropic Claude and similar platforms) to assist with content creation, data analysis, communications, and service delivery. Information submitted to these tools is subject to those providers' privacy policies. We do not submit your personal information to AI training pipelines without your explicit consent.

We do not sell your personal information to any third party. Each third-party service operates under its own privacy policy; we encourage you to review them.

5. Cookies and Tracking Technologies

Our Site uses cookies and similar tracking technologies. Cookies are small data files placed on your device that help us improve your experience and understand Site usage. You control non-essential cookie placement through our consent banner and your browser settings.

a. Necessary Cookies

These cookies are essential for the Site to function and cannot be disabled. They include session cookies and your cookie consent preferences. No personal data is tracked beyond what is required for basic functionality.

b. Analytics Cookies

With your consent, we set analytics cookies from Google Analytics 4 and our custom analytics system. These cookies help us understand how visitors use our Site, which pages are most popular, and how users navigate. Analytics data is aggregated and does not personally identify you.

c. Marketing and Behavioral Cookies

With your consent, Microsoft Clarity may place cookies on your device to enable session recording and heatmap functionality, helping us understand user behavior and improve our Site design.

d. Advertising and Retargeting Cookies

With your consent, we may use advertising cookies from Google Ads and Meta (Facebook/Instagram) to serve you targeted advertisements after you visit our Site. These technologies — commonly referred to as retargeting or remarketing — allow us to show relevant ads on other websites and platforms based on your prior visit to groundworkstudio.co. These cookies may track your online activity across websites over time. You may opt out of interest-based advertising at aboutads.info or networkadvertising.org. Note that even if you decline advertising cookies on our Site, you may continue to see ads from us on third-party platforms if those platforms serve ads to their own audiences independently.

e. Managing Your Cookie Preferences

When you first visit our Site, a cookie consent banner allows you to accept or decline non-essential cookies by category. You can update your preferences at any time by clicking the cookie settings link in our website footer. You may also configure your browser to refuse cookies, though doing so may affect Site functionality.

6. Data Retention

• Analytics data — retained for up to 26 months from the date of collection, after which it is automatically deleted.
• Contact and CRM data — retained for as long as the business relationship exists or as necessary to fulfill the purposes described in this policy. You may request deletion at any time.
• Newsletter subscription data — retained until you unsubscribe or request deletion.
• Cookie consent preferences — stored locally on your device for 12 months, after which you will be prompted to confirm your preferences again.
• SMS consent records and phone numbers — retained for the duration of your active subscription and for five (5) years thereafter to demonstrate compliance with applicable telecommunications regulations, including TCPA and CTIA guidelines.

7. Your Privacy Rights — California Residents (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) provides you with specific rights regarding your personal information:

• Right to know — you may request disclosure of the personal information we have collected, used, disclosed, and sold about you in the past 12 months.
• Right to delete — you may request deletion of your personal information, subject to certain exceptions.
• Right to correct — you may request correction of inaccurate personal information we maintain about you.
• Right to opt-out of sale or sharing — we do not sell your personal information. We do not share your personal information with third parties for cross-context behavioral advertising without your consent.
• Right to limit use of sensitive personal information — we do not use sensitive personal information beyond what is necessary to provide our services.
• Right to non-discrimination — we will not discriminate against you for exercising any of your privacy rights.

To exercise any of these rights, contact us at omar@groundworkstudio.co. We will respond to verifiable requests within 45 days. We may need to verify your identity before processing your request.

8. EU Residents and International Users (GDPR)

If you are located in the European Union, the European Economic Area (EEA), or the United Kingdom, the General Data Protection Regulation (GDPR) and applicable data protection laws may apply to our processing of your personal information.

a. Legal Basis for Processing

We process your personal information on the following legal bases:

• Consent — for cookies (non-essential), SMS opt-in, and newsletter subscriptions. You may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.
• Legitimate interests — for website analytics, security and fraud prevention, and direct marketing to existing contacts where we have assessed that our interests are not overridden by your rights and freedoms.
• Contractual necessity — where processing is required to fulfill or prepare for a service agreement with you.
• Legal obligation — where processing is required to comply with applicable law.

b. Your GDPR Rights

If GDPR applies to you, you have the following rights, which you may exercise by contacting us at omar@groundworkstudio.co:

• Right of access — to request a copy of the personal information we hold about you.
• Right to rectification — to request correction of inaccurate or incomplete personal information.
• Right to erasure — to request deletion of your personal information, subject to certain exceptions.
• Right to restrict processing — to request that we limit our use of your personal information in certain circumstances.
• Right to data portability — to receive your personal information in a structured, commonly used, machine-readable format and to transmit it to another controller where technically feasible.
• Right to object — to object to processing based on our legitimate interests, including for direct marketing purposes. Where you object to direct marketing, we will cease processing immediately.
• Rights related to automated decision-making — not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects.

