Privacy policy

Who we are

This site belongs to Your Wish Is Our Code LLC, a small agency in Los Angeles, at 7300 W Sunset Blvd, Ste L #820, Los Angeles, CA 90046, and you can reach us by email at hello@yourwishisourcode.com. This policy covers the site, the inquiries sent through it, calls to our phone numbers, the blog's newsletter and the emails we send to businesses.

What the contact form collects

Your name and email address, plus your business name, phone number and website if you add them.

Your answers about what you need, your budget range and your timeline, and the message you write.

The start form in the site's footer stores nothing. Pressing Start opens the application page with what you typed in its address, which is how it reaches our server. That page fills in its first step from the address, then takes your words out of it. Nothing is kept until you send that step.

Website review requests

If you ask us to review your website, we keep your website's address, your email address and your phone number if you add it.

We use the address to look at your site's public pages and to run a speed test through Google PageSpeed Insights, which receives the address. We send you the link to your review by email, and the review stays at that private link for 30 days.

The request goes to our CRM like any other inquiry, and we may email you about the review, or call you if you gave us a number.

The AI visibility checker

When you use the AI visibility checker, our server sends the kind of business and the place you typed, with your IP address, to our CRM, which looks them up in the answers our study already stored. No AI service is asked, and nothing is looked up about you or your business.

Our CRM records each check: its time, the kind of business and the place in a simplified form, whether it was answered or refused, and a code made from your IP address and the day with a secret key. Our CRM holds both the code and the key, and uses the code to count your checks, at most 30 a day. Your IP address itself is not stored. If the study has no answers yet for a kind of business it covers, at a place it knows, our CRM also keeps a request to add that pair to the study: how many times it was asked for, when it was first and last asked for, and the words typed the first time. Our CRM keeps these records with no set end date.

If you ask for the full report by email, we keep your name and email address, plus your business name and website if you add them, and file them, with the kind of business, the place and the report's figures, as an inquiry, like the site's other forms. We send the report by email through Resend, our email provider, and the inquiry notes whether it went out. Our CRM then sends you a short note that it has your request, and the team may email you about it.

To stop automated requests, the server keeps your IP address in memory for ten minutes after a check or a report request, and the email address you typed for a day after you ask for a report. After a check, it also keeps your IP address with the kind of business and the place you typed and the checker's answer in memory for twenty minutes, so a report you ask for in that time uses that answer instead of a second check.

Where it goes

Your answers go to our CRM, the system we use to keep track of inquiries. If the CRM cannot be reached, they come to us by email through Resend, our email provider, and a copy of the answers is written to our server log so nothing is lost.

We use them to reply to you and to prepare a proposal. We do not sell them for money. What we share with Meta and Google to measure our ads is set out under Advertising and measurement, and you can stop it on the Your Privacy Choices page.

The newsletter

If you subscribe to the Friday note on the blog, we keep your email address, the day you signed up, whether you confirmed it and when, and when you left the list. Confirmed addresses are also kept at Resend, our email provider, which sends the emails.

We send one email with a confirmation link. Nothing else is sent until you open it and press Confirm.

Every email carries an unsubscribe link, and the page it opens takes you off the list with one press.

To stop automated sign-ups, the server keeps your IP address and the address you entered in memory for a while after a sign-up. They are not part of the list.

To have your address deleted everywhere, email hello@yourwishisourcode.com. We remove it here and at Resend.

Booking a call

When you book a call on our booking page, we keep the time you pick, your name and email address, and the note you add, if any.

Our CRM puts the call on our Google Calendar with your name, your email address and a Google Meet link for the call. It sends your confirmation itself, by email through Resend, our email provider.

Calls to our phone numbers

This is how calls are handled whenever a phone number is shown on this site.

Calls to our phone number, and to the numbers our ads show, are answered by an AI receptionist we built, once a screen lets them through. First our phone company turns away calls from numbers on spam lists or numbers that are not valid. It also turns away a call whose caller ID fails the carriers' check. A call it turns away never reaches our CRM.

