Your information, stated plainly.

Columbia Data Group builds web apps, websites and advertising, and offers AI consulting and drone services. It is a business name of Columbia Groundwork Inc., a Washington corporation (“Columbia Data Group,” “we,” “us”). This policy explains what we do with personal information.

1. Who this policy covers

• Website visitors. Anyone who visits columbiadatagroup.com or sends a message through its contact form.
• Prospects and clients. People who call, email or meet with us about a project, and the staff of businesses we work for.
• People in our clients’ data. Customers, leads and users of a website, app or ad account we build or run for a client.

Our software products, including Eavedesk, have their own privacy policies on their own websites, and those policies govern the products.

2. Our two roles

We are the controller for website visitors, prospects and our own client contacts. We decide why and how that information is used, and this policy governs it directly.

We are a service provider for data that belongs to a client. When we build, host, maintain or advertise for a client, the client decides what is collected and why, and we handle the data on its behalf and under our agreement with it. If you are a customer or user of one of our clients, that client’s privacy policy applies to your information, and the client is your first contact. If you contact us instead, we will pass your request to the client within 5 business days and help it respond.

3. Information we collect

From website visitors

• Contact form. Your name, email, phone number and what you tell us in the “What is slowing you down?” box. Squarespace stores the submission and emails a copy to our inbox.
• Visit data. IP address, browser and device type, pages viewed, the page that referred you and timestamps, recorded by Squarespace and by Google Analytics using the cookies in section 8.
• Spam protection. The contact form uses Google reCAPTCHA, which looks at device and interaction signals to tell people from bots.

From prospects and clients

• Business contact details. Name, business name, email, phone number and mailing address.
• Calls and messages. Our business phone system logs the number, time and length of calls, voicemails and text messages. If we record a call, we tell you at the start of that call.
• Project information. Goals, content, photos, documents and access you give us so we can do the work, such as logins for a website, hosting account, domain, analytics or ad account.
• Billing information. Billing contact, invoices and payment records. We do not ask for or store full payment card numbers.

In client work

• Websites, apps and ad accounts. While we build or run them, we can see whatever the client’s systems hold: form submissions, customer records, orders, analytics and advertising audiences. We use it only to do the work the client asked for.
• Drone imagery. Aerial photos and video of a client’s property can include people, vehicles and neighboring property. We deliver the imagery to the client, and we will blur or remove an identifiable person or license plate if you ask.

We do not knowingly collect health information, government identification numbers or payment card numbers through our website.

4. How we use information

• Answer your message, prepare estimates and proposals, and follow up on a project you asked about.
• Do the work in a client agreement: build, host, maintain, advertise, consult, fly and support.
• Send invoices, collect payment and keep business records.
• Understand which pages and sources bring people to our website, and improve it.
• Keep our website, accounts and systems secure, and prevent spam and fraud.
• Comply with legal obligations and enforce our agreements.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We do not use one client’s data for another client. We use AI tools, including Anthropic’s Claude, in our own work. We do not put a client’s confidential or personal data into an AI tool unless our agreement with that client allows it.

5. Our affiliated businesses

Columbia Groundwork Inc. also runs an excavation business and a post-frame construction business. A client’s data, customer lists, leads and pricing are that client’s confidential information. We do not use them for, or disclose them to, our affiliated businesses. Where an affiliated business is our client, it is treated like any other client and has no access to other clients’ data.

6. When we share information

• Service providers. Vendors that run our website, email, phone and records on our behalf, listed in section 7, under terms that limit what they may do with it.
• Within a client project. With the client, and with vendors the client chose or approved for its project, such as its hosting company, domain registrar or ad platform.
• Legal requirements. When we are legally compelled, or to protect the rights, property or safety of our clients, the public or us. We disclose only what is required, and we tell an affected client unless the law forbids it.
• Business transfer. If Columbia Data Group is sold or merged, information transfers with the business, subject to this policy.

7. Service providers

These vendors process personal information for our own business. The list is accurate as of the date at the top of this page, and we update it when it changes.

