Privacy Policy

The short version

Black Slate Digital designs, builds, hosts and maintains websites for local businesses, and runs optional AI services — a chatbot, online booking, instant quotes and a phone-answering receptionist — on those websites and phone lines. This policy explains what information passes through us, why, and what you can do about it.

The rest of it, in brief:

• We do not sell personal information. Not phone numbers, not email addresses, not enquiries — to anyone, for any purpose.
• Our website analytics use no cookies at all — no cookie, no local storage, no fingerprint, no cross-site identifier — and we never store a visitor's IP address. See section 04.
• We run no third-party advertising or analytics trackers. No Google Analytics, no Meta Pixel, no session recorders — not on this site, and not on any website we build.
• We never see your card number. Payments run on Stripe's own hosted checkout.
• Enquiries left on a client's website belong to that client. We hold them on the business's behalf. See section 06.
• When a client connects Google Calendar, we cannot read what is in it — only which blocks of time are busy. We deliberately did not ask for the permission that would show us event titles, guests or locations. See section 08.

Text messaging (SMS) and your mobile number

This section applies to every text message we send, whether we send it as Black Slate Digital or on behalf of a client business whose website or phone line we operate. The matching contractual terms are in our Terms of Service.

How we get your number, and what we send

• You gave it to a business we operate a site or phone line for. If you submit a contact, quote or booking form, or call a line our AI receptionist answers, and you provide a mobile number, you are asking that business to get back to you. The number is used to reply to that enquiry and to follow up on it.
• You are one of our clients or a business we have spoken to. We text account and service messages — billing notices, new-lead alerts, demo links, appointment details and support replies — and, where you have agreed to hear from us, occasional promotional messages about our own services.

Agreeing to receive marketing text messages is never a condition of buying anything from us. Opting out of them does not affect anything else you have with us.

Frequency, rates, STOP and HELP

• Message frequency varies — it depends on your activity, such as how many enquiries you send or receive.
• Message and data rates may apply. Those are your carrier's charges; we do not charge you to receive a message.
• Reply STOP to any message to opt out. You will get one confirmation and then nothing further. You can also opt out by emailing or calling us and we will do it for you.
• Reply HELP to any message for help, or contact us at (385) 519-0030 or Phil_Beasley@Black-Slate-Digital.com.
• Carriers are not liable for delayed or undelivered messages. Delivery depends on your carrier and your handset, and no message is guaranteed to arrive.

What an opt-out does

A STOP is permanent and it is total. We record the number on a suppression list that our system checks before every send, and that record is never deleted — it is the only way to be sure the number is never texted again, including by a future campaign that has no idea you once opted out. An opt-out covers all message types from us, not just marketing. If you later want messages again, reply START and we will honour that too.

We keep a record of the messages we send and receive — the number, the time, the delivery result and the message text — because messaging rules require us to be able to show what was sent to whom and on what consent.

Information we collect

When you contact a business through a website we host

Contact, quote and booking forms on the sites we build ask for a name and phone number, optionally an email address, and whatever you write in the message. Some forms — instant quotes, booking — ask job-specific questions, and your answers are stored with the enquiry exactly as you typed them. We record which site the enquiry came from and when it arrived.

We do not store your IP address or your browser's user-agent string with your enquiry. Your IP is used briefly, in memory, to rate-limit submissions so a bot cannot flood a business's inbox, and is then gone.

When you contact us on this website

The enquiry form on this site takes your name, email, optional phone number and message, and emails them straight to us. It does not write to any database.

When you use an AI feature

The chatbot, instant-quote and booking assistants, and the AI receptionist on the phone, all receive whatever you tell them. What is kept from those conversations is covered in section 07.

When you become a client

We hold your business's name, contact name, email address, phone number, the details of your business we build your site from, your plan and subscription status, the documents we have produced for you, and our own notes about the work. Signing in to the dashboard or client portal creates an account with our authentication provider.

Visitor analytics

Covered separately in section 04, because how we do it is unusual and worth reading.

Visitor analytics, and why there is no cookie banner

Every website we host counts its visits, because a business paying for a website deserves to know whether it is working. We built that counter to need as little about you as possible.

• No cookies. No local storage. No fingerprinting. No cross-site identifier. Nothing is stored on your device at all. That is a deliberate design decision, not an oversight — and it is why the sites we build carry no cookie consent banner: there is nothing to consent to.
• Your IP address is never stored. It is combined with the current date, the site you are on and your browser's user-agent into a one-way SHA-256 hash, truncated, and then discarded. That hash is what lets us tell two visits apart on a given day. It changes at midnight UTC, and it is different on every site, so it cannot follow you from one day to the next or from one business's site to another's.
• We keep the referring website's host name, never the full address — "google.com", not the search you typed to get there. When you arrive from another page on the same site, even that is blank.
• We also record the page path, your browser's language setting, whether the screen is phone-sized or bigger, and how long the page was open. We do not store the actual screen dimensions.
• We count a handful of anonymous actions so a business can see what its site is doing: a tap on a phone number, a tap on an email link, a widget being opened, a form being submitted, and how far down the page people read. We record that the action happened — never the number dialled, the address clicked, or anything typed.

