Practical data handling, written plainly.

1. Information we collect

We collect information you choose to provide, including your name, work email, business or organization, selected service, timing preference, inquiry description, safely shareable reference links, and later correspondence.

Our hosting and security providers may also process technical information needed to deliver and protect the site, such as IP address, browser and device information, request headers, timestamps, and security signals.

Please do not send passwords, credentials, payment-card details, regulated records, private customer data, government identifiers, health information, or other sensitive information through the intake form or ordinary email.

2. How we use information

• Review, route, and respond to business inquiries.
• Assess fit, clarify scope, prepare quotes, and manage approved work.
• Send a non-marketing receipt confirming that an inquiry reached the desk.
• Operate, secure, troubleshoot, and prevent abuse of the website and intake route.
• Measure website audiences and campaign performance, build advertising audiences, and show or suppress relevant follow-up advertising where those features are enabled.
• Maintain business, accounting, contractual, and legal records.
• Comply with law and protect NBW, its clients, and others.

3. Providers and disclosures

We use service providers that process information for us under their own terms and security commitments. The production intake architecture uses Vercel for website hosting and server execution, Resend for transactional email delivery, Google Workspace for the authorized NBW inbox, HubSpot for customer-relationship and inquiry-status records when CRM synchronization is enabled, Supabase for an internal, non-personal operational record of accepted inquiries when enabled, Google Tag Manager for website tag management, Google Analytics 4 for audience measurement, and Microsoft Clarity for privacy-masked heatmaps and session recordings.

We may enable additional measurement or advertising providers, such as Meta Pixel, LinkedIn Insight Tag, or Mixpanel, when their services are configured for this website. We will update this policy when the providers or our use of them materially changes.

We may also disclose information when required by law; to protect rights, safety, and systems; in connection with a business reorganization; or with your direction. We do not sell personal information for money or send intake-form contents to analytics or advertising providers. Website activity, cookie or device identifiers, and limited event data may be disclosed to configured providers to measure campaigns, create audiences, and deliver or suppress relevant advertising. Some privacy laws may define this use as sharing, targeted advertising, or a sale even when no money changes hands.

4. Cookies and analytics

We use Google Analytics 4 through Google Tag Manager to understand page visits, traffic sources, device and browser categories, and privacy-safe website interactions. Google Analytics advertising features may also support aggregated demographics and interests, advertising audiences, campaign measurement, and remarketing when enabled. These services may use first-party or third-party cookies and similar browser or device identifiers.

When enabled, we use Microsoft Clarity through Google Tag Manager to create heatmaps and session recordings that help us investigate website interaction and usability. Clarity is configured to mask all page content, and the intake form is additionally marked for masking. Meta Pixel and LinkedIn Insight Tag may be used for campaign measurement and website retargeting, and Mixpanel may be used for product or website analytics, only when the applicable provider has been configured for this website.

Our custom analytics and advertising events do not include information entered into the intake form, including names, email addresses, company names, phone numbers, or free-text messages. A phone_click event records only an intent to call; it does not establish that a call was placed, answered, or completed. Please do not submit sensitive information for use in advertising audiences.

For visitors identified as being in the European Economic Area, United Kingdom, or Switzerland, we do not load non-essential analytics or advertising tags until you make a choice. If location cannot be determined, we apply the same consent-first protection. Visitors in those regions can accept, reject, customize, or later withdraw consent through the “Privacy choices” control. For visitors positively identified outside those regions, our configured analytics, audience measurement, campaign measurement, and remarketing technologies may operate without displaying that regional consent prompt, subject to applicable law and browser or device controls.

The intake flow also uses security technology and, after a successful submission, a short-lived, essential, HTTP-only receipt cookie so the confirmation page does not falsely claim delivery.

5. Retention

We delete unconverted inquiry records no later than 12 months after the last meaningful inquiry activity, unless a shorter period is practical or a longer period is required to resolve a dispute, prevent abuse, or meet a legal obligation. If an inquiry becomes a client engagement, we retain client records according to the client agreement, accounting requirements, and other legal obligations.

Service providers may retain security logs, delivery records, and backups for their own limited operational or legal periods. We review retention practices and delete or request deletion when records are no longer needed.

6. Security

We use reasonable administrative and technical safeguards appropriate to a small business website, including server-side validation, spam protection, restricted inbox access, and no public file-upload route. No internet transmission or storage system is completely secure, so we cannot guarantee absolute security.

7. Your choices

You may ask to access, correct, or delete inquiry information, or ask a question about our handling practices, by emailing privacy@nashvillebusinessworks.com. We may need to verify your identity and may retain information where the law or a valid business record requires it.

Visitors who receive our regional consent prompt can reopen “Privacy choices” at any time to change or withdraw consent. You can also limit cookies through your browser and manage advertising preferences through Google Ads Settings, the Google Analytics opt-out browser add-on, Meta Ad Preferences, and LinkedIn advertising settings. Blocking or deleting cookies may affect how some website features work.

8. Business users, children, and location

This is a business-services website intended for adults acting in a business or organizational context. It is not directed to children under 13, and we do not knowingly collect personal information from children under 13. NBW operates from Nashville, Tennessee, and information is processed in the United States.

9. Changes and contact

We may update this policy as the website, providers, or legal requirements change. The effective date above will identify the current version. Material changes will be presented appropriately before they take effect.

Nashville Business Works, operated by Trey Hamm
Nashville, Tennessee
privacy@nashvillebusinessworks.com