Jaik (Design by Jaik, a web design studio operated by John Kariuki, sole proprietor, in Renton, WA) ("we," "us," or "our") values your privacy. This Privacy Policy explains what information we collect, how we use it, and your choices regarding that information when you visit jaikmarketing.com (the "Site") or use our services. This policy applies to all visitors, regardless of location, and is designed to comply with applicable U.S. laws including the Washington Privacy Act, the California Consumer Privacy Act (CCPA/CPRA), and the EU General Data Protection Regulation (GDPR) where applicable.
1. Information We Collect
We collect the following categories of information:
- Contact information — name, email address, and phone number submitted through our contact, quote, booking, and checkout forms.
- Business information — business name, industry/trade, project goals, and service interests you voluntarily provide.
- Booking & scheduling data — when you book a strategy call via our native scheduling system at /book, we collect your selected date/time, time zone, name, email, and phone number to create the appointment and a Zoom video meeting link.
- Onboarding form responses — after a paid project is initiated, you may be asked to complete a JotForm onboarding questionnaire (brand assets, content, business details). Responses are stored by JotForm and forwarded to us via secure webhook.
- Device & browser data — device type (mobile/tablet/desktop), browser name, operating system, viewport size, and screen resolution.
- Approximate location — city, region, country, and metro area derived from your IP address via a third-party geolocation API (ipapi.co). We do not store your IP address.
- Usage & behavioral data — pages visited, sections viewed, scroll depth, time on page, referrer URL, UTM campaign parameters, CTA button clicks, exit-intent triggers, and A/B test variant assignments (used to test layout and copy variations).
- Promotional gating signals — small, non-identifying flags stored in your browser's localStorage to remember if you have already booked a call or completed checkout, so we can hide or alter promotional elements such as exit popups.
- Payment information — processed directly by Stripe; we do not store credit card numbers or full payment details on our servers. We retain Stripe customer IDs, transaction IDs, subscription IDs, and amounts for accounting and account management.
- Authentication data — if you create an account, we store your email address and a hashed password. Authentication emails (verification, password reset, magic links) are sent from noreply@jaikmarketing.com via our verified email domain.
- Anti-spam signals — we collect a hashed/truncated form of your IP address and timestamps for rate limiting, plus the value of a hidden honeypot field, to prevent automated form abuse.
2. Legal Basis for Processing (GDPR)
Where GDPR applies, we process your personal data on the following bases:
- Consent — for analytics tracking, marketing communications, and SMS notifications.
- Contractual necessity — to fulfill web design services you have engaged us for.
- Legitimate interest — to improve our site, prevent fraud, and ensure security.
- Legal obligation — to comply with applicable laws and regulations.
3. How We Use Your Information
- To respond to your inquiries and provide the services you request.
- To schedule, confirm, reschedule, and remind you of strategy calls booked through our native booking system, including generating Zoom video meeting links.
- To send SMS and email follow-ups related to your inquiry, booking, or project (with your consent).
- To send transactional emails (booking confirmations, payment confirmations, project updates) from our verified domain.
- To send authentication emails (email verification, password resets) from our verified domain.
- To process one-time payments and recurring subscription billing (e.g., monthly hosting and SEO retainers) and manage your account via Stripe.
- To deliver post-purchase onboarding (JotForm questionnaire) and gather the information needed to build your website.
- To analyze site usage, run A/B tests of layout and copy variants, and improve our website's performance, design, and conversion rates.
- To prevent fraud and abuse via rate limiting, honeypot anti-spam fields, and event deduplication.
- To personalize the experience of returning visitors (e.g., hiding promotional prompts for visitors who have already booked or purchased).
- To comply with legal obligations.
