Privacy policy.

1. Who we are

WebKing Marketing Services is a Houston, Texas digital marketing agency that has operated continuously since 1999. We provide Google Ads management, AI-driven SEO, website design and development, conversion rate optimization, social media management, and custom software and AI automations for clients across the United States. Our principal business address is in Harris County, Texas. For privacy questions, write to privacy@webking.com or call (832) 830-6474.

This policy describes how we collect, use, share, retain, and protect personal information. It applies to www.webking.com, every WebKing-owned subdomain, the WebKing client portals at /m/<slug>, the WebKing admin tools, and any email, chat, phone, or in-person interaction we have with you in a business or prospective-business capacity. For information about how we process personal data on behalf of clients (where we act as a data processor or service provider), see the data processing addendum in your engagement agreement.

2. The categories of personal information we collect

We collect only what we need to provide the services you ask for, run our business, and comply with the law. Concretely:

• Identifiers. Your name, business name, role, email, phone, mailing address, and any usernames or account IDs you create on our portals.
• Commercial information. Services you have inquired about or purchased, transaction history, billing details, and the contents of communications about your engagement.
• Internet and network activity. Your IP address, device type, browser, operating system, referring URL, pages visited on our site, time spent, search terms that brought you here, and how you interact with our forms and chat.
• Geolocation. Approximate location inferred from your IP address (city or metro level only). We do not collect precise GPS location.
• Audio and visual information. If you call us, we may keep records of the call (date, time, duration, parties). We do not record audio without telling you on the call. If you send photos or screenshots, we keep those.
• Professional or employment information. Your job title, employer, and similar context you share so we can serve you appropriately.
• Inferences. Conclusions we draw to understand fit, intent, and likely needs (for example, segmenting prospects by industry or by interest in a particular service).

We do not knowingly collect or process sensitive personal information as defined by California, Texas, Virginia, Colorado, Connecticut, Utah, Iowa, Indiana, Tennessee, Montana, Oregon, Florida, Delaware, New Hampshire, New Jersey, Minnesota, Maryland, Kentucky, Rhode Island, or Nebraska law (this includes precise geolocation, government IDs, financial account credentials, racial or ethnic origin, religious beliefs, union membership, biometric data used for identification, genetic data, health data, sexual orientation, immigration status, or contents of mail, email, or text unless directed to us). If you choose to share any of the above voluntarily (for example by emailing us a copy of a contract), we treat it with the same protections we use for all sensitive data and we limit its use to the purpose you provided it for. We do not sell sensitive personal information. We do not process it for the purpose of inferring characteristics about you.

3. How we collect it

• From you directly. When you submit a contact form, request an audit, chat with the WebKing wizard, email us, call us, sign an engagement letter, or upload content to a portal.
• Automatically through our website. Through first-party cookies, similar local-storage technologies, and standard server logs. See Section 9 (Cookies and similar technologies).
• From service providers. Hosting logs from Vercel, deliverability data from Resend, conversion data from Google and Meta, and similar operational data from the tools listed in Section 6.
• From clients. When a client provides us with end-customer data to power a campaign or a deliverable we are building for them. In that case the client is the controller and we are a processor or service provider.
• From public sources. When we research prospects, we may use publicly available information from LinkedIn, business directories, the Texas Comptroller, county records, and similar sources.

4. Why we use it

We process personal information for the following purposes:

• To provide the services you asked for. Including responding to inquiries, scoping work, performing campaigns, building deliverables, supporting the client portal, and invoicing.
• To run, secure, and improve our business. Including analytics, anti-abuse and anti-fraud, debugging, training our internal team, and improving the website and the wizard chat.
• To communicate with you. Including transactional messages (about your engagement), service updates, and (only with your consent or where allowed by law) marketing messages about our services.
• To comply with law and protect rights. Including responding to subpoenas, complying with tax and accounting obligations, defending claims, and protecting WebKing, our clients, and the public from harm.

We do not use your personal information to train any third-party general-purpose AI model. When we use AI to help us draft, summarize, or evaluate (for example, the WebKing wizard chat or an internal copywriting tool), we use providers under contracts that prohibit them from training on our data.

5. The legal bases we rely on

Where the law requires us to identify a legal basis (for example, under the European Union General Data Protection Regulation if you reach us from the EU), we rely on:

• Performance of a contract (to scope, deliver, and bill for the work you engaged us for).
• Legitimate interest (to run, secure, and grow our business, and to reach prospects in a B2B context proportionately).
• Consent (for non-essential cookies and for marketing email to consumers in jurisdictions that require opt-in).
• Legal obligation (tax, accounting, anti-fraud, regulatory reporting).

