What we collect, and what we do with it.

The short version

We collect the least we can get away with, we tell you what we do with it, and we do not sell it. If you only read one section, read this one.

• We ask for your name, email and organization when you request something from us. That is so we can send it and follow up.
• We use Google Analytics to see which pages are useful. It is aggregate, and you can opt out.
• We take payments through Stripe. Card numbers never reach our servers.
• We do not sell your data, and we do not share it for advertising.
• You can ask us what we hold on you, and ask us to delete it. Email hello@optimisticweb.co and a person will action it.

Who we are

Optimistic Digital Agency is a Colorado-based web and brand studio working mainly with government agencies, school districts, nonprofits, and recovery organizations. This policy covers optimistic.digital, optimisticweb.co, and the client portal we host for our clients.

If you want to reach a real person about anything on this page, email hello@optimisticweb.co. That address is read by us, not a ticketing robot.

What we collect, and why

We collect different things depending on how you use the site. Nothing here is collected speculatively, each item exists because something would break without it.

When you just visit

Our host and CDN record standard server logs: IP address, browser type, the page you asked for, and when. This is ordinary web infrastructure and is used for security and diagnosing faults. Google Analytics also records an anonymized view of your visit, covered in its own section below.

When you request a checklist, a guide, or a template

We ask for your name, work email, and organization. We use them to send you the thing you asked for, and to follow up once or twice with related help. Every email we send has an unsubscribe link, and unsubscribing does not cost you the resource you already downloaded.

When you use the website grader

You give us a website address and answer a few questions about how your organization runs that site. We fetch that page publicly, exactly as any visitor would, and score it. We do not log in to anything, we do not scan anything private, and we only read the page you name.

Your score is stored for 24 hours so the results link keeps working and can be forwarded to a colleague. After that it is deleted automatically. The lead record, your name, email, organization, the URL and the score, is kept so we know who we have already helped.

When you book a call

We store your name, email, organization, the time you chose, and anything you type into the notes field. It is used to hold the meeting and to prepare for it. If you tell us about a problem in that box, treat it as something a small team will read.

When you become a client

We create a portal account and hold what running the work requires: contact details, your projects and their status, invoices, files and proofs you upload, support requests, and messages between us. This is business record-keeping, and we keep it for as long as you are a client plus the period below.

When you pay us

Payments run through Stripe using their hosted checkout. Card numbers, expiry dates and security codes go directly to Stripe and are never stored on, or seen by, our servers. We keep the resulting record: what was bought, when, the amount, and a Stripe reference so we can find it again.

Analytics and cookies

We use Google Analytics to understand which pages actually help people and which ones do not. It tells us things like "forty people read the accessibility checklist this week", not who those people are.

We do not run advertising pixels, retargeting tags, session recorders, or heat-mapping tools on this site.

Cookies we set ourselves

WordPress sets a session cookie when you log in to the client portal, which is what keeps you signed in. The site also remembers whether you chose light or dark mode. Neither is used for tracking or shared with anyone.

A deliberate choice about fonts

Our typefaces are self-hosted rather than loaded from Google Fonts. That means visiting this site does not quietly send your IP address to Google just to render text. It was more work, and it is the right default for an audience that includes public agencies.

Who else touches your data

We do not sell your personal information, and we do not share it with anyone for their own marketing. We do use a small set of service providers to run the business. Each one only receives what it needs to do its job.

We may also disclose information if the law genuinely requires it, for example a valid subpoena or court order. If that ever happens and we are permitted to tell you, we will.

How long we keep things

• Grader results: 24 hours, then deleted automatically.
• Lead and enquiry records: up to 3 years from your last contact with us, so we do not ask you the same questions twice.
• Client records, projects and messages: for the life of the relationship, then 7 years, which is the practical window for contract, tax and audit purposes.
• Payment records: as long as Stripe and our accountants require, generally 7 years.
• Server logs: a short rolling window held by our host.

If you ask us to delete something sooner, we will, unless we are legally required to keep it. We will tell you plainly if that is the case.

Your rights over your data

Depending on where you live, you may have formal rights under laws like the GDPR or the Colorado Privacy Act. We extend the substance of these to everyone who asks, regardless of where you are, because drawing that line felt petty.

• Ask what we hold about you, and get a copy.
• Correct anything that is wrong.
• Ask us to delete it.
• Object to us using it, or ask us to restrict how we do.
• Take it elsewhere in a portable format.
• Unsubscribe from any email, at any time, with one click.

To use any of these, email hello@optimisticweb.co. We do not require a form, a portal account, or a specific phrase. We aim to respond within a few business days and never longer than 30 days.

How we protect it

The whole site is served over HTTPS. Portal accounts are password protected, and password reset links are single-use and time-limited. Payment card data never reaches our infrastructure. Access to client data is limited to the small number of people at Optimistic who need it to do the work.

We are not going to claim that any of this makes a breach impossible, because no one can honestly claim that. What we will commit to is telling you promptly and specifically if something goes wrong that affects your data.

Children

This site is aimed at people doing their jobs, and is not directed at children under 13. We do not knowingly collect their information. If you believe a child has sent us something, email us and we will remove it.

Changes to this policy

When we change how we handle data, we update this page and change the date at the top. If a change is significant, for example adding a new category of data or a new provider, we will say so clearly rather than quietly editing a line.

Contact us

Questions, requests, or a concern about how we handled something: email hello@optimisticweb.co. If you are a public agency and need this in a specific format for a procurement or vendor review, tell us what you need and we will produce it.