Privacy Policy

Last updated: 2026-11-01

This policy covers dewilliams.co, run by D. E. Williams and Company LLC. "I" in this policy means Daniel E. Williams and the company.

It explains what the site collects, which tools collect it, and how you choose. It's written to match what the site's code actually does.

The short version

• Nothing tracks you until you choose Accept. Until then, no Google Analytics or HubSpot tracking script loads and none of their cookies are set.
• Decline costs you nothing. The whole site works, including the office and the contact form.
• If your browser sends Global Privacy Control (GPC), I treat it as Decline and don't ask.
• You can change your choice at any time from Cookie settings in the footer.
• I don't sell your data.

1. Your cookie choice

When you first visit, a small panel asks whether to turn on Google Analytics and HubSpot tracking. Accept and Decline sit side by side, and each takes one tap. Scrolling or carrying on browsing isn't consent.

• Accept loads Google Analytics and the HubSpot tracking code, which set the cookies in section 4.
• Decline, or no answer at all, loads neither. The panel stays out of your way, and the site works the same.
• Global Privacy Control. If your browser sends a GPC signal, I treat you as declined and don't show the question. Cookie settings shows that GPC is on.
• Changing your mind. Open Cookie settings in the footer and choose again. If you withdraw consent, tracking stops from that point on, and the site deletes the Google Analytics and HubSpot cookies it can reach (_ga, _ga_<id>, hubspotutk and the __hs cookies). Choosing Decline deletes them too, including any left over from a visit before this panel existed.

Your choice is stored in your browser's local storage for dewilliams.co, so the site remembers it on your next visit. It isn't sent anywhere. Clearing your browser data clears it, and you'll be asked again. If I add a tool that tracks something new, the site asks you again.

2. What each tool collects

Google Analytics (only after Accept)

Google Analytics 4 tells me which pages people visit and how the site performs. With your consent it records:

• the pages you view, when, and how you arrived (the referring site)
• your device type, browser, screen size, language, and approximate location (country or city), which Google works out from your IP address
• page-speed measurements (Core Web Vitals)
• what happens in the office: when you enter it and from where, which objects you find, your finish time, and whether you open Subscribe or Contact from inside it

The speed and office measurements add no personal details. Like every Google Analytics hit, they carry the random ID in the _ga cookie, which lets Google count a returning visitor as the same visitor.

Google says Google Analytics 4 doesn't log or store IP addresses. Google still receives your IP address with each request, so I don't call this data "anonymized". Google signals is turned off, so Google Analytics doesn't link your visits to a Google account.

Google Analytics keeps event-level data for 2 months and user-level data for 14 months. The 14 months restart each time you visit again. After that, it's gone from detailed analysis. Totals, such as page views per month, stay in the standard reports. Google's policy: policies.google.com/privacy.

Before you choose Accept, Google Analytics sends nothing, not even cookieless pings.

HubSpot tracking code (only after Accept)

HubSpot is my CRM. With your consent, its tracking code loads three HubSpot scripts:

• Analytics (hs-analytics.net) records the pages you view on this site and your visits over time, under a random visitor ID in the hubspotutk cookie. If you later send the contact form, HubSpot links those earlier visits to your note, so I can see what you read before you wrote.
• Collected forms (hscollectedforms.net) may load, but form collection is switched off in my HubSpot account, so it records nothing, including the newsletter box.
• HubSpot's cookie-banner script (hs-banner.com) loads too, but shows nothing. The panel described in section 1 is the only cookie choice on this site.

There's no advertising pixel and no chat.

Both HubSpot's Breeze Intelligence data sharing and its AI training on my account's data are switched off.

HubSpot's policy: legal.hubspot.com/privacy-policy.

The contact form (whatever you choose)

The contact form sends your note straight from your browser to HubSpot (api.hsforms.com). It works the same whether you accepted or declined. It sends:

• your first and last name (split at the first space of what you type)
• your email address
• your message, with the subject you picked (Advisory, Speaking or Other) added at the top
• the address and title of the page you sent it from

While you've accepted, it also sends your hubspotutk visitor ID, which is how HubSpot links your earlier visits to the note. If you declined, or later withdrew, it isn't sent.

Like any web request, the note reaches HubSpot with your IP address and browser details, and HubSpot may record your IP address with it. Sending the form sets no cookies.

The newsletter

The subscribe box doesn't send your email address to me. It opens the newsletter's Substack page in a new tab with your address filled in, and you finish subscribing there. From then on, Substack holds your subscription under its own policy: substack.com/privacy. To unsubscribe or delete that data, use the link in any issue or contact Substack.

Hosting

The site is hosted on Amazon Web Services. No server of mine receives your data, and there's no login or account. I don't keep server request logs.

3. How I use it

• To read and reply to the notes you send me
• To see which pages and parts of the office people use, and whether the site is fast, so I can improve it
• To see what someone who has written to me read first (HubSpot, only if they accepted)

I don't sell your data, and I don't use it for advertising.

4. Cookies

None of these cookies are set before you choose Accept. After Decline, or with GPC on, none are set, and any left from an earlier visit are deleted. The site sets no cookies of its own.

Lifetimes are the providers' published defaults, from Google's and HubSpot's own documentation. Google's cookies are refreshed on each visit, so they last two years from your last visit. After Accept, HubSpot's tracking code may also keep some working data in your browser's storage.

__cf_bm belongs to HubSpot's domains, so the site can't delete it. It expires on its own after 30 minutes.

Your cookie choice itself is not a cookie (see section 1).

You can also block or delete cookies in your browser settings. The site still works if you do.

5. How long data is kept

• Contact form notes: in HubSpot until you ask me to delete them.
• Google Analytics: event-level data for 2 months, and user-level data for 14 months, restarting each time you visit again. Totals stay in the standard reports. The cookies expire as shown in section 4.
• HubSpot tracking data: the cookies expire after 6 months. HubSpot keeps the tracking data it has stored for a reasonable period of time under its own policy. If you've written to me, that data sits with your contact record until you ask me to delete it.
• Newsletter: held by Substack, under Substack's policy.
• Your cookie choice: on your device, until you change it or clear your browser data.

6. Security

• Every page is served over HTTPS, with HSTS, so browsers always connect securely.
• The site is static, with no database, login or server code of mine to break into.
• The contact form goes straight to HubSpot over HTTPS, and your note isn't stored on this site.

7. Your rights

You can ask me what I hold about you, to correct it, to delete it, or for a copy of it. You can withdraw consent at any time from Cookie settings. Depending on where you live, the law may give you more rights than these.

To make a request, send me a note through the contact form on the home page. To protect your data, I'll confirm the request came from your email address before I share or delete anything. I aim to answer within 30 days.

Substack holds newsletter data; see substack.com/privacy.

8. Changes

If what the site collects changes, I'll update this page and its date. If a change means tracking something new, the site asks you again.

9. Contact

D. E. Williams and Company LLC
Use the contact form at dewilliams.co.