Privacy Policy
What AWD CMS collects, why, who else sees it, and what you can tell us to do about it.
This policy is published by Armstrong Web Development, who is responsible for it.
1. Who is responsible for your information
Armstrong Web Development operates AWD CMS at awdcms.com and is the data controller for everything described in this policy: we decide what is collected and why.
Where you build a website with AWD CMS and other people visit it, the position reverses. For that website's own visitor data — enquiries sent through its forms, its analytics, its member accounts — you are the controller and we are your processor, acting on your instructions under the data processing terms in our Terms of Service. Each website built here publishes its own privacy policy at /privacy naming you, not us.
2. What is collected
This is everything, in the order you are likely to meet it:
| What | Specifically | Where it comes from | What it is for |
|---|---|---|---|
| Things you type into a form | Your name, email address, phone number, and whatever you write in the message — plus any file you attach | You, when you send it | To read your message and reply to it |
| Records our servers keep | Your IP address, the browser and device you used, the page that sent you here, and the time of each request | Automatically, on every visit | Keeping the site up, keeping it secure, and spotting abuse |
| Cookies and similar storage | A small identifier for your session, and — only if you agree to them — analytics identifiers | Your browser | Remembering you are signed in; measuring use where you have agreed to it |
| Account details | Your name and email address, and a scrambled (hashed) form of your password that cannot be turned back into it | You, when you register | Signing you in and keeping your account yours |
| How you use the site | Pages viewed, mouse movement, clicks, scrolling, and a replay of your session, recorded by Microsoft Clarity; your approximate location to the nearest town or region | Automatically, once you have agreed to analytics | Seeing what is confusing and improving the site |
| Payment details | What you bought and when. Card numbers go straight to the payment provider and are never held by us | You, at checkout | Taking payment, and keeping the accounting records the law requires |
| The websites you build | Every page, section, image and file you create or upload, and the drafts behind them | You, as you work | Storing your work and serving it to your visitors |
| Recordings of your answers | Optional: the sound of each spoken answer, with the question it answers and your business's name, when you build a website by talking and switch on sharper or best listening, or your browser cannot listen by itself. Sent to be written down and not kept | You, when you talk to the builder | Turning what you say into words for your website |
| Web address registration | The registrant's name, postal address, phone number and email address | You, at checkout when you buy a web address | Registering it, as every registry requires |
| Your phone number | Optional. Nothing stops working without it, and it is never used for marketing unless you separately agree | You, if you choose to give it | Contacting you about your account, and the marketing channels you have agreed to |
| What you agreed to | Which channel each permission covered, the exact wording you were shown, your answer, the date, and the address and browser it came from | Recorded when you answer | Proving what was agreed, which is the only thing that can settle it either way |
We do not buy personal information from data brokers, we do not build advertising profiles, and we do not track you across other people's websites.
4. Who else sees your information
Only the organisations below, each under a written contract. They act only on our instructions, except where an entry below says one also uses what it receives for its own purposes.
