Privacy
Privacy Policy
This page explains what happens to information when you use this website: what it collects, why, who else is involved, and how to reach us about it.
Who this covers
NovaPoint Consulting, LLC (“NovaPoint”, “we”, “us”) runs this website. This policy covers the website and the ways of getting in touch that it offers: the message form, the discovery-call booking window, and the email address and phone number published in the footer.
It describes the public website and those contact and booking paths. If an inquiry goes further — into a proposal, a contract, paid consulting or another business relationship — additional business records may be created and handled as appropriate to that relationship. Information we handle inside a paid engagement is governed by the written agreement and the business processes for that work rather than by this page.
The short version
- This website has no visitor or lead database. Information submitted through the message form is delivered to NovaPoint by email rather than stored in a website database.
- The one form asks for a name, an email address and a message, so that we can reply.
- With your Analytics consent, we use Google Analytics to see how the site is used. It then sets cookies. It is never sent your name, your email address or your message.
- Booking a call happens on Google’s own scheduling page, shown inside a window on our site.
- This site runs no advertising tags, no remarketing tags, no social-network pixels, no session recording and no chat widget.
What you give us directly
The message form on the Let’s Talk page asks for three things: your name, your email address, and a few lines about what is happening. All three are required, and there are no other fields for you to fill in. Please do not send payment details, account numbers, government identifiers, passwords or anything else sensitive through it — the form is not built for that, and we do not need it in order to reply.
The form also carries one field that a person never sees and never fills in. It is there to catch automated submissions. If it arrives filled in, the submission is discarded and nothing reaches us.
When you submit the form, the page adds a small amount of context about where the message came from: the page you submitted from, the referring web address your browser reported, any campaign parameters present in the address you arrived on, and the time the page was rendered. That context tells us how someone found us. It is not used to build a profile of you.
You can also reach us without the form, by email or by phone. If you do, we have whatever you chose to put in that message or tell us on the call.
What is collected automatically
Analytics is described in its own section below. Besides that:
- Service records. This site is hosted by Vercel, and requests to it pass through Vercel’s systems. When the form is submitted, our own code writes a short structured line recording a generated reference for the request, the route, what happened — that a message was delivered, say, or that validation failed — and which environment handled it. That line never contains your name, your email address, your message, or any value you typed. Vercel keeps its own operational records of requests as part of running the service; those are Vercel’s, held under Vercel’s terms rather than ours.
- Your IP address. The form endpoint reads the IP address of the submitting device for one purpose: limiting how many submissions can come from it in a short window, so the form is harder to flood. It is used during that request and then discarded. It is not attached to your message, not written into our own log lines, and not passed to anyone.
- Fonts. Pages use typefaces served by Google Fonts. Loading them means your browser makes a request to Google’s font servers, and Google receives what any web request carries, including your IP address and browser details.
Analytics
We use Google Analytics 4 to understand how the site is used — which pages get read, and which routes into a conversation get taken. It is loaded directly from Google only after you accept Analytics. Before acceptance, or if you decline, Google Analytics does not initialize, transmit measurement data or set analytics cookies. Advertising-related consent stays denied. We do not use Google Tag Manager, and we use no other analytics product.
Alongside page views, the site deliberately records a small set of events:
- starting to type in the message form
- a message that was actually delivered
- opening the message form
- clicking a button to book a discovery call
- clicking through to one of our capability pages
Those events carry the page they happened on and, where it is relevant, which button was used. They never carry your name, email address, company, phone number, the text of your message, or the reference number your message was given. We do not set a user ID, and we do not send contact details to Google Analytics.
Google Analytics sets cookies in your browser — one named _ga, and one whose name begins _ga_ followed by an identifier for our property — so that a returning browser is recognised and activity can be grouped into sessions. How Google handles what it collects is covered by Google’s Privacy Policy. Google also offers a browser add-on that opts you out of Google Analytics across every site that uses it.
Analytics here is best-effort: if it is blocked or fails to load, every page, form and link on this site behaves exactly as it otherwise would.
Cookies and browser storage
Google Analytics cookies are set only after you accept Analytics. Our own code sets no cookies. We save your explicit acceptance or decline in local storage in this browser, without an expiration, so later pages remember your choice. Clearing this site’s browser storage removes the preference and lets you choose again. If browser storage is unavailable, the choice applies only to the current page. Google’s booking page, once you open it, is Google’s own page and may set its own.
