Business information, handled with care.

1. Who we are

Credible by Design is a website, content, conversion, and visibility studio for therapists, healthcare practices, wellness organizations, and other trust-led services. Questions about this policy can be sent to hello@crediblebydesign.com. Use of the website is also covered by our Terms of Use.

2. Information we collect

We may collect the following categories of information:

• Contact details: name, work email, practice or organization name, and information you choose to provide when contacting us.
• Business and project details: public website or profile URLs, practice type and size, service priorities, project timing, working investment range, and form answers.
• Attribution and technical details: submission page, referral source, campaign parameters, browser user agent, and a privacy-preserving fingerprint used to limit abuse. We do not store a raw IP address with the lead record.
• Website analytics: aggregated or pseudonymous page, device, click, scroll, heatmap, and session-replay data collected by the tools described in section 5. Form inputs and admin content are masked from session recordings.
• Reading activity on links we send you: when you open a page we prepared for you, such as your audit, we record when, for how long, and how far down you read. We also record whether you use its PDF copy, booking link, or email link.

4. How we use information

We use submitted information to:

• review and respond to audits, project requests, content briefs, care inquiries, and scans;
• recommend a relevant service, next conversation, or smaller first piece of work;
• deliver confirmations and service-related updates;
• protect forms from spam, fraud, and repeated automated submissions;
• understand which pages and campaigns produce useful inquiries; and
• send occasional marketing notes only when you separately opt in.

5. Cookies and analytics

Website checklist answers are saved in your browser so you can return later. Use Start over to clear them. If browser storage is unavailable, answers last only while the page remains open.

If you request an emailed result, we process your email address and checklist answers to prepare and deliver that copy. A blank workbook request sends only your email address. Neither request subscribes you to marketing.

Checklist delivery uses our transactional email provider. We keep hashed request records for abuse prevention and duplicate-send protection, without email addresses or answers. Delivery records carry a two-day expiry; automatic deletion depends on the database retention configuration. Email-provider records follow that provider's retention settings.

If you ask us about a checklist item, we receive your question, the check it is about, and your email address. We also receive any website you add and whether you let us reuse your question. We use them to reply by email, and we send you a confirmation when your question arrives. An AI writing tool may help us draft the reply, and a person reviews and sends every reply. We store questions with our database provider and delete them after 90 days. If you allow reuse, we may publish your question without your name or other details that identify you. Please don't include client or patient details in a question.

We use Google Tag Manager and Google Analytics to understand which pages and campaigns bring useful visits, and Microsoft Clarity to see how pages are used through heatmaps and session replay. These tools set cookies or use similar technologies to recognize a browser across pages. The events we record name the page, the link or button, and the form involved. They never include what you typed into a form.

We also use the Meta Pixel to measure and target our ads on Facebook and Instagram. It tells Meta which pages a browser visits and when that browser sends a form request. Meta can connect this to your Meta account if you have one, and may use it to show you our ads. The pixel never receives what you type into a form, and it does not load when your browser sends Global Privacy Control.

Pages we share with you by link, such as your audit, measure how they are read. They tell us when a page is opened, how long it stays in use, and how far down it is read. They also tell us whether its PDF copy, booking link, or email link is used. We use this to follow up at a helpful time. These pages set no cookies and store nothing on your device. We keep the country, region, time zone, network, and device type your connection reports, but not your IP address. Global Privacy Control turns this measurement off.

You can limit analytics by blocking or deleting cookies in your browser settings, installing the Google Analytics opt-out browser add-on, or using a content blocker. The site does not read Do Not Track. Global Privacy Control keeps the Meta Pixel off but does not stop Google Analytics or Clarity, so please use these controls for them. Blocking analytics does not affect the forms.

6. Service providers and processing

Depending on the configured workflow, providers may include Firebase and Google Cloud for server-side storage, Resend for transactional email, Cloudflare Turnstile for abuse prevention, Google Analytics for website measurement, Microsoft Clarity for heatmaps and session replay, and a customer relationship or mailing-list service for follow-up. We may forward an Earshot scan request to our scanning system so the requested public-practice scan can be prepared. Learn more about Microsoft's data practices in the Microsoft Privacy Statement.

Providers process information under their own privacy and security terms. Information is processed in the United States and may be processed in other countries where our providers operate.

7. When information is shared

We do not sell personal information. Through the Meta Pixel, we share website activity with Meta for our advertising, as section 5 describes. Otherwise, we share information with service providers only as needed to operate the request, with professional advisers where necessary, or when required to protect rights, safety, or comply with law. A business reorganization may include information subject to safeguards.

8. Case studies and examples of our work

We may use work we have done for practices, including websites, copy, and audits, as case studies and examples. They may appear on this website, in proposals, and in our marketing. A case study can include screenshots, before-and-after comparisons, and a summary of the project.

We ask for your written permission before we name you or your practice, quote you, use your photo, or share figures from your analytics or Search Console. Without that permission, we describe the work only in general terms, with details that identify you removed.

Case studies never include your clients' or patients' information. We remove or blur third-party reviews and license numbers in screenshots. You can ask us to change or remove a case study at any time. We will take it off this website and stop using it in new materials.

9. Retention

Lead and project-request information is generally kept for up to 24 months after the last meaningful interaction, unless a longer period is needed for an active client relationship, accounting, dispute resolution, security, or legal obligations. Marketing information is kept until you unsubscribe or ask us to delete it. Checklist questions are deleted after 90 days. Reading records from pages we share by link are deleted after 12 months. Short-lived rate-limit records are removed automatically where configured.

10. Security

We use reasonable safeguards, including server-side submission handling, restricted database access, transport encryption, spam controls, and limited access. No method of transmission or storage is completely risk-free, so we cannot guarantee absolute security.

11. Your choices and rights

You may ask to access, correct, delete, restrict, or receive a portable copy of information where local law provides that right. Email hello@crediblebydesign.com. We may need to verify your identity first, and we aim to respond within 30 days.

Every marketing message includes an unsubscribe path. Unsubscribing does not prevent service-related replies about a request you submitted.

12. Additional rights in some regions

United States

Residents of California and several other states have rights to know, correct, and delete personal information, and to opt out of its sale or of sharing for targeted advertising. We do not sell personal information. We share website activity with Meta for targeted advertising, and we treat Global Privacy Control as your opt-out from that sharing. You can make a request to know, correct, or delete by email whether or not a particular state law applies to us, and we will not treat you differently for making one.

United Kingdom and European Union

We rely on legitimate interests to respond to business inquiries and keep the site secure, on consent for marketing email, and on legal obligations where they apply. You have the rights listed in section 11, and you may complain to your data protection authority, such as the UK Information Commissioner's Office. Information is processed in the United States, as described in section 6.

13. Third-party links

This site links to other websites and services, including the platforms and tools we write about and our own Earshot product at useearshot.com. Their privacy practices are their own, and this policy does not cover them.

14. Children

This website and its business forms are not directed to children under 16.

15. Changes to this policy

We may update this policy as the website, providers, or legal requirements change. The date at the top shows the current version.