- Cloudflare, Inc. — hosting, content delivery, DNS and protection against attacks. Traffic passes through their network, so they process request data on our behalf
- Google LLC — web fonts. Requesting a font discloses your IP address to Google. Where a font can be served from this domain instead, it is
- Microsoft Corporation — Microsoft Clarity analytics and session recording, running only after you agree to analytics
- Stripe, Inc. — takes your card details directly. We receive a record of the payment, never the card number. Stripe also uses payment details to prevent fraud and to meet its own legal duties, under its own privacy policy
- Resend — sends the emails AWD CMS sends: links to confirm an email address or reset a password, notices about your account and your websites (including copies of messages sent through their forms), and the emails websites built here send to their members, customers and mailing lists. It receives each message and the address it goes to
- Google LLC — the Gemini models used by the writing and page-generation features, and to tidy what you say when you build a website by talking, where you choose to use them. To tidy an answer it receives the words heard, the question they answer, and what you have already told us about your business while building it, such as what you offer, your opening hours, your phone number, email and street address, and the name and words of any customer review you read out
- Groq, Inc. — writes down what you say when you build a website by talking, if you switch on sharper listening or your browser cannot listen by itself. It receives the recording of each answer, with the question and your business's name to help it spell. We do not keep the recording
- OpenAI — writes down the recording of each answer instead of Groq when you switch on the best listening, which comes with plans that include the AI Assistant
- Anthropic, PBC — tidies what was heard, taking out the ums and false starts, when you switch on the best listening and tidying, which comes with plans that include the AI Assistant. It receives the words heard, the question they answer, and what you have already told us about your business while building it, such as what you offer, your opening hours, your phone number, email and street address, and the name and words of any customer review you read out. That can include details first heard before you switched it on
- Pexels — free photos and videos. When you search for one, our server sends Pexels the words you searched for. Pictures and clips from Pexels are loaded from Pexels's own servers, so anybody who views one — in the editor, or on a page that uses one — discloses their IP address to Pexels, which handles it under its own privacy policy
- Cloudflare, Inc. (Cloudflare Registrar) or Name.com, Inc. — registers a web address you buy through AWD CMS, whichever of the two we use for it. The name, postal address, phone number and email address of whoever registers it go to the registrar, and from it to the registry that runs the address's ending (such as .com), as every registration requires. The registry keeps them under its own rules. Where the ending allows it, they are kept out of the public record of who owns the address
Beyond that, we disclose personal information only where the law requires it — a valid court order, a warrant, or a lawful request from an authority with jurisdiction over us — or where it is necessary to establish, exercise or defend legal claims, or to protect someone from serious harm. We will tell you when we receive such a request unless we are legally prohibited from doing so. If the business is ever sold or merged, your information may transfer with it, and you will be told before that happens and before any new privacy policy applies to you.
5. Where information is processed
This site is offered to people in the United States only, and your information is stored and processed in the United States. Some of the companies listed above run servers elsewhere, but we use them only to provide the service to you and they are bound by their contracts with us to protect what they hold.
6. How long information is kept, and how it is protected
- Form messages and enquiries — kept for up to 24 months from when they are sent, then deleted automatically, with any files sent with them. They can be deleted sooner on request
- Account details — kept for as long as the account exists, and deleted within 30 days of the account being closed
- Server logs — kept for up to 90 days, then deleted
- Analytics records — kept for as long as the analytics provider retains them, up to 12 months
- Accounting and tax records — kept for as long as tax law requires, typically six to seven years
- Consent records — kept for as long as we rely on the consent and for six years afterwards, because a record of what you agreed to is the only thing that can prove it either way
- Feedback sent with the “Send feedback” button — the message is kept to improve the product; the screenshot and the details of the browser and screen it was sent from are deleted after 12 months
Protection: connections are encrypted in transit, passwords are stored only as salted hashes, the sign-in cookie cannot be read by scripts running in the page, and access to stored data is limited to the people who need it. No system is perfectly secure, and we do not claim this one is.
If a breach happens that is likely to result in a risk to your rights, we will notify the relevant state regulators and the affected individuals without unreasonable delay, as state breach-notification laws require, and tell you directly without undue delay where the risk is high, in every state that has such a law.
7. Your rights
These are yours as a United States resident. Some states give you more, and those are set out in the next section; none of them give you less than this.
- Access — ask whether your personal information is held, and get a copy of it
- Correction — have information that is wrong or out of date put right
- Deletion — ask for your information to be erased
- Portability — receive what you gave us in a structured, commonly used, machine-readable format, and have it sent to someone else where that is technically feasible
- Objection — object to processing carried out on the basis of legitimate interests, and to direct marketing at any time
- Restriction — ask that we hold information without using it while a dispute about it is resolved
- Withdraw consent — take back any permission you gave, at any time, without it affecting what was done before you withdrew
- Human review — ask for a person to look at any decision made about you by automated means alone
- Complain — take the matter to your state Attorney General or the Federal Trade Commission without asking us first
To use any of them, write to armstrongwebdev@gmail.com. It is free, you do not have to give a reason, and we answer within 30 days — or sooner where the law says so. We will ask you to confirm who you are before we release anything, which is a protection for you rather than an obstacle. Using a right never costs you access to the service or a worse price.
