Privacy Policy

The short version

We collect two things on this site: what you type into the contact form, and measurement of how the pages are used. We do not sell your information. We do run one advertising tracker, the Meta pixel, which tells Facebook and Instagram that you visited so we can measure our own ads. If you would rather not be measured or tracked at all, turn it off. The site works exactly the same either way.

If you connected a Google Calendar to a CRM we built for the business you work at, Google Calendar in the CRMs we build says what that connection reads, keeps and never does.

Who we are

GENESIS 98 LLC, trading as GENESIS 98, is a marketing agency in the United States. We build websites and run local SEO and paid search for other businesses. We are the business responsible for the information described here. In the language of these laws, the “business” and the “controller”.

Registered address: 22704 Ventura Blvd #246, Woodland Hills, CA 91364. This policy covers genesis98.com, and the Google Calendar connection in the CRMs we build for clients, described in its own section below. It covers nothing else.

It does not cover the websites we build and run for our clients. Each of those has its own privacy policy, and on those sites the client is the business responsible for your information. We handle it on their instructions. See Information we handle for our clients below.

This site is available to visitors in the United States only. Requests from outside the US are refused at the edge before a page is served.

What we collect, and why

What you send us

The contact form asks for your name, a phone number or email address so we can reply, and what you need. Your website and your trade are optional. The offer that may appear as you leave the site asks for your website and where to send our reply. Submitting either one sends what you typed to us by email and into our own lead records, which only our team uses. It does not subscribe you to any marketing list. If you arrived through a link carrying campaign tags, those tags travel with your message so we can tell which link brought you.

The form also carries one hidden field that you never see and never fill. Automated submissions fill it; people do not. If it arrives filled, the message is discarded. It collects nothing about you.

If you reach us by WhatsApp, text message or phone instead, we hold whatever you send in that conversation, in the same way any business holds a message you sent it. Messaging or calling us does not sign you up for marketing messages, and we do not send them. WhatsApp is operated by Meta and text and voice by your carrier; what those companies do with the fact of the message is governed by their terms, not ours. Standard message and data rates apply.

What the site measures

Unless you turn it off, this site uses Google Analytics 4 to count how the pages are used: which pages were opened, roughly where in the country the visit came from, what kind of device and browser, how you arrived, and how long you stayed. It is aggregate traffic measurement. We have not enabled Google Signals, which is the setting that would let Google add demographics and cross-device history from people signed in to a Google account.

Since 11 September 2026 this property has been linked to our Google Ads account, with ad personalisation switched on. That means Google can use what it records here to build advertising audiences and to show you our own advertising elsewhere. Until that date this page said we had enabled none of Google’s advertising features, and for as long as it stood that was true. Turning the analytics off stops the collection that feeds it, using the same control described below.

Unless you turn it off, this site also loads the Meta pixel. It tells Meta, meaning Facebook and Instagram, that a browser opened a page here, along with the page address, your IP address, and an identifier Meta keeps in a cookie named _fbp. We use it to measure whether our own advertising works and to reach people who resemble the people who visit us. This one is advertising rather than counting, and under California law it counts as sharing your information. The same switch turns it off, and turning it off also clears that cookie.

Our host, Vercel, keeps ordinary server logs for delivering and securing the site. Your IP address, the request, the time, and your browser’s user-agent string. Every web server does this, and a site cannot be served without it.

Your cookie choice is stored in your own browser, not on our servers. We cannot read it and it never leaves your device.

What we do not collect

No session replay or mouse recording. No fingerprinting. No CAPTCHA service. No data brokers, and nothing bought about you from anyone. We do not knowingly collect sensitive personal information: government identifiers, financial account details, precise geolocation, health data, biometric data, racial or ethnic origin, religious beliefs, sexual orientation, union membership, or the contents of your mail and messages, and we ask you not to send any of it through this form.

The same thing, in the law’s own categories

California and the states that followed it require this to be set out using their categories rather than ours, with the purpose, whether any of it is sold or shared, and how long it is kept. Here it is that way. It is the same information as the section above, relabelled.

Identifiers

Your name, phone number or email address, and your IP address. Collected to answer you, and to deliver and secure the site. Not sold, not shared. Kept for the life of the conversation and our business records; IP addresses only for the short period our host retains server logs.

Internet or other electronic network activity

Pages viewed, how you arrived, and how long you stayed. Collected to measure how the site is used. Not sold, not shared. Kept under the analytics property’s retention setting, then deleted automatically. Not collected at all if you opt out.

Geolocation data (approximate only)

A rough region derived from your IP address, never precise location. Collected to understand where our traffic comes from and to enforce the US-only restriction. Not sold, not shared. Retained as above.

Commercial information

Only what you choose to tell us about the work you want done. Collected to answer you. Not sold, not shared. Kept with the inquiry.

Sensitive personal information

None. We do not collect it, so there is nothing to limit the use of, and nothing to disclose.

Biometric, audio, education, employment, and inferences or profiles

None of these. We build no profile about you and draw no inferences about your characteristics.

Every category above comes from one of two sources: you gave it to us, or your browser sent it in the course of loading the page. We buy nothing about you from anyone.

