Webgrade ("we," "us," or "our") is committed to protecting the privacy and personal data of everyone who interacts with our websites, services, and platforms. This Privacy Policy explains what information we collect, why we collect it, how we use and protect it, who we share it with, and the rights you have over your data.

By accessing or using any Webgrade website, service, or platform, you agree to the practices described in this Privacy Policy. If you do not agree, please discontinue use of our Services.

1. Information We Collect

Information You Provide Directly

• Contact & inquiry data: When you submit a quote request, contact form, support ticket, or any other inquiry, we collect your name, email address, phone number, business name, and any details you include in your message
• Email subscription data: Your email address (and optionally your name) when you subscribe to our mailing list, either voluntarily or through automatic opt-in upon first inquiry
• Project & service data: Content, brand assets, copy, images, files, and communications you share with us during an active project or service engagement
• Account credentials: Username, hashed password, session data, and related authentication information for users with portal or platform access
• Review & feedback submissions: Any testimonials, ratings, or feedback you submit through Webgrade channels
• Payment information: Payment is processed through third-party processors (such as Stripe). Webgrade does not store your full credit card number, CVV, or bank details on our servers

Information Collected Automatically

• IP address: Collected automatically with every request to our servers and used for security, rate limiting, fraud prevention, and analytics
• Browser & device data: Browser type, operating system, screen size, device type, and language preferences
• Usage data: Pages visited, time spent on pages, links clicked, referral source, campaign tags, and navigation patterns, collected through Cloudflare Web Analytics and, only after you accept cookies, through Webgrade Site Analytics and the Meta Pixel (see Cookies & Tracking Technologies)
• Error & performance logs: JavaScript errors, failed requests, and performance metrics collected to improve reliability
• Session data: Encrypted session tokens stored in cookies to maintain authenticated state during portal access

Information from Third Parties

We may receive limited information about you from third-party platforms when you interact with Webgrade through integrations or partner systems, such as analytics providers or advertising platforms, as described in this policy.

2. How We Use Your Information

We use the information we collect for the following purposes:

• Service delivery: To process quote requests, manage active projects, communicate about your work, deliver completed services, and issue invoices and receipts
• Support & communication: To respond to your inquiries, support tickets, and messages in a timely and accurate manner
• Email marketing: To send promotional emails, service announcements, and relevant updates to subscribers (subject to your subscription preferences and applicable law)
• Identity verification: To verify your identity via 2FA email codes during sensitive operations including portal login, email subscriptions, and account changes
• Security & fraud prevention: To detect and prevent unauthorized access, abuse, spam, scraping, DDoS attacks, and other malicious activity via IP rate limiting, session management, and security monitoring
• Analytics & improvement: To understand how our Services are used, identify issues, improve performance, and develop new features
• Legal compliance: To comply with applicable laws, regulations, court orders, and lawful requests from authorities
• Business operations: To maintain internal records, manage client relationships, and conduct general business administration

3. Legal Basis for Processing

Depending on how you interact with Webgrade and your jurisdiction, we rely on one or more of the following legal bases to process your personal data:

• Contract: Processing is necessary to fulfill a service agreement or quote request you have initiated
• Legitimate interests: Processing is necessary for our legitimate business interests (security, fraud prevention, service improvement) and does not override your rights
• Consent: You have given explicit consent for specific processing, such as promotional email subscriptions
• Legal obligation: Processing is required to comply with applicable law or lawful authority requests

4. Email Marketing & Your Choices

Webgrade sends three kinds of list email: the Newsletter, for people who contacted us through a form; the Subscribe list, for people who subscribed at webgrade.org/email/subscribe and confirmed with a code sent to their inbox; and Customer letters, for people with a Webgrade client dashboard account, about the service they use.

You can opt out at any time by:

• Opening the unsubscribe link at the bottom of any Webgrade list email and confirming your address
• Using the unsubscribe button your email app shows for our emails
• Replying STOP to any Webgrade list email

Unsubscribing takes you off all three at once, customer letters included, and our forms will not add you again. You can rejoin only by subscribing yourself at webgrade.org/email/subscribe. Transactional emails (sign-in codes, security alerts, invoices, receipts and replies to your own requests) are not list email and still arrive while you have an account or an open request.

