Privacy policy

This policy explains what personal information I collect through thexconcept.com, how I use it, who I share it with and the choices you have. The X Concept is a one-person business run by me, Charles Oreve, so “I”, “me” and “The X Concept” in this policy all mean the same thing.

Summary

• I collect only what I need to answer you, book calls, run client projects and understand how the site is used.
• I do not sell personal information for money.
• Analytics and advertising cookies only run if you allow them in the cookie banner. Your browser’s Global Privacy Control signal is honored automatically.
• You can ask to see, correct or delete your information at any time by emailing info@thexconcept.com.

1. Information I collect

Information you give me

• Contact details such as your name, email address, phone number and company, when you email or call me, or book a call.
• Booking details when you schedule a call through Calendly: your name, email, the time you pick and any answers you add about your project.
• Project information you share as a client or prospective client, such as website logins, content, brand files and business details. I treat logins and credentials as confidential and store them securely.
• Billing details such as billing contact and address. Card or bank payments are handled by the payment provider named on the invoice; I do not store full card numbers.

Information collected automatically

• Device and usage data: pages visited, referring site, approximate location (city or region, derived from your IP address), browser and device type. This is collected through Google Analytics only if you allow analytics cookies.
• Advertising measurement data: whether you arrived from an ad and whether you then contacted me. Collected through Google Ads or LinkedIn tags only if you allow marketing cookies.
• Server logs: like every website, the hosting server records IP addresses and requests for security and troubleshooting. These logs are kept for a short time.

Information from other sources

• Public reviews you leave on Google, which may be shown on this site with your name and photo as they appear on Google.
• Business contact information that is publicly available (for example on your company website or LinkedIn) when I research a potential project.

2. How I use your information

• To reply to your messages, hold intro calls and send estimates.
• To deliver client work: building and maintaining websites, SEO, advertising, email marketing, social media and IT services.
• To send invoices, keep business and tax records, and meet legal obligations.
• To understand how the site is used and improve it (only with analytics consent).
• To measure whether advertising works (only with marketing consent).
• To protect the site and my clients against fraud, spam and security threats.

I do not use your information to make automated decisions that have legal or similarly significant effects on you.

3. Legal bases (visitors from the EU, EEA, UK and Switzerland)

Where these laws apply, I rely on: your consent (analytics and marketing cookies, which you can withdraw any time); performing a contract or taking steps before one (estimates and client work); legal obligations (tax and accounting records); and my legitimate interests in running and securing the business and replying to enquiries, balanced against your rights.

4. Who I share information with

I share personal information only with service providers that help me run the business, under contracts that limit how they may use it:

• Website hosting provider, which stores the site and its server logs.
• Google (Google Workspace for email, Google Tag Manager, Google Analytics and Google Ads, the last two only with your consent).
• Calendly, to schedule calls. Calendly’s scripts load only when you click a booking button.
• LinkedIn, only if you allow marketing cookies and LinkedIn ads are running.
• Accounting, invoicing and payment providers, and my accountant.
• Map tiles from OpenStreetMap, which receives your IP address when you open the client map (no cookies are set).

I may also disclose information if required by law, to protect my rights or the safety of others, or as part of a sale or transfer of the business.

5. Selling and sharing (California)

I do not sell personal information for money. If you allow marketing cookies, advertising partners such as Google and LinkedIn may receive identifiers and browsing activity to measure ads and show ads on other sites. California law may call this “sharing” for cross-context behavioral advertising. You can opt out at any time on the Your privacy choices page or with “Cookie settings” at the bottom of every page, and the site honors Global Privacy Control automatically. I do not knowingly sell or share the personal information of anyone under 16.

Categories of personal information (last 12 months)

I do not collect sensitive personal information as defined by California law, other than account logins you give me to work on your website, which I use only for that purpose.

6. How long I keep information

• Enquiries that do not become projects: up to 2 years after the last contact.
• Client records, contracts and invoices: as long as we work together, then 7 years for tax and legal reasons.
• Website logins: deleted or rotated when the project or maintenance ends.
• Analytics data: 14 months in Google Analytics.
• Cookie consent records: about 13 months, without any IP address or name.

7. Security

I use encrypted connections (HTTPS), two-factor authentication, a password manager for client credentials, regular updates and backups. No method of transmission or storage is completely secure, but I take reasonable steps to protect your information and will notify you as required by law if a breach affects it.

8. Your rights

Depending on where you live, you may have the right to:

• Know and access the personal information I hold about you and get a copy of it.
• Correct inaccurate information.
• Delete your information, subject to legal exceptions (for example tax records).
• Opt out of the sale or sharing of personal information and of targeted advertising.
• Withdraw consent to cookies at any time with “Cookie settings”.
• Object to or restrict processing and ask for data portability (EU, EEA, UK).
• Not be discriminated against for using any of these rights.

These rights apply to California residents under the CCPA/CPRA, to residents of other US states with comprehensive privacy laws (such as Colorado, Connecticut, Oregon, Texas and Virginia), and to people in the EU, EEA, UK and Switzerland.

How to make a request

Email info@thexconcept.com or call (808) 344-5043. I will confirm receipt within 10 business days and respond within 45 days (30 days in the EU and UK). I will verify your identity by matching information you give with what I already hold; I may ask for one more detail, never for sensitive documents. An authorized agent may make a request for you with your signed permission. If I decline a request, you can appeal by replying to my answer with “Appeal” in the subject line; I will answer the appeal within 45 days. If you are in the EU, EEA or UK, you may also complain to your local data protection authority.

9. Global Privacy Control and Do Not Track

This site treats a Global Privacy Control (GPC) signal from your browser as a valid request to opt out of the sale or sharing of your personal information, and turns marketing cookies off automatically. Browsers’ older “Do Not Track” setting has no common standard; analytics and marketing cookies stay off unless you allow them.

10. Children

This site is meant for businesses and is not directed to children under 16. I do not knowingly collect personal information from children. If you believe a child has given me information, email me and I will delete it.

11. International visitors

I am based in the United States and the site is hosted in the United States. If you visit from another country, your information is processed in the United States, where privacy laws may differ. Where required, transfers rely on the service providers’ standard contractual clauses or the EU-US Data Privacy Framework.

12. When I work on your website

When I build or maintain a website for a client, I process the personal information on that website (for example its contact form entries) on the client’s behalf and only to provide the services. The client’s own privacy policy governs that information.

13. Links to other sites

Case studies and pages link to client websites and other services. Their privacy practices are their own; please read their policies.

14. Changes to this policy

I will update this page when my practices change and change the date at the top. If the changes are significant, the cookie banner will ask for your choices again.

15. Contact

The X Concept (Charles Oreve)
8525 Gibbs Drive, Suite 304, San Diego, CA 92123
Email: info@thexconcept.com
Phone: (808) 344-5043

Other legal pages

• Terms of use
• Cookie policy
• Accessibility statement
• Your privacy choices
• Disclaimer