The short version
We collect very little. If you fill in the contact form, we get what you typed and use it to answer you. If you join the newsletter, we get your email address and use it to send the newsletter. We don’t sell personal information, we don’t share it for advertising, and right now this site sets no cookies of its own. You can ask to see, fix or delete anything we hold about you by emailing [email protected], wherever you live.
The rest of this page is the detail.
1. Who we are
Foothills Digital is a trade name of Lucky Duck Works LLC, a Colorado limited liability company. When this policy says “we”, “us” or “Foothills Digital”, it means Lucky Duck Works LLC.
We are the controller of the personal information described here: we decide why and how it is used.
Postal address: 9249 S Broadway, Suite 200-324, Highlands Ranch, CO 80129, United States. Privacy questions and requests: [email protected]. Everything else: [email protected].
We don’t have a phone line. Email reaches a person, and so does a letter.
We haven’t appointed a Data Protection Officer, because the law doesn’t require one for a business that handles as little personal information as we do. For the same reason, and because our handling of information about people in the UK and EU is occasional and low-risk, we haven’t appointed a representative in either place. If that changes, they’ll be named here.
2. What this policy covers
It covers personal information we handle for our own purposes: people who use this website, write to us, subscribe to the newsletter, or are our contacts at the businesses we work with.
It doesn’t cover information we handle on behalf of a client while we do their work, such as the records in a system we manage for them. There we act on the client’s instructions, and a data processing agreement with that client sets the rules. If you think we hold your information that way, the client is the right first stop, and we’ll help them answer you.
3. What we collect, and why
When you use the contact form. Your name, email address and company, your phone number if you choose to give it, what you need help with, and your message. We use it to answer you and, if you want to work with us, to prepare a quote. The legal basis is our legitimate interest in replying to someone who wrote to us, and, once work is under discussion, steps you asked us to take before a contract.
When you subscribe to the newsletter. Your email address, and nothing else. We use it to send you news and updates from Foothills Digital. The legal basis is your consent, which you give by subscribing and can take back whenever you like: every newsletter has an unsubscribe link at the bottom, or email [email protected] and we’ll take you off the list. Every newsletter also carries our postal address. Subscribing sets no cookie.
When you email us. Whatever is in the email, plus the routing information every email carries. We use it to reply, on the same basis as the contact form.
When you become a client. Names, work email addresses and phone numbers of the people we deal with, plus billing details and the records of the work. We use them to deliver the work and get paid. The legal basis is the contract, and our legal obligations for tax and accounting records.
When your browser loads a page. The site is served through Cloudflare, which handles each request: your IP address, the time, the page asked for, and your browser’s user agent. That is how a website gets to you, and Cloudflare also uses it to block attacks. The legal basis is our legitimate interest in keeping the site up and safe.
What we don’t want. Please don’t send us sensitive information, such as health details, government ID numbers, passwords or payment card numbers, through the form or by email. We don’t need it to answer you, and if it arrives anyway we’ll delete it.
The same thing, in the categories California law uses
| Category | What it is here | Where it comes from | What we use it for |
|---|---|---|---|
| Identifiers | Name, email address, phone number if given, IP address | You, and your browser | Replying, the newsletter, delivering work, keeping the site safe |
| Professional information | Your company and role | You | Replying and quoting |
| Internet activity | Pages requested, browser type | Your browser | Serving the site and blocking attacks |
| Commercial information | What we’ve quoted and billed, for clients | Our records | Delivering and billing work |
We don’t collect any category the law defines as sensitive personal information, and we don’t use personal information to make inferences about you.
4. Who else sees it
We use a few providers to run the business. Each one handles personal information only to do its job for us, under terms that bind it to that.
| Provider | What it does for us | What it sees |
|---|---|---|
| Cloudflare | Hosts the website, protects it from attacks, runs our domain, and forwards email sent to our foothillsdigital.com addresses | Requests to the site, and emails to us |
| Resend | Sends email from our foothillsdigital.com addresses, including contact-form messages | Emails from us |
| Hosts the mailbox where our email is kept | Emails to and from us | |
| Sentrello | Holds the newsletter list and sends the newsletter | Subscribers’ email addresses |
Nobody else, with three exceptions. We’ll disclose information when the law requires it, or to protect our rights or someone’s safety. If you become a client and the work needs another provider, that provider is named in your agreement. And if the business moves to a different company, as it will when Foothills Digital becomes its own LLC, the information moves with it under this same policy, and we’ll update this page to say so.
We don’t sell personal information, and we don’t share it for cross-context behavioral advertising. We never have. That’s why there’s no “Do Not Sell or Share My Personal Information” link here: there’s nothing to opt out of. If that ever changes, the link and the choice arrive before the practice does.
5. Where it goes
We’re based in the United States, and so are all the providers above, so your information is processed in the US. Some providers also use servers in other countries to keep things fast; Cloudflare, for example, answers requests from the data center nearest you.
When personal information comes to us from the UK, the EU or Switzerland, the transfer relies on the provider’s certification under the EU-US Data Privacy Framework and its UK and Swiss extensions where the provider holds one, and on the European Commission’s Standard Contractual Clauses (with the UK addendum) where it doesn’t. Ask us and we’ll tell you which applies to whom.