Then our CRM turns away most numbers we have blocked. Callers we already know as a client or a prospect go straight through, and so do most callers on a mobile phone or a landline. Other callers, such as one on an internet phone line or with a hidden number, first hear a short recorded message asking them to press one. Pressing one puts the call through. Without it, the call ends there. To sort a number it does not know, our CRM asks our phone company what kind of line it is and which carrier it belongs to, and keeps that answer with the number.

Nothing is recorded before the screen lets a call through. From then on the call is recorded, and the first thing you hear is a short notice that says so. During the hours posted on this site, a member of our team may be connected to the call after the receptionist asks whether they can take it. The receptionist tells you before putting them through, and the call stays recorded once they join. No person joins a call that comes in outside those hours. Recordings and transcripts are stored on our systems to file your inquiry, schedule your call and prepare your proposal. Our team can read a written summary of a call there and play its recording.

A call our CRM turns away, or one that ends at the message, is never recorded. It leaves one entry under the caller's number, with the time and the reason, so we can let the number through if it was stopped by mistake. When a caller we do not know uses the call to sell us something, or asks for a person and will not say why, the receptionist ends it. A call like that has already passed the screen, so it is recorded like any other. A number that made a sales pitch may also be blocked. A blocked number stays on our list, with a note of why when we give one, until we remove it.

Recordings of inquiries we decline are deleted 30 days after the decision; clients' recordings are kept for the life of the engagement and one year after. Ask us to delete a recording at any time at hello@yourwishisourcode.com. The entry a call leaves with our CRM and the line type it looks up are kept with the inquiry they belong to, or with the caller's number when there is none. So are the recording and the transcript of a sales call. The same address takes a request to delete any of it.

Emails we send to businesses

We email some businesses we think our work could help. For each one we keep the business's name, website, email address and phone number as it publishes them, the ID of its Google Maps listing, and the name of someone who works there when its own website gives one. We take them from the business's own website and its public listing on Google Maps, and from nowhere else. We also keep what our checks note: whether its email address works, and a few facts about its website, such as whether it fits a phone's screen and the year its copyright line shows.

For some of these businesses we also review their website. We look at its public pages and run a speed test through Google PageSpeed Insights, which receives the website's address, and the review stays at a private link for 30 days.

We choose to treat these details as personal information, as California's privacy law, the CCPA, defines the term: we use them only to email that business about our work and to review its website, and we do not sell them or share them for advertising. The service that sends these emails, from mailboxes another company hosts for us, holds the list and the replies, and a service that checks that an address works may receive each address.

Every one of these emails carries a way to opt out, and we stop writing at once. After an opt-out, the business stays on our list marked as opted out, and we keep its email address, its website's domain, its phone number and the ID of its Google Maps listing on a do-not-contact list for good, so we never write to it again. We keep a business's entry on our list until the business asks us to delete it. To see, correct or delete what we hold about you or your business, email hello@yourwishisourcode.com.

Analytics

This site counts its own visits. A small script we wrote sends a few facts about each page you open to our own server, and from there to our CRM. None of it goes to an analytics company. The two advertising tags described in the next section are the only scripts on this site that load from another company.

What it records: the path of the page, without anything typed into its address; the site you came from, as a domain and never the full link; on the first page of a visit, the campaign labels of the link that brought you, if it had any (the utm tags an ad or a newsletter adds, never its click id); how long you keep each page open and how far down it you scroll, in quarters; clicks on the main buttons, which are start a project, book a call, subscribe, the phone number, the email address and the contact page; clicks on links that leave this site; how far you get in an application, a review request, a request for an AI visibility report or a booking, and whether a booking finishes; and what you do in the demo bakery on the work pages.

To tell one visit from another for a day, our server turns your IP address, your browser type and the date into a code with a secret key. Our CRM keeps only that code and cannot turn it back into your address, the code is never sent to or stored on your device, and tomorrow it is a different code. Your IP address itself is not stored with your visit; the server holds it in memory for a minute to limit how often one address can post.

It sets no cookies and keeps nothing in your browser. It does not record your name, your screen or device, or anything you type. Visits from crawlers and automated browsers are dropped.

Advertising and measurement

We pay for ads on Meta, which runs Facebook and Instagram, and on Google. To learn which ads bring us inquiries, our pages load two tags from those companies: the Meta Pixel and the Google Ads tag. The tags stay off while your browser sends Global Privacy Control, once you opt out on the Your Privacy Choices page, and on the pages that hold a private website review or confirm or end a newsletter subscription.