6. Who we share it with

We do not sell personal information for money and we do not engage in cross-context behavioral advertising of our own products in a way that would meet the legal definition of "sharing" under California or comparable state law. We do disclose personal information to the following categories of recipients, only for the purposes described:

• Hosting and infrastructure. Vercel (web hosting and edge functions), Supabase (database and storage), Cloudflare (some DNS).
• Email and messaging. Resend (transactional and bulk email delivery), Google Workspace (corporate email).
• Analytics and ad measurement. Google (Ads, Analytics, Search Console), Microsoft (Bing Webmaster, IndexNow), Yandex (IndexNow). We use these to measure how the site is used and how campaigns perform, not to retarget you across the web.
• AI processing. Anthropic (Claude), to power the wizard chat, the lead-routing engine, and internal drafting tools. Conversations are not used to train models.
• Creative and production tools. Higgsfield (image and video generation), Suno (audio generation), used only on creative we produce for our own brand or with explicit client approval.
• Payment processing. Stripe (when invoiced electronically). Stripe collects payment-method data directly under its own privacy policy.
• Professional advisors. Our attorneys, accountants, and insurers, subject to confidentiality.
• Government and regulators. When we are legally required to disclose, when we have a good-faith belief disclosure is necessary to prevent harm, or to enforce our rights.
• Successors. If WebKing is acquired, merges, or sells substantially all of its assets, your information may transfer to the successor entity subject to this policy.

We require every service provider to use personal information only on our instructions, to protect it, and to delete or return it at the end of the engagement.

7. Your rights

Depending on where you live, you have some or all of the following rights. We honor them across the United States regardless of whether your state has enacted a comprehensive privacy law, because we think it is the right way to operate.

• Right to know and access. You can ask us what personal information we hold about you, the categories of sources, the categories of recipients, and the purposes of processing. You can also ask for a copy in a portable format.
• Right to correct. You can ask us to correct inaccurate personal information.
• Right to delete. You can ask us to delete personal information, subject to the legal exceptions that apply (for example, transaction records we are required to keep for tax purposes).
• Right to opt out of sale and sharing. We do not sell or share for cross-context behavioral advertising. If that ever changes, you will be able to opt out at this URL.
• Right to opt out of targeted advertising. Same as above.
• Right to opt out of profiling that produces legal or similarly significant effects. We do not perform such profiling.
• Right to limit the use of sensitive personal information. We collect almost no sensitive information by design.
• Right to non-discrimination. Exercising your privacy rights will not cause us to deny you service, charge you a different price, or provide a lower quality of service.
• Right to appeal a denial. If we deny a request, you can appeal by replying to our denial message. We will respond within 45 days (or as required by your state law).

To exercise any of these rights, email privacy@webking.com with the request and enough information for us to verify your identity (we will ask for the minimum needed). We respond within 45 days. We may extend that window by another 45 days when reasonably necessary, in which case we will tell you why.

You can also authorize an agent to act on your behalf. We will verify the agent and may contact you to confirm. California and several other states require us to honor preference signals like Global Privacy Control (GPC); we do.

8. State-specific disclosures

Texas (TDPSA)

Under the Texas Data Privacy and Security Act, Texas consumers have the rights described in Section 7 above. We do not sell sensitive personal data and we do not engage in targeted advertising as defined by the TDPSA. To exercise your rights, email privacy@webking.com. To appeal a denial, reply to our denial. If you remain unsatisfied, you may contact the Texas Attorney General at texasattorneygeneral.gov.

California (CCPA and CPRA)

In the prior twelve months we collected the categories of personal information listed in Section 2 from the sources listed in Section 3, for the purposes listed in Section 4, and disclosed them to the categories of recipients in Section 6. We do not sell personal information for money and we do not share personal information for cross-context behavioral advertising. We retain personal information for the periods described in Section 11. California residents have the rights in Section 7. Submit requests at privacy@webking.com. We do not offer a financial incentive in exchange for personal information.

Virginia, Colorado, Connecticut, Utah, Iowa, Indiana, Tennessee, Montana, Oregon, Florida, Delaware, New Hampshire, New Jersey, Minnesota, Maryland, Kentucky, Rhode Island, Nebraska, and any other state with a comprehensive privacy law in force as of the effective date

Residents of these states have the rights in Section 7. We honor every such right in every state. We do not sell personal data, do not engage in targeted advertising as defined by these laws, and do not perform profiling that has legal or similarly significant effects. We do not knowingly process the personal data of a known minor for targeted advertising or sale.

