Privacy Policy

This Privacy Policy describes how Rivet Bay LLC(“Rivet Bay,” “we,” “us,” or “our”) handles information collected through rivetbay.com and its related forms, tools, and subdomains (collectively, the “site”). Rivet Bay is a web design and SEO/AEO agency based in Weymouth, Massachusetts, serving businesses nationwide.

In this policy, “personal information” means information that identifies, relates to, or could reasonably be linked to you or your device. This policy covers the site only. It does not cover information we process under a separate written agreement with a client, which is governed by that agreement.

We collect only the information you choose to share and limited technical data:

• Contact and project inquiries. Your name, email address, current website (optional), and the details of your message.
• Discovery-call bookings. Your name, email, phone number, time zone, website (optional), and the topic you want to discuss, used to schedule the call.
• Job applications. Your name, email, phone (optional), a portfolio or LinkedIn link (optional), your resume file, and any cover note. Your resume is sent to us as an email attachment.
• Site-audit tool. If you use our site-performance checker, the website URL you submit so it can be analyzed and a report returned to you.
• Technical and usage data. Standard request information collected automatically — such as IP address, browser and device type, referring page, approximate (country-level) location, timestamps, and error diagnostics — used for security, spam prevention, rate limiting, aggregate analytics, and reliability.

Please do not submit sensitive personal information (for example, government identifiers, financial account numbers, or health information) through the site’s forms. We do not request it and the forms are not intended to receive it.

We use the information above to:

• Respond to your inquiry and provide the services or information you request.
• Schedule and confirm discovery calls.
• Evaluate job applications and communicate with applicants.
• Generate the site-audit report you requested.
• Protect the site from spam and abuse, and keep it running reliably and securely.
• Understand, in aggregate, how the site is used so we can improve it.
• Comply with our legal, tax, and recordkeeping obligations, and enforce our terms.

Where required by law, our legal bases for processing are: performing or responding to your request and taking steps at your request; our legitimate interests in operating, securing, and improving the site; your consent (where we ask for it); and compliance with legal obligations.

We do not sell your personal information for money. To measure and improve our marketing, we use, or may in the future use, advertising and analytics technologies (described under “Cookies, advertising, and analytics” below) that involve sharing online identifiers with partners such as Google. Under some U.S. state privacy laws this activity may be considered “sharing” for cross-context behavioral advertising or a “sale.” You can opt out at any time — see “Your U.S. state privacy rights” below.

We rely on a small set of trusted third parties to operate the site. Each processes only the data needed for its function, on our behalf, under its own privacy terms:

• Resend — delivers form submissions (including resume attachments) to us by email.
• Cloudflare Turnstile — verifies that form submissions come from a person, not a bot; receives your IP address and challenge data.
• TidyCal — powers discovery-call scheduling and stores your booking details.
• Upstash — provides the rate-limiting datastore that briefly records IP-based request counts to prevent form abuse.
• Google PageSpeed Insights— when you use the site-audit tool, the URL you submit is sent to Google’s API to generate the report.
• Cloudinary — serves images on the site through its content delivery network.
• Sentry — captures application errors (no session replay) so we can diagnose and fix problems.
• Vercel — hosts the site and provides privacy-friendly, aggregate Analytics and Speed Insights.
• Advertising and analytics partners— to measure our marketing and reach potential clients, we use, or may in the future use, services such as Google (Google Ads and Google Analytics) and conversion or remarketing pixels (such as the Meta pixel). These partners may set cookies and receive online identifiers and activity data, as described under “Cookies, advertising, and analytics.”

Our fonts are self-hosted and served from our own domain, so loading the site does not send your information to a font provider. We may also disclose information when required by law, to respond to lawful requests, to protect our rights and safety or those of others, or in connection with a merger, acquisition, or sale of assets.

We use cookies and similar technologies for three purposes: those that are strictly necessary for security and anti-spam (such as Cloudflare Turnstile); those that help us measure site performance in aggregate (such as Vercel Analytics); and — now or in the future — advertising and analytics technologies that help us understand and improve our marketing.