You can block or clear cookies in your browser settings. The site stays fully readable, and the form still works, without them.
This site does not currently respond to Do Not Track or Global Privacy Control signals sent by a browser.
Booking a discovery call
The button that books a complimentary discovery call opens a window on our site containing Google’s appointment-scheduling page for NovaPoint. Nothing is requested from Google until you open it.
What you enter on that page — your name, your email address, and anything else Google asks for — goes to Google, and the resulting appointment appears in our Google Calendar. It does not travel through this website’s code, and the website never receives a copy of it. Google’s handling of it is covered by Google’s Privacy Policy. The same page can be opened in a new tab instead, from the link inside the booking window.
How we use what we have
- to reply to you, and to carry on the conversation you started
- to prepare for and hold a discovery call
- to understand which parts of the site are useful and which are not
- to keep the form working and to resist automated abuse of it
What you send through this website is not added to a marketing list, and we send no newsletters or marketing campaigns from it. We do not sell or rent it.
Who else is involved
We keep the list of outside services short, and use each one for a stated, ordinary purpose:
- Vercel hosts this site, serves every page, and runs the endpoint the form posts to. Vercel’s privacy policy.
- Resend delivers your message from that endpoint as an email. It is the delivery service that carries the message, not the place it ends up. Resend’s privacy policy.
- Google hosts our business mailbox on Google Workspace, which is where a delivered message arrives and stays. Google also provides the fonts the pages use, Google Analytics, and the Calendar appointment-scheduling page behind the booking button. Google’s privacy policy.
Apart from those providers, we do not share what you send through this website with anyone, except where the law requires it or where it is needed to establish or defend a legal claim.
Where your message goes, and how long it is kept
There is no visitor or lead database behind this website, and no copy of your message is stored on the site or on the server that processes it. The path is short and always the same: the form posts to our endpoint on Vercel, that endpoint hands the message to Resend, and Resend delivers it as an email to NovaPoint’s business mailbox on Google Workspace. From that point it is ordinary business correspondence in our mailbox.
We keep inquiry correspondence for as long as is reasonably necessary to respond to the inquiry, maintain appropriate business records, and address legal, contractual or operational needs.
Analytics data is held by Google under the retention configuration of our Analytics property. Our providers also keep their own operational records and backups under their own terms; those are outside our direct control.
Security
What we actually do:
- the site is served only over HTTPS, and browsers are told to keep using it
- a content security policy restricts what a page is allowed to load, alongside other protective response headers
- there is no visitor or lead database, so the site holds no pool of visitor information to lose
- the form accepts only an expected set of fields, cleans every value it receives, and refuses submissions that did not come from this site
- the form asks for nothing sensitive, and we do not want sensitive information sent through it
No website, and no way of sending information over the internet, is completely secure. We cannot guarantee that something sent to us will never be intercepted, and you send it on that understanding.
Your choices, and making a request
- Use email or the phone instead of the form. Nothing here requires you to fill it in.
- Block or clear cookies in your browser, or use Google’s opt-out add-on, if you would rather not be measured.
- You may contact us to request access to, or deletion of, information we hold about you.
We will evaluate and respond to requests as required by applicable law and subject to legitimate retention requirements. Two limits are worth stating plainly: our providers keep their own operational records and backups, which are outside our direct control and which we cannot delete on your behalf; and we may retain information where it is reasonably necessary for legitimate business, legal, contractual or recordkeeping purposes.
If a privacy law that applies to you gives you rights beyond this, write to us and we will deal with your request.
Other websites
This site links to a small number of pages we do not control, including the provider policies above and Google’s scheduling page. Once you are on one of those, that organisation’s own terms and privacy practices apply, not ours.
Children
This website is aimed at businesses and is not directed at children. We do not knowingly collect information from anyone under 13. If you believe a child has sent us personal information, please contact us so we can take appropriate steps to address it.
Changes to this policy
We may update this page as the website changes. The line at the top of this page identifies the current version. If a change materially affects what happens to information you have already sent us, we will say so here rather than change it quietly.
Contact
NovaPoint Consulting, LLC — Central Florida, United States.
Our Website Terms cover the use of this site.