PRIVACY POLICY

John August Design LLC
Effective Date: September 10, 2026

This policy explains what happens to information when you visit johnaugustdesign.com (the "Site") or get in touch with John August Design LLC ("we," "us," or "our"). We're a design studio in Missoula, Montana. The Site exists so people can see our work and reach us, and the data practices behind it are limited. All of them are described below in plain language.

Two points up front: nothing you type into a form on this Site goes to an advertising company, and the one analytics tool on the Site stays off until you choose to allow it. There are no advertising tags.

1. Information you give us

Contact form. The form on our Contact page asks for your first name, last name, email address, and message, plus a phone number if you want to include one. Google reCAPTCHA protects this form (see section 3).

Quote request. The quote form at /get-a-quote asks what you're after, then walks through a few questions about your business: its name, what you do and where, your current website if you have one, and details about the project, such as the size of the site, the pages or features it needs, the searches you want to show up for, whether you've run ads before and what you spend on them, where your brand stands today, what needs designing, and what kind of ongoing help you want. If you're asking about a privacy and tracking audit, it also asks what's prompting the audit, whether an attorney is involved, what platform the site is built on, and which tools are running on it. The last step asks for timing, a budget range, your name, your email address, how you'd like to hear back, a phone number when you ask for a call, and anything else you want to add.

Email, phone, and text. When you reach out directly using the details on the Site, we receive whatever you choose to send.

How we use it. To answer you, talk through the project, and send a proposal, an agreement, or an invoice when we work together. We keep the conversation in our email and in our project records.

Where it comes from. Directly from you. When you ask about a project, we may also look at your public website, your business listings, and your public social profiles to understand the work before we reply.

A note on legal matters. If you're contacting us about a demand letter or a lawsuit, keep the form to the basics and we'll talk it through by phone. We're designers and developers. Nothing you send us is protected the way a conversation with your attorney is.

2. Information collected automatically

Hosting logs. The Site runs on Squarespace. Like every web host, Squarespace records standard server logs when your browser requests a page: your IP address, browser type and version, operating system, the page requested, the time, and the page that referred you. These logs exist to deliver and secure the Site.

Squarespace visitor statistics. Squarespace gives us page-level visitor counts, general traffic sources, and approximate visitor location by region. That information is held by our hosting provider, and it is not sent to an advertising company.

Your cookie choice. A consent tool called Cookiebot runs the cookie banner and records what you chose (section 3).

Google Analytics, if you allow it. With your permission, Google Analytics collects information about your visit: an identifier stored in your browser, the pages you view, the site that sent you here, your device and browser details, and your approximate location derived from your IP address. Nothing loads and nothing is sent until you allow statistics cookies on the banner. We keep the Google signals feature turned off, so Google Analytics does not connect your visit to a Google account or to your activity on other sites for advertising.

What is not here. The Site has no advertising tag from Google or Meta, no session replay, no heat maps, no chat widget, and no embedded social feeds. Section 4 lists every outside service that receives anything at all.

3. Cookies and similar technologies

A cookie is a small file a website stores in your browser. Some tools use related methods, such as browser local storage, which work the same way for the purposes of this policy.

Essential. A few cookies are required for the Site to work: a Squarespace security token that protects the forms, and the cookie that remembers your consent choice for up to 12 months. These carry no advertising identifier, and they are set without asking because the Site cannot function without them.

Squarespace visitor statistics. Squarespace sets its own cookies when a page loads to produce the visitor counts described in section 2. They identify a browser to Squarespace only, and nothing from them goes to an advertising company.

Statistics. Google Analytics cookies count visits and show which pages people read. They are set only after you allow them. The banner lets you allow all, deny all, or choose by category, and it saves your choice for twelve months. Denying, or ignoring the banner, leaves them off.

Advertising. None. The Site sets no advertising cookies, whatever you choose on the banner.

You can change your choice at any time through the Cookie Preferences link in the footer of every page, and you can delete cookies in your browser settings.

reCAPTCHA. The contact form is protected by Google reCAPTCHA, which runs as soon as the Contact page loads, whatever you chose on the banner. It sends Google your IP address, your browser and device details, and how you interact with the page, and it may set Google cookies. Google states that it uses this information to run and improve reCAPTCHA and for general security purposes, and that it is not used for personalized advertising. If you'd prefer to skip reCAPTCHA, email or call us instead.

