Privacy Policy

This Privacy Policy explains how This Meeting Matters, LLC, an Indiana limited liability company doing business as Colin Makes Software (“Colin Makes Software,” “we,” “us” or “our”), collects, uses and protects information. It covers our website at colinmakessoftware.com, our client dashboard at app.colinmakessoftware.com, the tools that let clients edit their websites through AI assistants such as Claude, and the websites we build and host for our clients (together, the “Services”).

We build and host websites for businesses and individuals. We think a website company should be a careful steward of two groups' information: our clients, who trust us with their business, and their visitors, who never chose us at all. We don't sell personal information, we don't share it for cross-context behavioral advertising, and we collect only what we need to do the work.

A quick summary

This summary is for convenience; the full policy below controls.

• For our clients, we collect what we need to build, host and support your website: your account details, the materials you give us, your site's content, and records of the changes you make.
• For visitors to the websites we host, we act on our client's behalf. The business whose site you're visiting decides what its forms ask for and what happens with your answers. We store and deliver that information for them and don't use it for anything else. See Visitors to our clients' websites.
• We use PostHog for product analytics and, with form fields and other inputs masked, session replay. Where the law requires your consent first (for example, in the EU and UK), we ask before any of it runs, and we honor Global Privacy Control.
• We use AI tools, such as Anthropic's Claude, to help build websites. We use them only under commercial terms that don't allow your materials to be used to train AI models.
• We don't sell personal information, don't use it for third-party advertising, and don't show ads on our own website or dashboard.
• Everyone, wherever you live, can ask to see, correct, export or delete their information. See Your privacy rights.

Who we are and our role

The company responsible for the information described here is:

This Meeting Matters, LLC (d/b/a Colin Makes Software)
9783 E 116th St PMB 2448
Fishers, IN 46037
United States
hello@colinmakessoftware.com

Privacy law gives the companies that handle personal information one of two roles, and ours depends on whose information it is:

• We are the “controller” (or “business”) for information about our clients and their team members, people who sign up or contact us, and visitors to our own website and dashboard. We decide how that information is used, and this policy describes it.
• We are a “processor” (or “service provider”) for information about visitors to our clients' websites, such as what they type into a contact form. Our client is the controller: they decide what to collect and why, and their own privacy policy governs it. We handle that information only on their instructions, under the Data Processing Agreement in our Terms of Service.

Information we collect about clients

Information you give us

• Account information. Your name, email address and password (stored only as a secure hash, never in readable form). If you invite colleagues to your organization, we collect their email addresses and the role you give them.
• Signup and project information. When you sign up or start a project, we collect what you tell us about it: your current website's address, your goals, your comments, and any files you upload, such as logos, photos, documents or brand guidelines.
• Website content. Everything that makes up your site: its text, images, videos, settings, page drafts and published versions, and its history of changes.
• Billing information. The details we need to invoice you and record your payments, such as your business name, billing contact and payment history. If you pay online, Stripe processes your payment and collects your card or bank details directly. We never receive or store full card or bank account numbers. We may see limited details, such as your card's brand, last four digits and expiration date, so you can recognize the payment method on file.
• Communications. The messages you send us and our replies.

Information created when you use the Services

• Editing records. When you edit your site through an AI assistant, such as Claude, the assistant sends our server requests to change your draft, such as “update this section.” We keep a record of each request: what it asked for, who made it, which connected app sent it, when, and whether it succeeded. These records help us support you, show your site's history and investigate problems. We receive only these requests, not your conversations with your assistant.
• Sign-in information. To keep you signed in securely, we record the IP address and browser type of each session. Sessions expire automatically after a limited period.
• Security checks. Our signup and sign-in forms use Cloudflare Turnstile to tell people from bots. Turnstile looks at technical signals from your browser and doesn't use advertising cookies.
• Usage analytics. See Analytics, session replay and cookies.

Visitors to our clients' websites

If you're visiting a website we host for one of our clients, that client, not us, is responsible for your information. Here's what we handle on their behalf:

• Form submissions. When you fill out a form on a client's site (for example, a contact or quote request), we receive whatever the form asks for, along with the page you sent it from and your language. We check it for spam, store it for the client, and deliver it to them, usually by email.
• Analytics and session replay, if the client has chosen to use them. See Analytics, session replay and cookies.
• Technical information. Like every website, our servers receive technical information such as your IP address, browser type and the pages you request, so they can deliver the page and protect it from abuse.

We use visitor information only to provide the client's website to them. We don't sell it, don't use it to advertise to you, don't combine it across our clients' sites to profile you, and don't use it for our own marketing.

Our clients are responsible for having a privacy policy for their own site and for using their visitors' information lawfully. To exercise your privacy rights over information a business collected on its website, please contact that business. If you contact us instead, we'll pass your request to them and help them respond.