5. Cookies & Tracking Technologies

What We Use

Webgrade uses cookies and similar browser storage technologies for the following specific purposes:

• Session authentication: Encrypted session cookies that keep you logged in during authenticated portal access. These are essential for security and functionality
• Security tokens: Tokens used for CSRF protection and session integrity during form submissions and account actions
• Cookie consent preference: A small cookie to remember whether you have accepted or declined non-essential cookies
• Analytics: Cloudflare Web Analytics, a privacy-respecting analytics tool that does not use fingerprinting, does not set persistent advertising cookies, and does not track you across other websites
• Webgrade Site Analytics (only after you accept): Our own analytics on webgrade.org and the client dashboard (my.webgrade.org). It records the pages you view, where you came from (the referring site and campaign tags), clicks on buttons we track, and your device type, browser, operating system and screen size. It keeps a random visitor ID in your browser for up to 13 months and a session ID for the visit. The data stays with Webgrade, on Cloudflare, for up to 13 months. Webgrade staff working in a client’s dashboard are never counted
• Meta Pixel (webgrade.org only, only after you accept): A tag from Meta Platforms, Inc. that tells Meta which pages you visit on webgrade.org, together with technical details about your browser, so we can measure our advertising on Facebook and Instagram and show our ads to people who have visited. Meta may set its own cookies (such as _fbp) and may link this information to your Meta account, under Meta’s own privacy policy. It never runs on the client dashboard

Your Choice

• The first time you visit webgrade.org or my.webgrade.org you are asked to Accept or Decline. One answer covers both sites. Until you answer, no analytics or advertising tag records or sends anything about you
• If you decline, Webgrade Site Analytics and the Meta Pixel stay off, and we ask again after 30 days. If you accept, we remember it for 12 months
• The Meta Pixel also stays off when your browser sends a Global Privacy Control signal
• You can change your cookie choice at any time; withdrawing consent stops new data from being collected
• We never use a cookie that identifies you personally without your knowledge or consent

Managing Cookies

You can manage, restrict, or delete cookies at any time through your browser settings. Note that disabling session cookies will prevent access to authenticated areas of the site (such as the client portal). Disabling analytics cookies has no impact on your experience.

6. Data Sharing & Third Parties

We do not sell, rent, or trade your personal information. Apart from the Meta Pixel described below, which runs only if you accept cookies, we do not transfer your personal information to third parties for their own marketing or commercial purposes. We share data only in the following limited circumstances:

• Infrastructure providers: Cloudflare (hosting, CDN, DDoS protection, analytics), data passes through Cloudflare's network as part of normal web operation
• Advertising (Meta): Only if you accept cookies on webgrade.org, the Meta Pixel sends Meta Platforms, Inc. the pages you visit and technical details about your browser, for advertising measurement and audiences. Under some U.S. state privacy laws this may count as “sharing” personal information for cross-context behavioral advertising. Declining cookies, or a Global Privacy Control signal, stops it
• Email delivery: Cloudflare delivers our emails, including 2FA verification codes, password reset emails, and transactional notifications. Newsletters you choose to receive are sent through an email delivery provider that receives only your email address and subscription details. Neither receives your full contact records or project data
• Payment processing: Stripe or other designated processors handle payment transactions. They operate under their own privacy policies and PCI-DSS compliance obligations
• Legal requirements: We may disclose your data if required by law, court order, subpoena, or lawful government authority request. Where permitted, we will notify you before such disclosure
• Business transfers: In the event of a merger, acquisition, restructuring, or sale of Webgrade assets, your data may transfer to a successor entity with equivalent privacy protections, and you will be notified in advance

All third-party service providers are contractually required to handle your data in accordance with applicable privacy laws and to use it only for the purposes for which it is shared.

7. Data Retention

We retain your personal data for as long as necessary to fulfill the purposes described in this policy and to comply with legal obligations. Specific retention periods:

• Contact & inquiry data: Retained for up to 3 years from the date of last interaction, to support ongoing business relationships and legal record-keeping
• Email subscription data: Retained until you unsubscribe, after which it is deleted or anonymized within 30 days
• Website analytics: Webgrade Site Analytics data is kept for up to 13 months; what Meta keeps from the Meta Pixel is governed by Meta’s own policies
• Project & service data: Retained for the duration of the engagement plus up to 2 years after project completion for dispute resolution and reference
• Account & session data: Active sessions are retained during portal use. Session tokens expire automatically upon logout or after a set inactivity period
• Security & error logs: Retained for up to 90 days for security investigation purposes
• Payment records: Retained for up to 7 years as required by financial and tax regulations

You may request earlier deletion of your data at any time (subject to legal retention obligations) by contacting us at desk@webgrade.org.