4. Analytics, Cookies & Consent
We use a combination of a custom, first-party analytics system and Google Tag Manager (GTM) with Google Analytics 4 (GA4, property ID G-RED75Z8606) and Google Ads conversion tracking (ID AW-413089823). Our custom analytics captures session-based engagement data (scroll depth, sections viewed, CTA clicks, A/B test variant assignments, and exit-intent triggers) using a randomly generated session ID stored in your browser's sessionStorage. This ID is not linked to your personal identity and is discarded when you close your browser tab. We use IP-based geolocation to determine approximate location (city/county level) but do not store your IP address in plaintext; we may store a short-lived hashed/truncated form solely for rate limiting and abuse prevention.
A/B testing: We periodically test variations of layout, copy, and offers. The variant you see is recorded with your session so we can measure which version performs better. No personally identifying information is required for A/B tests.
Google Analytics and Google Ads may use cookies to measure site usage and ad conversions. The data these services receive includes cookie identifiers, device and browser details, approximate location, and the pages and actions recorded on this site. It is used for measurement and advertising optimization, and it is processed by Google as described in Google's privacy policy.
How we handle consent. We do not display a cookie banner. Instead, we apply the rules of the visitor's location:
- If you are in the European Economic Area, the United Kingdom, Switzerland, or Quebec, we load no analytics or advertising scripts at all. Google Consent Mode stays denied for your visit, and we also block loading when your location cannot be determined.
- Everywhere else, including the United States, analytics and advertising cookies are used by default and you may opt out at any time. Your opt-out choice always overrides this default.
You can turn analytics and advertising cookies off for your browser at any time on our Your Privacy Choices page, which is linked in the footer of every page. The change takes effect immediately and we remember it on that device. You can use the same page to opt out of the sale or sharing of personal information and targeted advertising, to stop calls, texts, and marketing email, or to request access to or deletion of your data. We also honor Global Privacy Control signals where required by law.
Essential cookies are required for basic site functionality (for example session management and remembering your privacy choice) and cannot be disabled. Analytics cookies help us understand how visitors use the site (custom analytics + GA4). Marketing cookies are used for Google Ads conversion measurement.
5. SMS Communications
Program: Low-volume SMS notifications (<30 messages/month) for lead alerts, payment confirmations, and project updates. Consent is obtained via checkbox on jaikmarketing.com forms and/or SMS reply YES/SUBSCRIBE. Reply STOP to unsubscribe at any time. Reply HELP for assistance. Message and data rates may apply. Your phone number is not shared with third parties for marketing purposes.
SMS Consent: By checking the SMS consent checkbox on our forms, you consent to receive SMS notifications from Jaik (John Kariuki, jaikmarketing.com) regarding your inquiry, updates, or follow-ups. Consent is not required to make a purchase. Message frequency varies. SMS is delivered via Twilio; your phone number is shared with Twilio solely for delivery purposes.
Marketing Consent (optional): You may also choose to receive occasional tips, offers, and promotional updates from Jaik. This is entirely optional and not required to submit a form or receive services. You can withdraw marketing consent at any time by replying STOP to any marketing message or contacting us directly.
6. Email Communications
All emails from Design by Jaik are sent from our verified domain (jaikmarketing.com) with proper SPF, DKIM, and DMARC authentication to ensure deliverability and prevent spoofing. Email types include:
- Authentication emails — email verification, password resets, and magic links sent from noreply@jaikmarketing.com.
- Lead notifications — internal alerts sent from leads@notify.jaikmarketing.com.
- Payment confirmations — customer receipts sent from confirmations@notify.jaikmarketing.com.
All transactional emails include an unsubscribe mechanism. You may opt out of non-essential emails at any time.
7. Third-Party Services
We share limited information with the following service providers, solely to operate our business:
- Stripe — processes one-time payments and recurring subscriptions (e.g., monthly hosting and SEO retainers). Stripe receives your name, email, billing address (when applicable), and payment details, and stores a customer record on our behalf. See Stripe's Privacy Policy.
- Twilio — delivers SMS messages and tracks message delivery status. Twilio receives your phone number and message content. See Twilio's Privacy Policy.
- Zoom — provides video conferencing for booked strategy calls. We use Zoom's Server-to-Server OAuth integration to programmatically create meeting links; Zoom receives the meeting metadata (date, time, attendee email and name) and any data you submit when joining a Zoom call. See Zoom's Privacy Statement.