By default, we ask our clients not to collect sensitive information through their websites. That includes health information, payment card or bank details, Social Security or other government ID numbers, and information about children. Clients may do so only under a separate written agreement with us.

How we use information

We use information about our clients to:

• design, build, host, maintain and support your website;
• create and secure your account and let you and your team sign in;
• carry out the edits you request, show you previews, and publish your changes;
• invoice you and keep accounting records;
• send you service messages, such as account, security, billing and project updates;
• send you occasional news and marketing emails about our Services. Every one includes a one-click unsubscribe link, and unsubscribing never affects service messages;
• understand how our website and dashboard are used, so we can fix problems and improve them;
• prevent fraud, spam and abuse, and keep the Services secure;
• enforce our Terms of Service and meet our legal obligations.

We don't use your information to serve third-party advertising, and we don't sell it.

Our legal bases (for people in the EU, UK and similar places)

Where laws like the GDPR apply, we rely on these legal bases:

• Contract: to provide the Services you've signed up for.
• Legitimate interests: to secure, support and improve the Services and to send relevant news to our clients, always balanced against your rights. You can object at any time.
• Consent: for analytics and session replay where the law requires it, and for marketing where the law requires it. You can withdraw consent at any time.
• Legal obligation: to keep accounting records and respond to lawful requests.

How we use AI

Two kinds of AI can be involved in our Services, and they work differently:

• AI tools we use to build your site. We may use AI tools, such as Anthropic's Claude, to help us work with the materials you give us: drafting copy, organizing content, or adapting your existing site. We use these tools only under commercial terms that don't allow the provider to train its models on what we send.
• The AI assistant you connect to your site. You can edit your website with any compatible AI assistant, such as Claude. We recommend Claude, but the choice is yours. Your conversations happen in that assistant, under your own agreement with its provider. We receive only the requests the assistant sends us to read or change your site (see Editing records). The provider's privacy policy covers what happens in your account with them.

Analytics, session replay and cookies

Analytics and session replay

We use PostHog to understand how people use our website and dashboard: which pages they view, which features they use, and where they run into problems. PostHog may also record session replays, reconstructions of how a visitor moved through a page, so we can see and fix confusing or broken experiences.

• Inputs are masked. Session replays mask what people type into form fields and other inputs, so passwords, messages and form answers aren't recorded.
• Your site content stays out of analytics. We don't send the text of your drafts, your form submissions or your uploaded files to PostHog.
• Recordings are short-lived. Session replays are kept only for a limited period and then deleted automatically.

Our clients can choose to use PostHog on their own websites too. Sometimes the client has their own PostHog account; sometimes we set up and manage one for them as their processor. Either way, the data belongs to that client and is kept separate from every other client's.

Cookies and similar technologies

We use two kinds of cookies and similar technologies (like local storage):

• Necessary: these make the Services work. They keep you signed in, protect forms from bots, remember the language you chose, and let you view draft previews. They can't be switched off without breaking those features.
• Analytics: these let PostHog recognize a returning browser so analytics and session replay can work.

We don't use advertising cookies on our own website or dashboard, and we don't let advertisers track people there.

Your choices

• Where consent is required (for example, for visitors in the EU, the UK and Switzerland), analytics and session replay don't start until you agree through our cookie banner, and you can change your mind at any time.
• Elsewhere, you can opt out of analytics at any time through our cookie settings.
• Global Privacy Control. If your browser sends a Global Privacy Control signal, we treat it as an opt-out of analytics and session replay for that browser, and as a request to opt out of any “sale” or “sharing” of personal information (which we don't do anyway).
• You can also block or delete cookies in your browser's settings.

The websites we host for clients follow the same approach by default. A client can configure their own site's cookies and banner, and is responsible for that configuration.

Tools our clients add to their sites

Our clients decide what runs on their own websites. A client may add, or ask us to add, third-party tools such as analytics, advertising pixels, chat widgets, booking tools or video embeds. Those tools are chosen by the client, collect information under the client's and the tool provider's own policies, and aren't covered by this policy. We aren't responsible for how a client or its chosen providers collect or use visitors' information; please see the privacy policy of the website you're visiting.

Service providers

We use a small number of trusted service providers (“subprocessors”) to run the Services. Each one processes information only to do its job for us and is bound by its own commitments to protect it. As of the date above, they are:

• Cloudflare: hosting, content delivery, our database and file storage, email delivery, custom domains and security (including Turnstile). Processes all of the information described in this policy, as needed to store and deliver it.
• PostHog: product analytics and session replay. Processes usage events, technical identifiers and masked session recordings.
• Anthropic: AI tools we use while building websites. Processes the materials and content we work with, under terms that don't allow training on it.
• Stripe: payment processing. Processes your payment details, billing contact and payment history. Stripe also uses some of this information under its own privacy policy, for example to prevent fraud.