8. Data Security

We implement comprehensive, industry-standard security measures to protect your personal data from unauthorized access, alteration, disclosure, or destruction:

• Encryption in transit: All data transmitted between your browser and our servers is protected by HTTPS/TLS encryption
• Encryption at rest: Sensitive stored data (including portal HTML and session tokens) is encrypted using AES-GCM
• DDoS protection: Cloudflare's enterprise-grade DDoS mitigation protects all Webgrade properties
• IP rate limiting: Server-side rate limiting prevents brute-force attacks and abuse on all sensitive endpoints
• Two-factor authentication: Required for all portal access and email subscription changes
• Session management: Authenticated sessions use encrypted, short-lived tokens that expire automatically
• Access controls: Administrative access to systems and data is restricted to authorized Webgrade personnel on a need-to-know basis

While we take all reasonable precautions, no system connected to the internet can be guaranteed to be 100% secure. You transmit information to us at your own risk. If you suspect a security incident involving your account, contact us immediately.

9. Data Breach Notification

In the event of a confirmed data breach that is likely to result in a risk to your rights or personal data, Webgrade will:

• Notify affected users via email as promptly as possible, and no later than 72 hours after discovery (where feasible)
• Describe the nature of the breach, the categories and approximate volume of data affected, the likely consequences, and the measures taken or proposed to address the breach
• Notify relevant supervisory authorities as required by applicable law
• Provide guidance on steps you can take to protect yourself following the breach

10. Children's Privacy

Webgrade's Services are not directed to individuals under the age of 16. We do not knowingly collect, solicit, or process personal data from children under 16. If you are a parent or guardian and believe your child has provided personal information to us without your consent, please contact us at desk@webgrade.org and we will delete that information promptly.

11. Your Privacy Rights

Depending on your jurisdiction and applicable law (including GDPR, UK GDPR, CCPA, and similar regulations), you may have the following rights regarding your personal data:

• Right of access: Request a copy of the personal data we hold about you
• Right to rectification: Request correction of inaccurate or incomplete personal data
• Right to erasure ("right to be forgotten"): Request deletion of your personal data, subject to legal retention obligations
• Right to restriction: Request that we limit how we process your data in certain circumstances
• Right to object: Object to our processing of your data based on legitimate interests, including for direct marketing
• Right to data portability: Request a machine-readable copy of data you have provided to us
• Right to withdraw consent: Where processing is based on your consent, withdraw it at any time without affecting prior lawful processing
• Right to lodge a complaint: File a complaint with a relevant supervisory or data protection authority in your jurisdiction

To exercise any of these rights, contact us at desk@webgrade.org. We will respond to verified requests within 30 days. We may need to verify your identity before processing certain requests.

We will never discriminate against you for exercising your privacy rights.

12. International Data Transfers

Webgrade operates using infrastructure provided by Cloudflare, which operates a global network. As a result, your data may be processed in data centers located outside your country of residence. Where such transfers occur, they are protected by Cloudflare's standard contractual clauses and compliance frameworks. By using our Services, you consent to the transfer of your data as described in this section.

13. Do Not Track

Some browsers offer a "Do Not Track" (DNT) signal. Because there is no universally accepted standard for how websites should respond to DNT signals, Webgrade does not currently alter its data collection practices in response to DNT signals. Our analytics (Cloudflare Web Analytics) is privacy-preserving by design regardless of DNT settings.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal requirements. The "Effective" date at the top of this page reflects the most recent revision. For material changes, we will make reasonable efforts to notify active subscribers or portal users via email. Your continued use of our Services after changes are posted constitutes your acceptance of the revised policy.

15. Contact & Data Controller

Webgrade is the data controller for personal data collected through our Services. For any privacy-related questions, data subject requests, or concerns, contact us at:

desk@webgrade.org, or through our Support page.

We aim to respond to all privacy inquiries within 5 business days.