Privacy policy

Last updated 28 October 2026

Who we are

Guzman Digital is a founder-led digital marketing practice based in California, providing services to local businesses. In this policy, “we” and “us” mean Guzman Digital. For anything in this policy, contact [email protected] or call (760) 917-3197.

What we collect

Information you give us. The contact form asks for your first and last name, email address, phone number, company name, type of business, what you need help with, and an optional message. All of it is submitted by you, deliberately.

Information collected automatically. Our host records standard server logs — IP address, browser type, pages requested, and timestamps — for security and reliability. We do not use these to build a profile of you. When you submit the contact form, your IP address is also used briefly to check the submission is not automated and to limit how many times the form can be sent from one address in an hour. It is not stored beyond that. To stop the form being used to send one person repeated confirmation emails, we also keep a one-way fingerprint of your email address (not the address itself) for 24 hours, after which it is deleted automatically.

Privacy-friendly traffic counting. We use Cloudflare Web Analytics to count page views and measure how quickly pages load. It sets no cookies, uses no device fingerprinting, and does not follow you across other sites. It runs whether or not you accept cookies, because there is nothing stored on your device to consent to.

Cookies, only if you accept. If you accept cookies, Google Analytics sets them to count visits and tell returning visitors from new ones. If you decline, or ignore the banner, analytics runs in a cookieless mode that records nothing identifying. We do not use advertising pixels, retargeting, or cross-site tracking of any kind.

Why we use it

• To reply to your inquiry and prepare the snapshot for your call
• To send you one automatic email confirming your inquiry arrived
• To follow up about that inquiry if you asked us to
• To keep the site working and defend it against abuse

We do not add you to a marketing list because you filled in the contact form. If we ever offer a newsletter it will be a separate, explicit opt-in.

Who else sees it

We do not sell, rent, or trade personal information. We share it only with the services required to run the site:

• Cloudflare Web Analytics — counts page views and page speed. Cookieless, with no fingerprinting and no cross-site tracking. Cloudflare states it does not use this data to track individuals.
• Cloudflare — hosting, content delivery, and the code that receives the contact form. Processes server logs, handles security filtering, and where enabled runs the bot check on the form and the short-lived per-address request counter described above. The bot check sees your IP address and sets no tracking cookie.
• Google Fonts — typefaces load from Google's servers, which means your IP address is visible to Google when a page loads. No cookie is set by this.
• Google Analytics — if you accept cookies, Google receives your IP address (truncated), pages viewed, approximate location, device and browser. We use it to understand which pages are useful. We have not enabled advertising features, so this data is not used to build advertising profiles.
• Resend — delivers your submission to our inbox as an email, and sends you one automatic email confirming it arrived. It is a transactional email provider, not a form service: it passes the message on rather than keeping a searchable store of inquiries for us to browse.
• Email — we read and reply to inquiries in Gmail, so Google processes the message contents as our email provider.

We may also disclose information where we are legally required to.

Our client dashboard

Clients who hire us get a private dashboard at dashboard.guzmandigital.com that shows how their marketing is performing. Everything in this section is about that dashboard, not this website. We run it on the client’s behalf, so for the client’s own customers the client decides what is collected and we process it for them.

Google user data. With the client’s permission, the dashboard connects to Google services through Google’s official APIs — signed in as our agency’s Google account, except for Google Calendar, which the client connects with their own:

• Google Ads — read-only access to each client’s ad account linked to our manager account: campaign names and daily cost, clicks and impressions. We use it only to show the client what their advertising cost and what it brought in. We do not create, change or pause campaigns through the dashboard.
• Google Business Profile — for clients who add us as a manager of their profile: their Google reviews (reviewer name as shown on Google, star rating, review text and date, and the business’s reply), so the client can see and track their reviews in one place.
• Google Calendar — for clients who connect their calendar from the dashboard: the events on that calendar (title, time, location and notes) for the week they are viewing, read live from Google and not stored by us, so they can see their schedule next to their calls and jobs. When the client books or removes an appointment in the dashboard, we create or delete that event on their calendar. We keep only the sign-in Google gives us and the email address of the connected account, and we do not touch calendar settings, sharing or other Google data.