We may add or replace providers as the Services evolve. When we do, we'll update this list. Clients who need advance notice of new subprocessors for their visitors' data can ask us for it under our Data Processing Agreement.

When we access your information

Building and running websites means we work with your content directly, and we want to be specific about it:

• Your site and project materials. We work with your site content, drafts and uploaded files as part of the job: building your site, making changes you ask for, and fixing problems.
• Your visitors' form submissions. We treat these with more care. We look at them only when needed to provide support you've asked for, to fix a delivery or technical problem, to deal with spam, abuse or security issues, or when the law requires it. We never read them out of curiosity or for any purpose of our own.
• Everything else. We access account and usage information only to run, secure and support the Services.

We may also access, keep or disclose information when we reasonably believe it's necessary to comply with the law or a valid legal request, or to protect the rights, safety or property of our clients, their visitors, the public or us. Where the law allows, we'll tell the affected client first.

What we don't do

• We don't sell personal information, for money or anything else of value.
• We don't share personal information for cross-context behavioral advertising, and we don't show ads on our own website or dashboard.
• We don't use your visitors' information for our own purposes, and we don't combine it across clients' sites.
• We don't let AI providers train on your materials.
• We don't record what people type in session replays.

How long we keep information

• Account, site content and project materials: for as long as you're a client. After your Services end, we keep your content available for export for 30 days, then delete it from our active systems within 30 days after that.
• Visitors' form submissions: for as long as the client's account is active, unless the client deletes them sooner. They're deleted with the client's account.
• Editing records: for as long as the client's account exists, so your site's history stays complete.
• Sign-in sessions: they expire automatically after a limited period.
• Analytics: session replays are kept only for a limited period; other analytics data is kept only as long as it's useful for improving the Services.
• Billing and legal records: as long as tax, accounting and other laws require, usually up to seven years.

Deleted information may remain in encrypted backups for a limited time until those backups expire on their normal schedule. It's never restored to active use except to recover from a disaster.

Your privacy rights

We give these rights to everyone, wherever you live:

• Access: ask for a copy of the personal information we hold about you.
• Correction: ask us to fix information that's wrong.
• Deletion: ask us to delete your information.
• Portability: get your information in a common, machine-readable format. Clients can export their site content, media and form submissions.
• Objection and restriction: ask us to stop or limit certain uses of your information.
• Withdraw consent: wherever we rely on consent, withdraw it at any time.
• Opt out of marketing: use the unsubscribe link in any marketing email, or email us.
• Non-discrimination: we won't treat you differently for using any of these rights.

How to make a request. Email hello@colinmakessoftware.com. We'll confirm your identity, usually by confirming you control the email address on file, and respond within the time the law requires (within 30 days in most cases). You can use an authorized agent where the law allows. If we decline your request, we'll explain why, and you can appeal by replying to our response.

If you're a visitor to one of our clients' websites, please send requests about that site's information to the business that runs it. See Visitors to our clients' websites.

If you're in the EU, UK or Switzerland, you also have the right to complain to your local data protection authority. We'd appreciate the chance to address your concern first.

International transfers

We're based in the United States, and our service providers process information in the United States and other countries. Cloudflare's network serves websites from data centers around the world. When we transfer personal information out of the EU, UK or Switzerland, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses or our providers' certifications under the EU-U.S. Data Privacy Framework.

Security

We protect information with measures appropriate to its sensitivity. They include encryption in transit and at rest, hashed passwords, access controls that keep each client's data separate, multi-factor authentication on our infrastructure accounts, and reputable infrastructure. No system is perfectly secure, so we can't guarantee absolute security. If a breach affects your personal information, we'll notify you, and any regulators, as the law requires. For our clients' visitors' information, we'll notify the client without undue delay so they can meet their own obligations.

Children's privacy

Our Services are for businesses and adults. Our own website and dashboard aren't directed to anyone under 18, and we don't knowingly collect personal information from children. Our clients agree not to direct the websites we host to children under 13 (or under 16 in the EU and UK) without a separate written agreement with us. If you believe a child has given us personal information, email hello@colinmakessoftware.com and we'll delete it.

Changes to this policy

We'll post any update here with a new “Last updated” date. If a change is material, we'll tell our clients by email or in the dashboard before it takes effect. We'll never make a material change to how we use information we've already collected without the consent the law requires.

Contact us

Questions, requests or concerns about privacy? Email hello@colinmakessoftware.com, or write to:

This Meeting Matters, LLC (d/b/a Colin Makes Software)
9783 E 116th St PMB 2448
Fishers, IN 46037
United States