Cookies we do set

Our dashboard and client portal set a sign-in session cookie. It is strictly necessary to keep you signed in and it is the only cookie our platform sets. We use no advertising, retargeting or analytics cookies anywhere.

Fonts and other assets your browser fetches

The websites we build load typefaces from Google Fonts and Fontshare. That means your browser contacts those services directly when a page loads, and they can see your IP address as a result — the same as on most of the web. We do not send them anything else about you.

How we use information

We use what we collect to:

• Deliver an enquiry to the business it was meant for, by email, push notification and text message.
• Build, host, maintain, monitor and improve the websites and AI services we provide.
• Answer questions, take bookings and quote work, including through our AI features.
• Bill for our services, and keep the records a business is required to keep.
• Show a client how their own website is performing.
• Contact our clients and prospective clients about our services, subject to the opt-outs below.
• Detect and stop spam, abuse and fraud.
• Comply with the law, and with the messaging and email rules we are bound by.

We do not use the information in an enquiry to build advertising profiles, we do not feed it to advertising networks, and we do not use client data to train AI models. Our AI providers process what is sent to them in order to answer, under contracts that do not permit them to train their models on it.

Enquiries left on a client's website belong to that client

This is the most important distinction in this policy. When you fill in a form, open the chatbot, book an appointment or call the AI receptionist on a website we built for a local business, you are contacting that business — not us.

• The business is the one that decides what happens with your enquiry. We hold and process it on their behalf, as their service provider.
• We forward it to them, store it in the dashboard we provide them, and keep it available to them for as long as they are our client.
• We do not use one client's enquiries for another client, we do not build a shared marketing list out of them, and we never sell them.
• A copy of the enquiry notification also reaches us as the operator of the platform, so that we can support the service and prove delivery when a business says a lead never arrived.

If you want a business to delete an enquiry you left with them, ask the business. If it is easier to ask us, contact us at Phil_Beasley@Black-Slate-Digital.com and we will act on it or pass it straight to them.

AI chat, quotes and the AI receptionist

The website chatbot

The chatbot is powered by Anthropic's Claude. What you type is sent to Anthropic to produce a reply, along with the facts the business has given us about itself. Anthropic processes it to answer and does not use it to train its models.

A chat that does not turn into an enquiry is not stored. We keep a count of conversations and a single coarse topic label — nothing you typed reaches our database. If you do leave your details and the chat becomes a lead, the conversation is saved with it so the business can see the context of what you asked, along with a short AI-written summary.

The AI receptionist

Calls to a business line running our AI receptionist are handled by our voice provider, Retell AI, which in turn uses speech and language services from its own providers to hear you and to speak. Every such call opens with an audible notice that the call may be recorded.

From those calls we store the calling number, how long the call lasted, a written transcript, a short summary, and what the call was about. Audio recordings stay with the voice provider; we do not download or store them. The transcript and summary are delivered to the business as an enquiry, exactly like a form submission.

What AI output is worth

Anything our AI tells you about price, availability or scope is an estimate and an enquiry, not a binding quote or a confirmed booking, until a person at the business confirms it. Our AI never claims to be a human being.

Online booking and Google Calendar

When you book an appointment through a site we host, we take your name, phone number, an email address if you give one, the time you chose and any note you add, and we create the appointment on the business's Google Calendar. If you gave an email address, you are added to the invitation so Google sends you the details.

The permission we deliberately did not ask for

To offer real-time availability we ask a client to connect their Google Calendar. We request the narrowest permissions that can do the job: the ability to see free/busy time, and the ability to create and manage the appointment events themselves.

That means we cannot read what is in a client's calendar. Free/busy returns blocks of time and nothing else — no event titles, no guests, no locations, no descriptions. The broader permission that would let us read every event's contents exists, and we chose not to request it. We have turned down features that would have required it rather than widen the request.

Calendar access tokens are encrypted before they are stored, with a key that is not kept in the database. A client can disconnect their calendar at any time from their dashboard, and can revoke our access from their own Google account settings.

Payments

Payments are processed by Stripe. Card details are entered on Stripe's own hosted checkout page and are held by Stripe, a PCI-compliant payment processor. We never receive, see or store a full card number, and no card field exists anywhere in our software.

What we do store is what Stripe tells us about the relationship: the customer and subscription identifiers, the plan, the amount, the status, the renewal date, and the name, email and phone number given at checkout. Stripe handles the payment information itself under its own privacy policy.

Email we send, and how to stop it

We send two different kinds of email, and they are treated differently on purpose.

• Transactional email — lead notifications, invoices and receipts, monthly reports, account and support messages. These are part of the service and are not marketing.
• Promotional email — offers, new services and follow-ups. Every one carries a working unsubscribe link and our postal address, and supports one-click unsubscribe from your mail app.