We do not sell Google user data, use it for advertising, or use it to train artificial intelligence models. Google user data, including calendar events, is never sent to Anthropic or any other artificial intelligence service; AI is used only to summarize our own phone-call transcripts. It is shown only to the client it belongs to and to us, and is shared with nobody else except the hosting providers listed below, which store it for us. People are allowed to read it only when that is needed to support the client, for security, or to meet the law. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Other information in the dashboard. To report on calls and leads, the dashboard also holds the client’s call records (caller phone number, time, duration, which ad or listing the call came from, and, only if the client chooses recording in writing, the recording, a transcript and a short summary — callers hear a notice at the start of each recorded call that it may be recorded and transcribed), the texts sent from their tracking numbers (such as the reply to a missed call), their leads and jobs from the CRM we run for them (HighLevel), and their ad results from Meta (Facebook and Instagram).

Services the dashboard uses. Supabase (database and sign-in), Vercel (hosting), Twilio (phone numbers, call tracking and text messages, plus recording and transcription for clients who choose recording), HighLevel (leads and jobs), Resend (email alerts and reports), Local Falcon (local search rankings) and Anthropic (writing call summaries from transcripts, for clients with recording on; Anthropic does not train its models on this data). Each receives only what it needs to do its job.

How long we keep it, and how to remove it. While a client works with us, personal details in the dashboard — caller numbers, recordings, transcripts, message text and contact names — are deleted 24 months after they are created, and the remaining records, with those details removed, after 36 months. The one exception is the list of people who asked not to be texted, which is kept for as long as the client works with us so they are never texted again. Everything is deleted within 90 days after a client leaves, or sooner if they ask. A client can withdraw our access at any time: unlink our manager account from their Google Ads account, remove us as a manager of their Business Profile, or press Disconnect on the dashboard’s Calendar tab (or remove our access under Third-party apps in their Google Account), which deletes the calendar sign-in we hold. We stop fetching new data straight away and delete what we hold on request.

Cookies and how to say no

The only cookies this site can set are Google Analytics cookies, and only after you press Accept. They are used to count sessions and distinguish new visitors from returning ones. They are not used for advertising.

You have three ways to refuse or withdraw consent:

• Press Decline on the banner. Nothing is set.
• Use the Cookie choices link in the footer at any time to change your mind.
• Install Google's browser opt-out add-on, or block cookies in your browser settings.

Declining costs you nothing. Every part of the site works the same either way.

How long we keep it

Inquiries are retained for as long as we may reasonably need them for the business relationship, and no more than three years after our last contact, unless you ask us to delete them sooner. Server logs are retained on our host's standard schedule, which is a matter of days.

Your rights

If you are in California. Under the CCPA and CPRA you have the right to know what personal information we have collected about you, to request its deletion, to request correction, and not to be discriminated against for exercising those rights. We do not sell personal information. Analytics cookies are only set with your consent, and you can withdraw it at any time using the Cookie choices link in the footer.

If you are in the EU or UK. You have the right to access, correct, delete, restrict, or object to our processing of your data, and to data portability. Our lawful basis for handling contact inquiries is legitimate interest in responding to a request you made of us.

To exercise any of these, email [email protected]. We will respond within 30 days. We may ask you to confirm your identity before acting on a request.

Security

The site is served over HTTPS with a content security policy and related protections in place. The contact form is handled by code running on our host's network rather than in your browser, so the keys used to deliver your message are never exposed to the page, and it is protected by automated bot filtering and a per-address limit on how often it can be submitted. No method of transmission over the internet is completely secure, and we cannot guarantee absolute security — please do not send sensitive information such as financial account details through the contact form.

Children

This site is aimed at business owners and is not directed at anyone under 16. We do not knowingly collect information from children.

Changes

If this policy changes we will update the date at the top of this page. Material changes will be summarized here.