Privacy policy

When you hire me to build and run your online presence, you connect a few accounts so I can work on your behalf. With your permission I access your Google Business Profile (through Google's business.manage scope), the Google email tied to that profile, and your Facebook Page and Meta Pixel. I only request the access I need to do the work you've hired me for.

It's so I can build and manage your presence for you. That means updating your Google Business Profile, posting and replying for you, setting up and reading your Facebook Page, and reading Pixel data to see what's working. I don't use your accounts for anything outside the work you've agreed to.

When you connect an account, Google and Meta hand me an OAuth token instead of your password. I never see or store your passwords. Those tokens are encrypted at rest. I use them only to do your work, and I never sell your data or your tokens to anyone, for any reason.

My use of data from Google APIs follows Google's API Services User Data Policy, including the Limited Use rules. I use Google data only to provide and improve the features you've hired me for. I don't transfer it to others except as needed to run those features, to comply with the law, or as part of a sale of the business. I don't use it for ads, and nobody reads it except where you allow it, where it's needed for support or security, or where the law requires it.

Revoke my access directly in your own account settings and it takes effect right away: for Google, go to your Google Account's Security page under "Third-party apps with account access"; for Meta, go to your Facebook settings under "Business Integrations". You can also email josh@tannerpreserve.co and I'll disconnect it on my side and confirm when it's done. There's no disconnect button inside the client hub yet, so use one of those two paths. Once access is revoked, my tokens stop working and I can't reach that account anymore.

Email josh@tannerpreserve.co and ask me to delete your data. I'll delete the OAuth tokens and the information I hold tied to your accounts, and confirm when it's done. I may keep records I'm legally required to keep (like invoices), and I'll tell you if that applies.

If you fill out a form or book a call before becoming a client, I collect your name, email, phone, and whatever you tell me. I use that to reply and follow up. I use Cal.com for scheduling, so Cal.com's privacy policy covers anything you do there. You can opt out of follow-up anytime.

On the public pages of this site (the marketing pages, the audit and the report it hands back, and the client demo pages under /t/) I run four analytics tools: Plausible for page counts, Google Analytics 4, the Meta Pixel for the ads I run, and PostHog for product analytics. Between them they record which pages you view, roughly where you are (from your IP address, not GPS), your device and browser, what you click, and which ad, link, or search sent you. Clicks on a phone number or a booking link get counted as events too. Turning JavaScript off doesn't stop all of it: two hidden one-pixel Meta images still count the visit on those same public pages. Plausible doesn't use cookies. Google, Meta, and PostHog do, and each is a separate company with its own privacy policy. The signed-in pages don't ask for any of it. Your account page, your build page, the client hub, the CRM, and my internal dashboards request no third-party scripts, so opening one of them directly loads no trackers at all. One honest caveat: if you're already on a public page and click straight through to a signed-in one without reloading, the scripts that public page loaded are still running in that tab until you reload or open a new one. I don't send them anything from the signed-in pages, but I'd rather tell you they're still in memory than claim a clean slate I can't guarantee. There's no cookie banner here today, so if you'd rather not be measured anywhere, a browser tracking blocker stops most of it, Google publishes an opt-out add-on for Analytics, and Meta lets you limit pixel data in your Facebook ad settings. I don't sell any of it.

Some of my phone lines are answered by an AI assistant, and it says so at the start of the call. Calls may be recorded and transcribed so the message actually reaches the right person and so I can check the AI did its job. The assistant discloses recording up front. Recordings and transcripts are stored securely, used only to deliver the service, and deleted on request.

If you call one of my numbers and miss me, ask me a question, or a business you worked with asks me to send you their review link, you may get a text from me. These are account and service messages only, not marketing, and message frequency depends on your interactions with me (usually a handful of texts around a call or request, not an ongoing series). Message and data rates may apply. I never sell or share your mobile number with anyone. Reply HELP for help or STOP to opt out, and I stop immediately and permanently unless you text START later.

Clients sign into a hub to see reports, request reviews, and send change requests. I store your account email, what you do in the hub, and the work I log for you (that's how your monthly report proves what happened). I don't sell any of it.

When a client uses my tools on their own customers (a review request, a missed-call text-back, an answered call), I process that customer's name, number, and message on the client's behalf and instructions. I use it only to deliver that service to the client, I don't market to the client's customers, and I delete it when the client asks or leaves.