• Squarespace: hosting for columbiadatagroup.com, the contact form and site visit statistics.
• Google: business email and documents (Google Workspace), website analytics (Google Analytics) and contact form spam protection (reCAPTCHA).
• HubSpot: our customer relationship management system for prospects and clients.
• Aircall: our business phone system for calls, voicemail and text messages.
• GitHub: source code hosting for the apps and sites we build.

Each client project also uses the hosting, payment and advertising vendors named in that client’s agreement or approved by the client.

8. Cookies and analytics

• Strictly necessary cookies that Squarespace sets for security, to protect forms and to keep site administrators signed in.
• Squarespace analytics cookies. ss_cvr and ss_cvt recognize a returning browser and count visits, so we see how many people visit and which pages they read.
• Google Analytics cookies. _ga and _ga_EWBK5N9ZZ0 tell visits from the same browser apart and expire after up to 2 years. They show which pages and sources bring people to the site. You can block them with Google’s browser opt-out add-on.
• reCAPTCHA on the contact form, under Google’s privacy policy and terms.

We do not use advertising pixels, retargeting or social media tracking on columbiadatagroup.com. You can block or delete cookies in your browser and the site still works, though the contact form needs reCAPTCHA to send. We honor Global Privacy Control signals where the law requires it. Browser “Do Not Track” signals have no agreed standard and we do not respond to them separately.

9. How long we keep information

• Contact form messages and prospect records are kept until you ask us to delete them or they go stale, whichever comes first.
• Client records, including agreements, project files and correspondence, are kept for the length of the relationship and as long afterward as our records retention schedule requires, generally up to 6 years for contracts.
• Client data in systems we run for a client is returned or deleted under that client’s agreement, and otherwise within 90 days after the service ends.
• Billing and tax records are kept as long as tax and accounting law requires, generally 7 years.
• Website analytics are kept under Google Analytics and Squarespace retention settings.

Backups age out on their own cycle, so deleted data can remain in a backup for a short time before it is overwritten.

10. How we protect information

• Access only for the people who need it for the work, with multi-factor authentication on the accounts that hold client data.
• Encryption in transit on our website and the systems we build.
• Client logins kept in a password manager, not in email or documents, and removed when the work ends.
• Updated, protected work devices.

No system is perfectly secure. If a breach affects your information, we will notify you, the affected client and regulators as the law requires.

11. Your rights and choices

Wherever you live, you can ask us to tell you what personal information we hold about you, correct it, delete it or give you a copy. We do not sell or share personal information for advertising, so there is nothing to opt out of there, and we will not treat you differently for making a request.

• Information we control (contact form messages, prospect and client contact records): email contact@columbiadatagroup.com. We verify your identity before acting.
• Information in a client’s systems: contact that client. We will help it respond.
• Marketing email: use the unsubscribe link in any marketing message. Messages about an active project, invoices or security are part of the service.

We acknowledge a request within 10 business days and respond within 45 days, extendable once by 45 days where the law allows, and we will tell you if we extend. An authorized agent may submit a request for you with written permission we can verify. You may appeal a denied request by replying to our decision, and you may complain to the Washington State Attorney General or the attorney general of your state.

12. Children

Our website and services are for businesses and are not directed to children. We do not knowingly collect personal information from anyone under 13. If you believe a child has sent us information, email contact@columbiadatagroup.com and we will delete it.

13. International visitors

We operate from Washington State and serve businesses in the United States. Our vendors may process information in the United States and other countries where they operate. If you contact us from outside the United States, you are sending information to the United States, where privacy law may differ from your own.

14. Changes to this policy

We will update this page when our practices change and revise the date at the top. For a material change that affects clients, we will tell them by email before it takes effect.

15. Contact us

Privacy questions, requests and complaints: contact@columbiadatagroup.com, (360) 218-5893, or by mail to Columbia Groundwork Inc., d/b/a Columbia Data Group, P.O. Box 1855, Castle Rock, WA 98611.

See also our Website Terms.