When the tags load, Meta and Google receive the address of each page you open, the site that sent you, your IP address, your browser and device type, and the ad you clicked, if you came from one. They also learn when you send a review request, a request for an AI visibility report or the first step of an application, when you book a call, and when you tap our phone number. When you send a request, an application or a booking, the tags also send the email address and phone number you gave us, hashed in your browser first. A hash is a code made from the address or the number: Meta and Google can match it to an account they already hold, but cannot read the address or the number back from it.

Our CRM keeps, with each request, which ad or link brought you, read from the cookies listed below, so we can see what each ad costs per inquiry. Later it may tell Meta and Google how the request went: that we qualified it, booked a call, sent a proposal or received a deposit, and the deposit's amount. It sends the ad's click id, if there was one, and your email address and phone number, hashed the same way. With a request, an application or a booking, it also sends Meta the address of the page you sent it from and your browser type, the same details the Meta Pixel sends, so Meta can count the two copies of the event once. Meta and Google use this to count which ads found customers and to choose who sees our ads.

If your browser sent Global Privacy Control with your request, or you had opted out in that browser, our CRM tells Meta and Google nothing about that request.

Our ads on Meta and on Google may each have a phone number of their own, used for those ads alone, and a call to one reaches the same receptionist as our main number. When one of those ads brings you to one of our landing pages, the page shows that number in place of our main number. A call from a Google ad may go through one of Google's own numbers, which passes it on to our number for Google ads. Google keeps details such as the call's length and the caller's phone number to count the calls our ads bring, and we keep Google's option to record these calls turned off. The number the call reaches tells us whether it came from our ads on Meta or on Google, and from which campaign when that number belongs to a single campaign. Beyond that, we use the number you called from and what our receptionist already records, as set out under Calls to our phone numbers, and our CRM reads that record to judge whether the call was a real inquiry. Later our CRM may tell Meta or Google how the call went, as described above for a request. While your browser sends Global Privacy Control, or once you opt out on the Your Privacy Choices page, our landing pages keep showing our main number, which is not tied to any ad. No browser setting can reach a call made straight from an ad. To keep your calls out of what our CRM tells Meta and Google, email hello@yourwishisourcode.com.

Meta and Google may also read or set cookies on their own domains when the tags load, and their tags may keep similar entries in your browser's local storage.

Meta and Google handle what they receive under their own policies, which can include using it for the ads you see on their services. See Meta's Privacy Policy and Google's page on how it uses information from sites that use its services.

Under California law, letting Meta and Google receive this information for advertising is called sharing personal information for cross-context behavioral advertising, and it may also count as selling it, even though no money changes hands. We sell or share it with no one else. You can opt out at any time on the Your Privacy Choices page, and we treat Global Privacy Control as that opt-out. To keep your calls out of what our CRM tells Meta and Google, email hello@yourwishisourcode.com.

Cookies and local storage

Every cookie this site sets is in the table under Advertising and measurement, with what it holds and how long it lasts. If you start an application on the /apply page, your answers are kept in your browser's local storage for seven days so you can pick up where you left off, and they are removed when you send the application. Nothing else of ours is kept in local storage.

The demo bakery on the work pages keeps its sample orders in your browser's session storage, which is cleared when the tab closes.

Your choices

Global Privacy Control: if your browser sends this signal, we take it as your opt-out. The advertising tags do not load, and our CRM tells Meta and Google nothing about requests you send with it. The Your Privacy Choices page shows whether your browser is sending it.

The same page turns the advertising tags off in one tap, for one year in that browser, and back on in one tap.

A phone call carries no browser signal, so to keep your calls out of what our CRM tells Meta and Google, email hello@yourwishisourcode.com.

You can also limit the ads you see at the source, in Meta's ad preferences and in Google's My Ad Center.

Stopping spam

To stop automated spam, the server keeps your IP address in memory for ten minutes after you send the form. It is not stored with your inquiry.

Your requests

To see, correct or delete what you sent us, email hello@yourwishisourcode.com.

Changes to this policy

If this policy changes, the effective date at the top changes with it.