Unsubscribing is permanent. Your address goes onto a suppression list that is checked twice before any campaign sends — once when the audience is worked out, and again immediately before each individual message — and those records are never deleted by our software. Unsubscribing from promotional email does not stop your invoices or your lead alerts, because a business still needs its receipts; if you want those stopped too, that means closing the account, and you should just tell us.

You can also simply ask. Email Phil_Beasley@Black-Slate-Digital.com or call (385) 519-0030 and we will take you off.

Who we share information with

We do not sell personal information, and we do not share it for anyone else's marketing. We share it in only three situations: with the client business an enquiry was addressed to; with the service providers below, who process it on our behalf under contract and may not use it for their own purposes; and where the law requires it, or to protect someone's safety or our legal rights. If the business is ever sold or transferred, information may pass to the new owner, who would be bound by this policy.

The service providers we actually use

• Vercel — hosting and content delivery for our platform and the websites we serve.
• Supabase — our database, file storage and sign-in system.
• Stripe — payments, subscriptions and invoicing.
• Anthropic — the AI behind the website chatbot and the AI writing we do.
• Retell AI — the AI receptionist that answers the phone. Retell in turn uses its own providers to understand speech, generate a reply and produce a voice, including OpenAI and ElevenLabs, and uses Twilio for the phone numbers it runs on.
• Twilio — phone numbers, call routing and text-message delivery.
• Google — Google Calendar for booking, the Google Places API for public business listing information, and Google Fonts for typefaces loaded by a visitor's browser.
• Resend — email delivery. Where a client's own mail server is used instead, that server handles it.
• Web push services — Google, Mozilla and Apple deliver the browser notifications we send to a client's own devices. They carry the alert, not your enquiry's contents.
• Microlink — generates a screenshot of a public web page when we prepare a demo. No personal information is sent to it.
• Pexels — stock photography used only while a demo site is being designed, before any real visitor exists.

These providers are mostly based in the United States, and information handled by them is processed there.

Public business information

When we build a demo for a business, we read its public Google Business Profile — name, address, phone, hours, rating, review count, and the reviews and photos Google publishes on that listing — through Google's Places API. That is information the business and its reviewers already made public. If you are a reviewer and would rather your review did not appear on a business's website, tell us and we will remove it.

How long we keep information

We keep information for as long as it is doing a job, and we would rather tell you what that means in practice than quote a schedule we do not run.

• Enquiries, chat transcripts and call records stay available to the client business for as long as their site is with us, because they are that business's customer records. When a site is deleted, everything attached to it — enquiries, transcripts, call records, analytics, uploaded media — is deleted with it.
• Analytics are stored as daily aggregates. There is nothing in them that identifies you.
• Billing records are kept as long as tax and accounting rules require.
• Opt-out records — email and SMS suppression lists — are kept forever, on purpose. Deleting them would be the one way to accidentally start contacting you again.

Ask us to delete something sooner and we will, unless we are required to keep it. See section 14.

How we protect information

Everything runs over encrypted connections (HTTPS), on managed infrastructure with automatically renewed certificates. Our database enforces row-level security, so the keys that reach a visitor's browser can read none of it. Calendar access tokens are encrypted before storage with a key that is not stored alongside them. Access to the dashboard is limited to the operator and supports two-factor authentication. Payment card data never reaches us at all.

No system is perfectly secure, and we will not pretend otherwise. If a breach ever affects your information, we will tell those affected promptly and plainly.

Your choices and your rights

Whatever state or country you are in, you can ask us to:

• Tell you what information we hold about you.
• Correct anything that is wrong.
• Delete it, where we are not required to keep it.
• Give you a copy.
• Stop sending you marketing email or text messages.

Email Phil_Beasley@Black-Slate-Digital.com, or call or text (385) 519-0030. We will respond within 30 days, and we may need to check you are who you say you are before acting. We will never charge you for asking, and we will never treat you differently for having asked.

Where an enquiry was left with one of our clients, that business decides what happens to it and we will pass your request to them — see section 06.

Residents of California, and of other states with similar laws, have these rights by statute. For the avoidance of doubt: we do not sell personal information, and we do not share it for cross-context behavioural advertising.

Children

Our services are for businesses and their customers, and are not directed at children. We do not knowingly collect information from anyone under 13. If you believe a child has given us information, tell us and we will delete it.

Changes to this policy

We will update this policy when what we do changes. The revision date at the top of the page always reflects the current version, and the current version is always published at black-slate-digital.com/privacy. If a change materially affects how we handle your information, we will make it obvious rather than relying on you to re-read the page.

This version is dated August 18, 2026.

How to reach us

Black Slate Digital is a website design, hosting and maintenance business operated by Phil Beasley in Layton, Utah, United States. Questions about this document, or any request about your information, should go to:

• Email: Phil_Beasley@Black-Slate-Digital.com
• Phone or text: (385) 519-0030
• Mail: Black Slate Digital, 1052 E. Bigelow Ave, Layton, UT 84040, United States

We answer every request ourselves — there is no ticket queue and no third-party support desk between you and the person who runs the business.