Do Not Track. Browsers can send a "Do Not Track" signal, and there is no agreed standard for how a website is supposed to read it. The Site does not respond to Do Not Track signals. The banner is where you control analytics on this Site, and we honor the Global Privacy Control signal as described in section 9.

Other parties collecting across sites. No advertising company collects information about your online activities over time and across different websites through this Site. When you allow statistics cookies, Google Analytics collects information about your visit to this Site and sends it to Google, with Google signals off as described in section 2. If you deny them, or make no choice, no analytics company collects anything through this Site either. The other Google services on the Site, reCAPTCHA on the contact page and the typeface, are described in section 4, and Google states that reCAPTCHA data is not used for personalized advertising. Google's own description of how it uses information from sites that use its services is at policies.google.com/technologies/partner-sites.

4. Who receives information about your visit

That is the full list. Squarespace's privacy practices are described at squarespace.com/privacy. Cookiebot's are at cookiebot.com/en/privacy-policy. Google's are at policies.google.com/privacy.

5. How we use information

We use the information described above to:

• Answer your message and talk through a project
• Send a proposal, an agreement, or an invoice when we work together
• Keep the Site running, fast, and secure
• Understand which pages people read, so the Site gets better, when you've allowed statistics cookies
• Keep business records and meet legal and tax obligations

We don't build advertising profiles, and we don't make automated decisions about you.

6. How we share information

We don't sell your personal information, and we don't share it for cross-context behavioral advertising.

We disclose information only to:

• Service providers who run parts of the studio on our behalf: our web host, our consent tool, our email provider, and the software we use for proposals, agreements, invoices, and bookkeeping. Each is limited to what it needs to do that work.
• Google, which receives the information described in section 4: for reCAPTCHA on the contact page and for the typeface on every page, and for Google Analytics when you allow statistics cookies.
• Legal process, where a law, subpoena, or court order requires it, or where disclosure is needed to protect the studio's rights, safety, or property.
• A business transfer, if the studio is ever sold or merged, in which case information transfers with it.

7. How long we keep information

We may keep information longer where the law requires it or where we need it to establish, exercise, or defend a legal claim. You can ask us to delete your information at any time (section 14), and we will unless we're required to keep it.

8. How we protect information

We keep reasonable administrative, technical, and physical safeguards designed to protect personal information from unauthorized access, use, disclosure, or loss. Access to our Squarespace account, our email, and the accounts behind the Site is limited to the people on our team who need it, and each of them signs in with their own credentials. The Site is served over an encrypted connection. No website or storage method is completely secure, and we don't claim otherwise. If a security incident affects your personal information, we will notify you, and any authorities the law requires, without unreasonable delay, consistent with Montana's data breach law (Mont. Code Ann. § 30-14-1704) and the law of your own state.

9. Your choices

Cookies. Use the Cookie Preferences link in the footer of any page to change your choice at any time.

Global Privacy Control. If your browser or an extension sends a Global Privacy Control signal, we treat it as a request to opt out of the sale or sharing of your personal information and of targeted advertising. We don't sell or share personal information and we don't run targeted advertising, so no such activity happens in any case. The signal does not change your statistics choice, which you make on the banner. You can read about the signal at globalprivacycontrol.org.

Google Analytics directly. You can block Google Analytics in most desktop browsers with Google's opt-out add-on at tools.google.com/dlpage/gaoptout.

Email. We don't run a newsletter. If you'd like us to stop emailing you about anything, reply and say so, and we will.

Access, correction, deletion. Ask us what we hold about you, ask us to fix it, or ask us to delete it, using either method in section 14. We answer these requests wherever you live.

