Privacy notice
Here is the plain version of how I deal with information about the businesses I write to. I make demo websites for small service companies in the US and email their owners about them, so this covers what I know about your business, where I found it, who helps me with it, how long it stays, and how to switch it all off. It also applies to anyone who opens one of my demo sites.
Want it to stop? One email does it.
Write to hi@michaelmakessites.com or send "stop" in reply to anything I've emailed you. After that, no more emails from me, your demo is taken down within 7 days (immediately, if you ask), and on request I delete what I hold about you. That's your right to object, and it costs nothing.
Who is responsible
Me: Mykolas Bira, who goes by Michael, running an individual activity (individuali veikla) registered in Lithuania. I decide what happens to this information, which makes me the controller under the GDPR. For anything about your data, write to hi@michaelmakessites.com.
What I have about your business
- Business details: name, trade, town, the address and opening hours on its listing, its website, plus the email address and phone number it published itself.
- Names of the owner or staff, where the business published them (for example on its Facebook page or in a post).
- Public content I use for the demo: photos, logo, services, reviews and ratings, and the text of public posts.
- The emails we exchange, and my notes on where things stand (for example "not now" or "stop").
- Records of visits to your demo site, described below.
Where it comes from
From places where the business or its owner published it:
- your Google Business Profile (your Google Maps listing);
- your business website;
- your Facebook page;
- posts you or your business made in Facebook groups, such as groups for contractors or local businesses.
What I use it for, and on what basis
I use it to make a demo site for your business, send it your way, and offer you a website by email, followed by a few reminders. The visit records show me whether the demo was opened, which tells me whether another email makes sense.
I rely on legitimate interests (Article 6(1)(f) GDPR): letting businesses that might want a website know what I offer. I try to keep the impact on you small: I write only to the address the business published, every email links here, one reply ends it all, and nothing outlives the periods in the table below.
Who helps me handle it
These services process the information for me, on my instructions:
- Google (Google Workspace and Google Maps data)My email: every email between us goes through it. Google's listing data is also how I look up a business on Google Maps.
- CloudflareHosts the demo sites and this site, stores the demo visit records, and delivers messages sent through a demo's contact form, after its spam check (Turnstile).
- Bright Data and ApifyCollect public Facebook content for me: posts, photos and page details.
- QuickEmailVerificationChecks that an email address can receive mail before I write to it. It gets only the address.
- GitHubStores the files of each demo site.
- Oracle CloudThe server that holds my lead database and its backups.
- Other IT and software servicesAnything else I use to keep my small business going; it handles your information only to do that job for me.
I don't sell your information, and I don't give it to anyone else for their own use.
Some of them are based in the United States or elsewhere outside the EU, so your information may be handled there. Where a provider offers them, the transfer rests on standard contractual clauses approved by the European Commission or on the EU-US Data Privacy Framework.
Visits to a demo site
When someone opens a demo site I made, the site records the visit: the date and time, the pages viewed, how long they stayed and how far they scrolled, the device, browser and window size, the page that linked to it, the browser's time zone, and a rough location and internet provider derived from the IP address. The address itself never goes into the record, only a scrambled (hashed) form of it, and no cookies are used.
How long things stay
| Data | How long | After that |
|---|---|---|
| Your business file: the name, the email and phone it lists publicly, how I found it, the facts behind the demo, and what we've emailed each other | 24 months after the last contact | Erased |
| My do-not-email list | Forever; the address itself only for as long as your record exists | Once your record is gone, just a SHA-256 hash of the address (in lower case), which is still enough to block it |
| Individual demo page views | 180 days at present; 45 days once the CRM's import of them has worked without a hitch for 30 days | Erased |
| Your demo's visit summary | 12 months after I close your file, or when your record goes, if that's earlier | Erased |
| The demo website | Online until the end date my emails mention (180 days after the first email, pushed back if you keep visiting); gone no later than 7 days after a stop or a no, or immediately on request | Unpublished |
| Anonymous tallies (per mailbox and step: how many emails went out, bounced or got a reply) | Forever | |
| Backups containing prospect data | The latest 30 daily copies, plus one copy a month for 24 months | Rotated out, so anything erased disappears from every backup within 24 months |
Your rights
- See what I have about you and get a copy (access).
- Have it corrected.
- Have it deleted. I keep only what stops me from contacting you again (the stop list above).
- Have its use limited (restriction).
- Object at any time, including to all direct marketing. Replying "stop" counts, and I stop at once.
To use any of these rights, email hi@michaelmakessites.com. I answer within one month.
And if you're unhappy with how I've handled your data, you can take it to the State Data Protection Inspectorate (VDAI), Lithuania's supervisory authority, at vdai.lrv.lt.
I make no decisions about you by automated means that have legal or similarly significant effects.
This website
No cookies, trackers or analytics run on michaelmakessites.com. Your IP address does reach Cloudflare, the host, because that's how a page gets to your screen; I keep no visitor log for this site.
Changes
If I change anything here, the "Last updated" date above moves too.