For advertising and marketing measurement, we use, or may in the future use, third-party services and tracking pixels, including Google Ads, Google Analytics, and conversion or remarketing pixels (such as the Meta pixel). These technologies may set cookies and collect online identifiers, device and browser information, and information about your activity on our site so we can measure campaigns, understand our audience, and show relevant ads to you on other platforms. Where required by law, we will ask for your consent before using non-essential advertising or analytics cookies.

You can manage cookies through your browser settings and opt out of advertising-related sharing as described under “Your U.S. state privacy rights.” We honor the Global Privacy Control (GPC) signal as a valid request to opt out of the sale or sharing of personal information for the browser on which it is enabled.

We keep personal information only as long as needed for the purposes described above, then delete or anonymize it. In general: inquiry and booking information is kept while we correspond with you and for a limited period afterward for our records; job-application materials are kept for up to about twelve months unless you are hired or you ask us to delete them sooner; site-audit URLs are not retained beyond generating your report; and rate-limiting IP records are short-lived and expire automatically. We may retain information longer where required to meet legal, tax, or recordkeeping obligations or to resolve disputes.

We maintain reasonable technical and organizational measures designed to protect personal information against unauthorized access, loss, or misuse, including encrypted transport, access controls, and reputable infrastructure providers. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

Depending on your state of residence (for example, California under the CCPA/CPRA, and comparable laws in states such as Virginia, Colorado, Connecticut, Utah, and Texas), you may have the following rights regarding your personal information:

• To know or access the personal information we have collected about you.
• To request correction of inaccurate personal information.
• To request deletion of your personal information.
• To opt out of the sale or sharing of your personal information for targeted advertising.
• To not be discriminated against for exercising these rights.

Categories we collect and why

In the past twelve months we have collected identifiers (such as name, email, phone, and IP address), professional information (such as your company, website, and resume details), and internet/usage activity (such as technical and analytics data). We collect these for the business purposes described in “How we use your information,” and we disclose them to the service providers and advertising/analytics partners listed above to perform those purposes.

Sale and sharing; how to opt out

We do not sell your personal information for money. However, our use of advertising and analytics technologies (such as Google Ads and conversion or remarketing pixels) may be considered a “sale” or “sharing” for cross-context behavioral advertising under some U.S. state privacy laws. You have the right to opt out: email us at the address below, or enable the Global Privacy Control (GPC) signal in your browser, which we honor as a valid opt-out request. We do not knowingly sell or share the personal information of consumers under 16.

How to exercise your rights

Email hello@rivetbay.com or write to us at 847 Washington Street, Weymouth, MA. We will respond within the time required by law (generally 45 days, with an extension where permitted). To protect your information, we may need to verify your identity before acting on your request, and we may decline requests where an exception applies. You may use an authorized agent to submit a request on your behalf with proof of authorization.

We are based in the United States and do not target our services to the European Economic Area, the United Kingdom, or Switzerland. If you access the site from those regions, we process your personal information on the legal bases described above and honor the rights available to you under the GDPR and UK GDPR — including the rights to access, rectify, erase, restrict, object to, and port your personal information, and to withdraw consent where processing is based on consent.

Because we operate from the United States, your information will be processed there; where required, we rely on appropriate safeguards for international transfers. You have the right to lodge a complaint with your local data protection or supervisory authority. To exercise any of these rights, contact us using the details below.

The site is intended for businesses and is not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact us and we will delete it.

The site may link to third-party websites and services we do not control. We are not responsible for their content or privacy practices, and this policy does not apply to them. Review their policies before providing personal information.

We may update this policy from time to time. When we do, we will revise the “last updated” date above. Material changes will be reflected on this page.

Questions about this policy or your information, or to exercise a privacy right, contact Rivet Bay LLC by email at hello@rivetbay.com or by mail at 847 Washington Street, Weymouth, MA.