10. California residents

In the twelve (12) months before the Effective Date, we collected the following categories of personal information, as California law defines them: identifiers (your name, email address, phone number, and IP address); commercial information (the business and project details you give us when you ask for a quote, including a budget range); internet or other electronic network activity information (the pages you request, your browser and operating system, the referring site, your interaction with the contact page as observed by reCAPTCHA, and, when you allow statistics cookies, the Google Analytics data in section 4); and approximate geolocation derived from your IP address. We collect it directly from you, automatically from your browser through our hosting provider and the services in section 4, and from your public website, business listings, and public social profiles when you ask about a project. We collect it for the purposes in section 5, we disclose it only to the recipients in section 6, and we keep it for the periods in section 7. We do not collect or process sensitive personal information as California defines it.

Sale and sharing in the past twelve months. During that period the Site carried Google Analytics without a consent gate, a Google Ads tag, a Meta tag, and a SearchAtlas script. The Google Ads and Meta tags sent browser identifiers, pages viewed, and approximate location to those companies for cross-context behavioral advertising, which California law treats as sharing and, in some cases, as a sale. The Google Ads, Meta, and SearchAtlas tags were removed before the Effective Date, Google Analytics now stays off until you allow it, and the Site does not sell or share personal information today. We did not sell personal information for money, and we do not knowingly sell or share the personal information of anyone under 16.

If you are a California resident, we give you these rights, following the California Consumer Privacy Act as amended by the California Privacy Rights Act:

• To know what personal information we collect, use, and disclose about you
• To delete personal information we hold about you, subject to legal exceptions
• To correct inaccurate personal information
• To a copy of the personal information you gave us, in a usable format
• To opt out of the sale or sharing of personal information. We don't sell or share it, and a Global Privacy Control signal is honored as an opt-out in any case
• To limit the use of sensitive personal information. We don't collect it
• Not to be treated differently for exercising any of these rights

To exercise them, email hello@johnaugustdesign.com or call (406) 381-8981. We verify a request by asking you to confirm information you already gave us. You can use an authorized agent, and we may ask for proof of their authority. We confirm receipt within ten (10) business days and respond within forty-five (45) days of a verifiable request, which we may extend by another forty-five (45) days where reasonably necessary, and we'll tell you why. There is no fee.

Shine the Light. California Civil Code section 1798.83 lets California residents ask about personal information disclosed to third parties for those parties' own direct marketing. We don't disclose personal information for that purpose.

11. Residents of other states

Montana, where we're based, along with Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Florida, and a growing list of other states, has a privacy law that gives residents rights over their personal data. We extend those rights to everyone, whichever state you live in: to confirm whether we hold your personal data, to get a copy, to correct it, to delete it, and to opt out of targeted advertising, the sale of personal data, and profiling that produces legal or similarly significant effects.

We don't run targeted advertising, we don't sell personal data, and we don't profile visitors. To exercise any other right, contact us by either method in section 14. We confirm receipt within ten (10) business days and respond within forty-five (45) days, with the same one-time extension described in section 10. If we decline a request, you can appeal by replying to our response or by emailing us with "Appeal" in the subject line. We respond to an appeal in writing within forty-five (45) days, and if we decline again we'll tell you how to submit a complaint to your state's attorney general.

12. Children

The Site is for businesses and the people who run them, and it is not directed to children. We don't knowingly collect personal information from anyone under 16. Consistent with the federal Children's Online Privacy Protection Act, we don't knowingly collect personal information from children under 13, and if we learn that we have, we delete it promptly. If you're a parent or guardian and believe a child has sent us information, contact us using the details in section 14 and we'll delete it.

13. If you become a client

Building or maintaining a website means we get access to systems that belong to you: your hosting account, your domain, your analytics, your ad accounts, your email platform, and sometimes your customers' information inside them. We treat all of it as yours. We use it only to do the work you hired us for, we don't use it for our own purposes, we don't use your customers' information to market anything of ours, and we hand back or remove our access when the engagement ends. Your services agreement covers this in detail, and this policy does not replace it.

14. Contact

Questions about this policy, or requests about your information:

John August Design LLC
Missoula, Montana
hello@johnaugustdesign.com
(406) 381-8981

Put "Privacy" in the subject line and it reaches the right person faster.

15. Changes to this policy

When this policy changes, the updated version goes on this page and the Effective Date at the top changes with it. If a change is material, we post a notice describing it at the top of this page for at least thirty (30) days. We review this policy at least once every twelve (12) months and update it when our practices change.