6. How long we keep it
| What | How long |
|---|---|
| Messages that don’t turn into work | 2 years from our last contact, then deleted |
| Client records | For the length of the work, then 7 years for tax and legal claims, then deleted |
| Newsletter subscription | Until you unsubscribe. We then stop sending, and keep the address only on a do-not-send list so you’re never added back by mistake. Ask and we’ll delete it entirely. |
| Records of privacy requests | 2 years, as the law expects |
| Website request data | Handled by Cloudflare under its own retention rules; we don’t keep a copy |
7. How we protect it
Every page and form travels over an encrypted connection. Every account that holds personal information is protected by multi-factor authentication, and only the people who need it can open it, which today means the founder. We keep as little as we can, for as short a time as we can, because information we don’t have can’t leak.
If something does go wrong, we’ll tell the people affected and the regulators the law requires us to tell, within the deadlines it sets.
8. Your rights
These rights are yours wherever you live. Some privacy laws only cover people in certain places, or only businesses above a certain size. We give everyone the same rights anyway, because doing it once and properly is simpler than checking where you are.
You can ask us to:
- tell you what we hold about you, where it came from, what we use it for and who else has seen it;
- give you a copy, in a format you can take somewhere else;
- correct it if it’s wrong;
- delete it;
- stop or limit how we use it, including objecting to anything we do on the basis of legitimate interests;
- withdraw your consent, for anything that relies on it, such as the newsletter.
Using a right won’t cost you anything, and it won’t change how we treat you or what we charge you.
How to ask. Email [email protected] or write to the postal address in section 1. You don’t need to name a law, and you won’t be asked to create an account. We’ll confirm we’ve got your request within 10 days, and answer it within 30 days. If a request is unusually complex we may need longer, as the law allows; we’ll tell you why within the first 30 days.
Checking it’s you. We’ll ask for just enough to be sure we’re giving your information to you and nobody else. For most people that means replying from the email address we already have.
Someone acting for you. An authorized agent can make a request for you. We’ll ask for proof that you gave them permission, and we may ask you to confirm your identity with us directly.
If we say no. We’ll tell you why. You can appeal by replying to our answer with the word “appeal”. We’ll look at it again and give you a final answer within 45 days, and if we still say no, we’ll tell you how to complain to the regulator.
Complaints. You can complain to a regulator at any time, though we’d like the chance to fix it first.
- In the EU, the data protection authority where you live or work.
- In the UK, the Information Commissioner’s Office.
- In California, the California Privacy Protection Agency.
- In Colorado, the Colorado Attorney General.
- Elsewhere in the US, your state’s attorney general.
9. Browser privacy signals
If your browser sends a Global Privacy Control or Do Not Track signal, we treat it as a no to analytics, and the analytics described in section 12 won’t load unless you choose to turn them on yourself.
10. Children
This site and our services are for businesses. They aren’t meant for anyone under 16, and we don’t knowingly collect information from them. If you think a child has sent us something, tell us and we’ll delete it.
11. Automated decisions, and AI
We don’t make decisions about you by automated means that have legal or similarly significant effects. We use AI tools heavily in the work we do for clients, under the terms of those clients’ agreements, but we don’t use them to profile people who visit this website, and we don’t feed what you send us into tools that train on it.
12. Cookies
The short version
Right now this site sets no cookies of its own: no analytics, no advertising. There’s nothing to opt out of, so we don’t show a banner asking.
Cloudflare’s security cookie
If Cloudflare thinks a visit looks like an attack, it may show a short check and set a cookie that remembers you passed it. That cookie is strictly necessary to keep the site safe, is used for nothing else, and expires on its own. The law doesn’t require consent for a cookie like that, but we’d rather you knew.
What’s planned
Google Analytics, through Google Tag Manager. It would tell us which pages get read and which get skipped. It’s the only thing we intend to add, and when we do, this section will name the property’s settings before it goes live.
It won’t load until you say yes. Not “load and wait for a signal”: not load. The script is added to the page only after you press Allow, so until then your browser hasn’t contacted Google at all. If you say no, or say nothing, or your browser sends one of the signals in section 9, nothing loads and the site works exactly the same.
The video on our WordPress page
One page embeds a video hosted on YouTube. Nothing is requested from YouTube or
Google until you press play; until then there’s only a picture of a player.
Press play and YouTube may set cookies of its own, under its terms rather than
ours. We use youtube-nocookie.com, Google’s privacy-enhanced mode, but we
can’t remove YouTube’s own advertising from a video we didn’t publish.
Changing your mind
Once the analytics banner exists, Cookie settings in the footer reopens it. Your answer is stored in your own browser, not on our servers, so clearing your browser data clears it, and you’ll be asked again.
13. Changes to this policy
When this policy changes, the date at the top changes too. If a change matters, such as a new kind of information or a new provider, we’ll say so on this page before it takes effect, and we’ll email newsletter subscribers and clients about it. Earlier versions are available on request.
14. Contact
[email protected], or Lucky Duck Works LLC, trading as Foothills Digital, 9249 S Broadway, Suite 200-324, Highlands Ranch, CO 80129, United States. A person will answer.