Where this policy applies
Armstrong Web Development offers this website and its services to people in the United States only. This policy is written for United States law, and the rights below are those of United States residents. We do not intend the site for use from, or to market to, people elsewhere; if you are outside the United States, please do not use it to submit personal information.
California
This section applies if you are a California resident, and is our notice at collection under the California Consumer Privacy Act as amended by the California Privacy Rights Act (Cal. Civ. Code § 1798.100 and following). It uses the statute's own category names so that it can be checked against them.
| Statutory category | Collected | Examples | Purpose | Kept for |
|---|---|---|---|---|
| A — Identifiers | Yes | Name, email address, account ID, IP address, cookie ID | Running the site, signing you in, security | While your account or enquiry is live, then as set out above |
| B — Customer records (Cal. Civ. Code § 1798.80(e)) | Yes | Name, telephone number, billing details | Contacting you, taking payment | Account lifetime, plus what tax law requires |
| C — Protected classifications | No | — | We do not collect these | — |
| D — Commercial information | Yes | Plans bought, transaction records | Billing and support | Seven years for accounting records |
| E — Biometric information | No | — | We do not collect these | — |
| F — Internet or network activity | Yes | Pages viewed, clicks, scrolling, session recordings where analytics is enabled | Understanding and improving the site | As long as the analytics provider retains it |
| G — Geolocation data | Yes | Approximate location to city or region, inferred from IP address | Security and coarse analytics. We do not collect precise geolocation | With the associated log or analytics record |
| H — Audio, electronic, visual information | Yes | Anything you upload — images, files, documents | Showing it on your site, storing it for you | Until you delete it |
| I — Professional or employment information | Yes, if you type it | Whatever you enter in a form | Answering your enquiry | Until deleted |
| J — Education information | No | — | We do not collect these | — |
| K — Inferences | Limited | Aggregate usage patterns | Improving the service | With the analytics record |
| L — Sensitive personal information | Account credentials only | Your password, stored only as a salted hash we cannot reverse | Signing you in, and nothing else | Account lifetime |
We use sensitive personal information only for the purposes listed in § 7027(m) of the CCPA regulations — performing the service, security and fraud prevention — so the right to limit its use does not arise. You may still ask us to stop, and we will.
- Right to know — the categories and specific pieces of personal information we hold, where we got them, why we have them, and who we disclose them to
- Right to delete — subject to the exceptions in § 1798.105(d), such as records we must keep by law
- Right to correct — inaccurate personal information, under § 1798.106
- Right to opt out of sale or sharing — we do neither, so there is nothing to opt out of, and we honour Global Privacy Control signals regardless
- Right to limit use of sensitive personal information — as described above
- Right against discrimination — we will not deny service, charge a different price, or give a worse experience because you exercised a right (§ 1798.125)
You may use an authorised agent, who must provide your signed permission and prove their own identity. We verify requests against the details already on your account before we answer them; if we cannot verify you to a reasonable degree of certainty we will say so rather than release anything. We answer within 45 days, extendable once by a further 45 days.
Shine the Light (Cal. Civ. Code § 1798.83): we do not disclose personal information to third parties for their own direct marketing, so there is nothing to disclose in answer to such a request. Under Cal. Bus. & Prof. Code § 22581, a California resident under 18 who is a registered user may ask us to remove content they posted, and we will remove it from public view.