Who it reaches

Each company below does one job for us. Every row says what it sees and what it is allowed to do with it.

Vercel

Hosts and serves the site. Sees the request and the server log that comes with it. Contractually a service provider: it may not use any of it for its own purposes.

Resend

Delivers the contact form to our inbox. Sees what you typed into the form, because that is what is being delivered. Contractually a service provider: it may not use any of it for its own purposes.

Google Analytics

Measures page usage, and only while you have not turned measurement off. Governed by Google’s terms rather than ours.

Meta

Receives the fact that a browser opened a page here, so we can measure our advertising on Facebook and Instagram and reach similar people. Only while you have not turned measurement off. Meta uses what it receives for its own purposes as well as ours.

Google reCAPTCHA

Tells us whether a form submission came from a person or a script, which is the only thing standing between our inbox and automated spam. It runs only on the pages with a form, and only once you put the cursor in a field. To make that judgement Google receives your IP address and how you interacted with the page, and sets a cookie in your browser. Google uses what it receives to provide and improve reCAPTCHA, under its own terms rather than ours.

Beyond those: nobody, unless we are required to disclose something by law, by a court, or to establish or defend a legal claim, or unless the business is sold or merged, in which case the information moves with it and this policy travels with the information.

We do not sell your information. We do share some of it.

We have never sold personal information and we do not intend to. Selling means exchanging it for money or other value, and we have not done that.

Sharing is a narrower and more specific thing, and since 8 Sep 2026 we do it. The Meta pixel described above passes your visit to Meta for cross-context behavioural advertising, which is exactly what California law means by that word. We are telling you rather than leaving you to infer it from a cookie list. Before that date this section said we had never shared anything, and for as long as it stood that was true.

Since 11 September 2026 there is a second channel. The Google Ads link described above lets Google use what this site records to build advertising audiences, which counts as sharing under the same definition. The control below governs both, because both depend on the measurement it switches off.

You can stop it. At the foot of every page there is a control titled Do Not Sell or Share My Personal Information. Refusing there stops the pixel loading, silences one that is already running, and clears the cookies it set. It is one switch and it governs the analytics too; our cookie policy lists exactly what it turns off. We also honour Global Privacy Control, so a browser sending that signal is opted out on arrival without pressing anything.

We never share the contents of the contact form for advertising, we do not knowingly share the personal information of anyone under 16, and we do not profile you in a way that produces legal or similarly significant effects.

How long we keep it

• Inquiries. As long as we are in a conversation with you, and afterwards for as long as we need the record for tax, accounting or legal purposes. If a conversation goes nowhere, we delete it when it stops being useful.
• Analytics. Held by Google under that property’s retention setting and then deleted automatically.
• Server logs. Kept by our host for a short operational period and then rotated out.
• Your cookie choice. Stays in your browser until you change it or clear your browser data.

Your rights

California’s CCPA, as amended by the CPRA, and the comparable comprehensive privacy laws now in force in many other states give residents a set of rights over their personal information. That list grows most years, which is why it is described this way here rather than typed out. A roster in a policy is a roster that goes quietly out of date.

We honour every right below for anyone who asks, wherever you live and whether or not a law requires it of a business our size. Sorting visitors by state to decide who gets a right is not a thing we want to spend our time doing.

• Know and access. Ask what we hold about you, where it came from, why we have it, and who has received it. You can ask for a copy in a portable format.
• Delete. Ask us to delete what we hold, subject to the records we are legally required to keep.
• Correct. Ask us to fix anything inaccurate.
• Opt out of sale, sharing and targeted advertising. We do none of these, so there is nothing to opt out of, but the request is honoured and recorded if you make it.
• Opt out of profiling in decisions with legal or similarly significant effects. We do not do this either.
• Limit the use of sensitive personal information. We do not collect any.
• Opt out of measurement. Available on every page, with no account and no request to us. See the cookie policy.
• No retaliation. Exercising any of these changes nothing about the service or the price you are quoted.
• Appeal. If we refuse a request, you may appeal, and we will answer the appeal in writing with our reasons.

Browser signals

This site honours Global Privacy Control. If your browser or extension sends the GPC signal, we treat it as a valid opt-out on arrival: analytics does not load, and you are not asked again. You can still turn measurement on for this site if you want to, and that later choice wins, because it is more specific and it is yours.

A growing number of states now require a business to recognise a universal opt-out signal. California, Colorado and Connecticut have each confirmed that GPC is one, and in September 2025 the three of them opened a joint investigation into businesses that were not honouring it. We honour it for everybody rather than checking which state you are in first.

We do not act on the older Do Not Track header, which no standard was ever agreed for. GPC is the one that means something, and we act on it.

How to make a request

Email ib@genesis98.com or call 747 302 4566. Say what you want done. You do not need to use a particular form of words, and there is no fee.

Or write to us at 22704 Ventura Blvd #246, Woodland Hills, CA 91364. Post is slower and we would rather you emailed, but it works and we will not ignore it.

We will confirm receipt within 10 days and answer within 45 days. If a request is genuinely complicated we may take one further 45 days, and we will tell you why before we do. An appeal is answered within 45 days.