- JotForm — hosts our post-purchase onboarding questionnaire. JotForm receives any information you submit through the onboarding form (brand assets, business details, content) and forwards it to us via secure webhook. See JotForm's Privacy Policy.
- Google (Tag Manager, Analytics 4, Google Ads) — used for analytics and conversion tracking only after you grant analytics/marketing consent. Google may receive cookie identifiers, device and browser data, and event data. See Google's Privacy Policy.
- Supabase — provides our managed backend (database, authentication, storage, and serverless functions). All data we collect is stored in a Supabase project hosted in the United States with Row-Level Security enabled. See Supabase's Privacy Policy.
- Resend — delivers our transactional and authentication emails from our verified domain. Resend receives recipient email addresses and message content. See Resend's Privacy Policy.
- ipapi.co — provides approximate geolocation from IP addresses for analytics and city personalization. We do not share personal data with ipapi.co beyond what is implicit in a standard IP-based lookup.
- Domain and DNS providers (IONOS, Lovable) provide DNS and email domain hosting for jaikmarketing.com and for our legacy domain, which redirects here.
We do not sell, rent, or share your personal information with any other third parties for marketing purposes.
8. Data Retention
Contact form submissions, booking records, onboarding responses, and SMS logs are retained for up to 24 months to support ongoing client relationships and comply with legal/regulatory requirements. Analytics data (page views, engagement metrics, A/B test assignments) is retained for up to 12 months for performance analysis. Authentication data is retained for as long as your account is active. Payment, subscription, and invoice records are retained for at least 7 years to comply with U.S. tax and accounting laws. You may request deletion of personal data at any time (see Section 9), subject to legal retention obligations.
9. Your Rights
Depending on your location, you may have the following rights:
- Access — request a copy of the personal data we hold about you.
- Correction — request correction of inaccurate data.
- Deletion — request deletion of your personal data ("right to be forgotten").
- Portability — request your data in a portable format (GDPR).
- Restrict processing — request we limit how we use your data (GDPR).
- Object to processing — object to processing based on legitimate interest (GDPR).
- Opt-out of sale — we do not sell personal information, but you may exercise this right under CCPA.
- Opt-out of SMS — reply STOP to any message or contact us directly.
- Withdraw consent — withdraw previously given consent at any time.
To exercise any of these rights, email us at ayealvink@gmail.com or call (253) 293-1550. We will respond within 30 days (or 45 days for CCPA requests, with notice).
10. California Residents (CCPA/CPRA)
If you are a California resident, you have additional rights under the CCPA/CPRA:
- Right to know — what personal information we collect, use, disclose, and sell.
- Right to delete — request deletion of your personal information.
- Right to opt-out — we do not sell or share your personal information for cross-context behavioral advertising.
- Right to non-discrimination — we will not discriminate against you for exercising your CCPA rights.
In the preceding 12 months, we have collected the categories of personal information described in Section 1. We have not sold personal information. We have disclosed personal information to service providers (Stripe, Twilio) for business purposes only.
11. International Data Transfers
Our servers and service providers are located in the United States. If you are accessing our Site from outside the United States, your data will be transferred to and processed in the U.S. By using our Site, you consent to this transfer. Where GDPR applies, we rely on standard contractual clauses or other approved transfer mechanisms.
12. Data Security
We implement industry-standard security measures including encrypted connections (TLS/SSL), Row-Level Security on our database, server-side rate limiting, honeypot spam protection, and verified email domain authentication (SPF/DKIM/DMARC). However, no method of transmission over the internet is 100% secure.
13. Children's Privacy
Our Site and services are not directed to individuals under the age of 13 (or 16 under GDPR). We do not knowingly collect personal information from children. If we learn that we have collected such information, we will promptly delete it.
14. Changes to This Policy
We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. Material changes will be communicated via email or a prominent notice on our Site. Your continued use of the Site after changes constitutes acceptance of the updated policy.