Other United States state privacy laws
If you live in a state with a comprehensive consumer privacy statute, you have that state's rights, and we apply them to you whether or not our processing volume actually brings us within the statute's thresholds. As at the date of this policy that includes:
- Virginia — Consumer Data Protection Act
- Colorado — Colorado Privacy Act, including the duty to honour universal opt-out mechanisms such as Global Privacy Control
- Connecticut — Data Privacy Act
- Utah — Consumer Privacy Act
- Texas — Data Privacy and Security Act
- Oregon — Consumer Privacy Act, including the right to a list of the specific third parties we disclose data to
- Montana — Consumer Data Privacy Act
- Delaware — Personal Data Privacy Act
- Iowa — Consumer Data Protection Act
- Nebraska — Data Privacy Act
- New Hampshire — Data Privacy Act
- New Jersey — Data Privacy Act
- Tennessee — Information Protection Act
- Minnesota — Consumer Data Privacy Act, including the right to question the result of profiling
- Maryland — Online Data Privacy Act, whose data-minimisation rules we apply to everyone
- Indiana, Kentucky and Rhode Island — as each statute takes effect
In each case you may confirm whether we process your data, access it, correct it, delete it, obtain a portable copy, and opt out of targeted advertising, sale, and profiling with legal or similarly significant effects. We do none of those three things. Where a state gives you a right to appeal a refused request, you may appeal by replying to our refusal, and we will answer within 45 days and tell you how to contact your Attorney General if you are still unsatisfied.
Washington My Health My Data Act and Nevada SB 370: we do not collect consumer health data and do not sell it. Nevada residents may nonetheless submit a verified opt-out of the sale of covered information. Illinois Biometric Information Privacy Act: we collect no biometric identifiers or biometric information.
8. Children
This site is not meant for children and we do not knowingly collect personal information from them. The age below which a child cannot agree on their own is 13 under the federal COPPA rule, and some states set a higher age for certain kinds of processing. We do not knowingly collect information from anyone under 13.
If you believe a child has given us personal information, write to armstrongwebdev@gmail.com and we will delete it. We do not profile children, target advertising at them, or use their data to suggest content.
9. Automated decisions and artificial intelligence
We make no decisions about you by automated means alone that produce legal effects or similarly significantly affect you. Nothing here decides whether you get credit, a job, insurance, or a service.
AWD CMS does use generative AI — Google's Gemini models — to draft page copy and suggest designs when you ask it to. What you type into those features is sent to the model provider to produce the answer. Do not put personal information about other people, or anything confidential, into them. Output is a draft for you to check, never a finished statement of fact, and you remain responsible for what you publish. We do not use your content to train third-party foundation models.
Building a website by talking uses AI too, if you switch it on: the recording of each answer can be written down by Groq or OpenAI, and the words tidied by Gemini or Anthropic's Claude, as set out under who else sees your information. You see what was heard before anything goes on your page, and we do not keep the recording.
10. Marketing and messages
Messages about your own account — confirming an email address, resetting a password, security notices, receipts — are part of running the service. They are not marketing and you cannot switch them off while you have an account, because they are how you keep control of it.
Marketing is different. We send it only where you have specifically agreed, we ask about each channel separately — email, text message and phone call are three permissions, not one — and nothing is pre-ticked. Agreeing is never a condition of signing up or of using anything here. You can withdraw at any time, from the same place you agreed, with no reason and no email to anybody; withdrawal takes effect immediately and we keep a record of it.
This satisfies the US CAN-SPAM Act and the Telephone Consumer Protection Act for calls and texts, and the state telemarketing and marketing-consent laws that go further.
Complaints about a message you did not ask for go to armstrongwebdev@gmail.com, and we act on them the day we get them.
11. Changes to this policy
We update this policy when what we do changes. The date at the top always shows when the wording last changed. Where a change materially reduces your rights or widens what we do with your information, we will tell you before it takes effect and, where the law requires consent for the change, ask for it rather than assume it. Carrying on using the site after a minor change means you accept it.
12. Contact and complaints
For anything about this policy, your information, or a right you want to use:
- Armstrong Web Development
- Trading as AWD CMS
- Email: armstrongwebdev@gmail.com
- Website: https://awdcms.com
If you are not happy with our answer, you can complain to your state Attorney General or the Federal Trade Commission. You do not need our permission and you do not need to come to us first.