Nevada

Nevada residents have the right to opt out of the sale of certain covered information. We do not sell covered information as defined by Nevada law.

European Economic Area, United Kingdom, Switzerland

If you contact us from the EEA, the UK, or Switzerland, we process your personal data in the United States. We do not have an EU representative because our processing of EEA personal data is incidental to a US-focused business. We rely on the Standard Contractual Clauses with our subprocessors where required. You have the right to lodge a complaint with your local supervisory authority.

9. Cookies and similar technologies

We use first-party cookies and similar storage for three things only:

• Strictly necessary. To keep you logged into your client portal, remember your wizard chat persona, and protect against abuse. These do not require consent.
• Analytics. To measure how the site is used so we can improve it. We use Google Analytics and Vercel Analytics, configured to anonymize IP addresses where supported.
• Marketing measurement (limited). To measure conversions for our own Google Ads. We do not place third-party advertising pixels for retargeting.

You can disable cookies in your browser. The strictly necessary cookies will be re-set on your next visit because they are required for the site to function. We honor the Global Privacy Control (GPC) browser signal as an opt-out of sale and sharing.

10. Marketing communications and the WebKing wizard chat

If you initiate a chat through the WebKing wizard, the conversation may be processed by Anthropic Claude under our zero-retention business agreement. Your messages, the persona's messages, and any contact information you share are stored in our Supabase database and emailed to our team so we can follow up. We use this information to contact you about your inquiry and, if you opt in, about other services that may be relevant. You can opt out of marketing at any time by replying STOP, clicking an unsubscribe link, or emailing privacy@webking.com.

We comply with the federal CAN-SPAM Act, the Telephone Consumer Protection Act (TCPA), the Texas Business and Commerce Code Chapter 305, and all comparable state and federal anti-spam and telemarketing laws. We do not send unsolicited marketing email to residential consumers. B2B outreach is conducted in a manner consistent with industry practice and applicable law.

11. Data retention

• Client engagement records. Seven (7) years after the end of the engagement, to comply with tax, accounting, and statute-of-limitations requirements.
• Prospect inquiries. Twenty-four (24) months after the most recent interaction, then deleted or anonymized unless we have a continuing legal basis to retain.
• Wizard chat transcripts. Twenty-four (24) months after the last message, then deleted.
• Server logs. Ninety (90) days for operational logs, longer for security event logs as needed.
• Backups. Up to ninety (90) days in rolling backups. A deletion request reaches backups when they next cycle.

12. Security

We protect personal information with administrative, technical, and physical safeguards appropriate to its sensitivity, including encryption in transit (TLS 1.2 or higher), encryption at rest where our service providers support it, strict access controls based on least privilege, two-factor authentication for all administrative accounts, separation of production and non-production environments, and regular review of our security posture. No method of transmission or storage is perfectly secure. We notify affected individuals and regulators of a breach as required by applicable law, including without undue delay where state law requires it.

13. Children

Our services are directed to businesses and to adults acting in a business capacity. We do not knowingly collect personal information from anyone under the age of thirteen (13). If we learn we have collected such information, we will delete it. Parents who believe their child has provided us with personal information may write to privacy@webking.com.

14. Links to third-party sites

Our site links to third-party sites we do not control. We are not responsible for the privacy practices of those sites. Read their privacy policies before sharing personal information with them.

15. Do Not Track and Global Privacy Control

Browsers send a "Do Not Track" signal that has no consistent industry meaning, so we do not respond to it. Browsers and extensions that send the Global Privacy Control (GPC) signal are honored as an opt-out of sale and sharing as required by California and other state laws.

16. Accessibility

We design our site to meet Web Content Accessibility Guidelines (WCAG) 2.1 Level AA, including readable contrast, keyboard navigation, descriptive alt text, and respect for `prefers-reduced-motion`. If you encounter an accessibility issue, email accessibility@webking.com and we will respond within five (5) business days.

17. Changes to this policy

We may update this policy from time to time. The "Effective" date at the top tells you when the current version was published. If we make material changes, we will tell you by email (if you have given us your address), by a notice on the home page, or both. Your continued use of our services after the new effective date constitutes acceptance of the updated policy.

18. How to contact us

WebKing Marketing Services
Houston, Texas, United States
Email: privacy@webking.com
Email (general): help@webking.com
Phone: (832) 830-6474

This privacy policy is provided for transparency and is not a substitute for individualized legal advice. If you are a client, the terms of your engagement letter and any data processing addendum control over any inconsistency with this policy.