We will respond to your request within 30 days. You also have the right to lodge a complaint with your local supervisory authority.

c. International Data Transfers

Groundwork Studio is based in the United States. If you are located outside the United States, your information will be transferred to and processed in the United States, where data protection laws may differ from those in your jurisdiction. For transfers of personal information from the EU/EEA or UK to the United States, we rely on the EU-US Data Privacy Framework (DPF) and/or Standard Contractual Clauses (SCCs) as adopted by the European Commission, to the extent required by applicable law.

9. AI-Assisted Content and Services

Groundwork Studio uses artificial intelligence tools to assist with content creation, data analysis, customer communications, research, and service delivery. This may include blog articles, marketing copy, strategy documents, and automated communications that are drafted or assisted by AI systems.

All AI-assisted content intended for publication or client delivery is reviewed by our team. We do not represent that AI-generated content constitutes advice from a licensed professional (attorney, accountant, financial advisor, or otherwise). Content on our Site is for informational and marketing purposes only and does not constitute professional advice of any kind.

We are committed to responsible AI use. We do not use AI systems to make consequential decisions about individuals without human oversight. We do not submit your personal information to AI model training pipelines without your explicit consent. AI tools we engage are bound by data processing agreements that restrict the use of submitted data.

As our services evolve, we may offer AI-powered voice assistants, automated outreach, and AI-driven account management services. When such services are made available, we will obtain all required consents, clearly disclose that you are interacting with an automated system at the outset of each interaction, and update this Privacy Policy to describe the data collected, how it is used, and how long it is retained.

10. Do Not Track Signals

Our Site respects the Do Not Track (DNT) browser setting. If your browser sends a DNT signal, our custom analytics system will not track your session. Third-party services such as Google Analytics may handle DNT signals according to their own policies, which we do not control.

11. Children's Privacy

Our Site is not directed at children under the age of 13, and we do not knowingly collect personal information from children under 13. If we learn that we have inadvertently collected personal information from a child under 13, we will take steps to delete that information promptly. If you believe we may have collected information from a child under 13, please contact us immediately at omar@groundworkstudio.co.

12. Data Security and Breach Notification

We implement appropriate technical and organizational measures to protect your personal information, including:

• IP addresses are cryptographically hashed before storage — we do not retain raw IP addresses in our analytics systems.
• All connections to our Site are encrypted using HTTPS (TLS 1.2 or higher).
• Sensitive credentials and API keys are stored as environment variables and are never committed to our codebase or exposed to client-side code.
• Administrative access is protected by authenticated sessions with secure, HTTP-only cookies.
• API routes are protected by rate limiting and origin validation to prevent abuse and unauthorized access.

While we implement commercially reasonable security measures, no method of transmission over the Internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

Breach Notification. In the event of a security incident resulting in unauthorized access to, acquisition of, or disclosure of your personal information that creates a reasonable risk of harm, we will notify affected individuals and applicable regulatory authorities as required by applicable law. For Arizona residents, we will provide notification in compliance with Arizona Revised Statutes § 44-7601 (Arizona Data Breach Notification Act) within a commercially reasonable time not to exceed thirty (30) days following our determination that a qualifying breach has occurred and identification of affected individuals, unless law enforcement requests delay. Notification will be delivered via email to the address on file or, where email notification is not practicable, by substitute notice as permitted by law. If you believe your information may have been compromised, please contact us immediately at omar@groundworkstudio.co.

13. Third-Party Links

Our Site may contain links to third-party websites, services, or resources not operated by us. We have no control over the content, privacy policies, or practices of those sites and assume no responsibility for them. The inclusion of any link does not imply endorsement. We encourage you to review the privacy policy of every website you visit.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or applicable law. When we make material changes, we will update the "Last updated" date at the top of this page and, where required by law or where we deem appropriate, provide additional notice such as an in-site notification or email to subscribers. Your continued use of the Site after changes are posted constitutes your acceptance of the revised policy.

15. Contact Us

For questions, concerns, or to exercise your privacy rights, please contact us:

• Email: omar@groundworkstudio.co
• Business: Groundwork Studio LLC
• Location: Tucson, Arizona, United States

We respond to privacy inquiries within 30 days. For verified CCPA or GDPR requests, we will respond within the timeframes required by applicable law.