We will ask you to confirm enough for us to be reasonably sure the request is yours. Usually by replying from the address or number the information is attached to. We use what you give us for verification and nothing else. An authorised agent may act for you with your written permission, and we may still confirm the request directly with you.

California residents may also ask, once a year, for a list of any personal information disclosed to third parties for their own direct marketing (the “Shine the Light” law). Our answer is that there is none, and we will say so in writing on request.

Information we handle for our clients

Most of what we touch day to day is not ours. When we run a website, an analytics property, a Google Business Profile or an advertising account for a client, the client decides what is collected and why, and we act on their instructions. In the language of these laws, they are the controller or business, and we are the processor or service provider.

If you filled in a form on a client’s website and want your information corrected or deleted, ask that business directly. They hold the relationship and the record. If you reach us instead, we will pass it to them and tell you we have.

We do not use client data for our own purposes, we do not combine one client’s data with another’s, and we do not sell any of it.

Google Calendar in the CRMs we build

We build and run customer relationship software, a CRM, for our clients, each at the client’s own web address. Inside it, each person who works there can connect their own Google Calendar. That connection goes through one Google app that belongs to GENESIS 98, named GENESIS 98 CRM, so this section is ours to answer for in whichever client’s CRM you use it. Connecting is your choice, and the CRM works without it.

What it asks Google for

Two permissions, and nothing else.

• View and edit events on your calendars (calendar.events). Used to put your appointments on your calendar and, if the CRM is set to two-way, to read your busy times.
• Your Google account’s email address (userinfo.email). Used only to show you which account is connected.

It cannot see your email, your contacts, your files or anything else in your Google account.

What the CRM does with it

The connection does one job: it keeps the appointments booked for you in the CRM on your primary Google Calendar. How far it goes depends on the setting the business running the CRM chose.

• One-way. An appointment booked for you in the CRM goes onto your calendar as an event, with its title, time, location and a link to the customer’s record in the CRM. When the CRM changes, reassigns or cancels it, the event is changed or removed to match.
• Two-way does all of that, and two more things. It reads the other timed events on your primary calendar so the CRM’s schedule can show those times as Busy. Google sends those events to the CRM, which keeps only each one’s start and end time, draws them as a block marked Busy that your colleagues in that CRM can see, and does not save them. It also checks the events the CRM itself created: move one in Google and the appointment moves in the CRM, delete one and the appointment is cancelled.

What is stored, and where

Connecting gives the CRM a long-lived key from Google, called a refresh token, so it can keep your calendar up to date without asking you to sign in again. The token is encrypted before it is saved, sealed to your own account so it cannot be opened from anyone else’s, and kept in that client’s own database, in a table that no signed-in user of the CRM can read, administrators included. Only the CRM’s own server opens it, to talk to Google for you.

Beside it the CRM keeps the connected account’s email address, when it was connected and last synced, the last problem it had reaching your calendar, and, for each appointment it put on your calendar, the ID Google gave that event, so it can find the event again. Nothing else from your calendar is saved.

How long it is kept

Until you disconnect, until Google tells the CRM you removed its access, which the CRM learns the next time it tries to use the token, or until your account in that CRM is deleted. Each of those deletes the token and the event IDs. Disconnecting also revokes the token at Google. Events already on your calendar stay there, because they are yours.

What we never do with it

• Sell it, to anyone, for anything.
• Use it for advertising, including retargeting, personalised ads or building audiences.
• Transfer it to anyone else, except as needed to provide this feature, or where the law requires it.
• Let a person read it. Beyond the Busy blocks described above, nobody at GENESIS 98 or at the client reads your calendar data unless you have asked us to, it is needed for security such as investigating abuse, or the law requires it.
• Use it to train artificial intelligence or machine learning models, ours or anyone else’s.

GENESIS 98's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

How to disconnect

In the CRM, open your account page and choose Disconnect under Google Calendar. Or, at any time and without signing in to the CRM, remove GENESIS 98 CRM from your Google Account at myaccount.google.com/permissions. Either one stops the CRM reaching your calendar.

Notice at the point of collection

A short version of this. What the contact form takes, why, that it is not sold or shared, and how long it is kept. Sits beside the form itself, so you see it before you fill anything in rather than only if you come looking for this page.

No financial incentives, and no price for your privacy

We do not offer discounts, upgrades or anything else in exchange for your personal information, and we run no loyalty or financial-incentive programme. Nobody is quoted a different price for having opted out of anything.

This document

It is published in English, which is the only language we do business in. It is built to the same accessibility standard as the rest of the site. See the accessibility statement, so it can be read with a screen reader, at any text size, and by keyboard. If you need it in another format, ask and we will get it to you.

Children

This site is for businesses and is not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has sent us something, tell us and we will delete it.

Security

The site is served over HTTPS. Form submissions are transmitted encrypted, and the credentials our systems use are held as secrets outside the codebase. No system is perfectly secure, and anyone who tells you otherwise is selling something, but the amount of information this site holds is deliberately small, which is the most effective security measure available to it.

Changes to this policy

If we change it, the date at the top changes with it. Material changes will be announced on this page before they take effect. We do not backdate.