Legal
Privacy Policy
What we collect when you use this website, what we do with it, who else touches it, and how to get it back or have it deleted.
The short version
We collect what you type into our forms, plus a record of the submission itself: the time, your IP address, the kind of browser and device you used, and the exact consent wording you were shown. We keep that in our CRM so we can reply to you and prove the consent was real.
When you submit a form, we also record how you reached the site: the website that sent you, the page you landed on, any campaign tags in the link you followed and, unless you have opted out of advertising, the ad click identifier in it. That tells us which of our campaigns brought your inquiry (§3).
We use analytics and advertising tools on this website (Google Analytics, Google Tag Manager, Microsoft Clarity and the Meta pixel) to see how the site is used and whether our ads work. You can switch them off at any time with the Your Privacy Choices link at the foot of every page, and we treat a Global Privacy Control signal from your browser as that same opt-out, automatically.
We do not sell what you type into our forms, and we do not buy personal information to add to it. Letting Meta see your visit for advertising counts as "sharing" under some state privacy laws, which is why the opt-out exists (§4).
We may record and transcribe our calls and video meetings, and we always say so at the start, so you can object before anything is captured (§2).
Scope matters here. This policy covers zolley.com. Zolley also operates separate lead-generation websites, where a consumer asks to be contacted about a service and their inquiry is passed to a business that provides it, which privacy law treats as a sale of personal information. Those sites carry their own privacy notice, their own consent wording naming who may contact you, and their own opt-out. What you read here applies to this website.
If you want your information out of our systems, email [email protected] and we will remove it.
1Who we are
Zolley, LLC, a Florida limited liability company. 150 E Palmetto Park Rd #800, Boca Raton, FL 33432 · (888) 503-3750 · [email protected]
This policy covers zolley.com. It does not cover the client platform at app.zolley.com, which is governed by the Platform Terms and the Data Processing Agreement, nor the websites we build and run for our clients, which are governed by their own policies.
2What you give us
Everything in this section is information you give us: what you type into our forms, and what you say on a call or in a meeting with us. Nothing here is inferred, purchased, or collected from third parties.
Every form asks for some of: your name, email address, phone number, and business name.
Depending on which form you use, we may also ask:
| Form | Additional information |
|---|---|
| Contact | Your topic and your message |
| Free discovery call | Business type, state, time in business, annual revenue range, whether you run ads today, roughly how many leads you get, which services interest you, and the date and time you pick |
| Free marketing audit | Your website address, plus the business questions above |
| Value calculator | Your industry, whether a person closes your sales or customers buy on their own, and the figures you enter: average sale, purchases per year, years a customer stays, referrals per customer, gross margin, the share of profit you would reinvest, how many inquiries become customers, and, if you choose, the most you pay for a lead today. If you book a call from it, the date and time you pick |
| Marketing readiness scorecard | Your answers to its twelve questions, and the score and band they produce |
| Value worksheet and lead vetting guide | If you choose, after the download: your business name, industry and website. If you book a call from it, the date and time you pick |
| Review | Your star rating and what you write. Your phone number is optional |
| Support | Ticket category and priority, a description of the problem, and any file you attach |
| Refer a business | The name and contact details of the person you are referring, and your own, so we know who to thank |
| Partner | Your business details and how you would work with us |
| Subscribe | Your email address only |
A note on the revenue question: we ask for a range, and "Prefer not to say" is an option. We do not ask for exact figures.
A note on referrals: if you refer someone, you are giving us their contact details. Please only do that if they are expecting to hear from us. We contact them once, mention who referred them, and stop if they are not interested.
A note on what not to send us: please do not put health information, Social Security or other government ID numbers, or bank or card numbers into a message or a support attachment. If a screenshot shows your own customers' details, crop or blur them first. If something like that reaches us anyway, tell us and we will delete it.
A note on calls and video meetings: we may record and transcribe our phone calls and video meetings, including with an AI assistant that writes up what was said. We announce it at the start of every call or meeting that is recorded or transcribed, before anything is captured. If you do not want it, say so: we turn recording and transcription off, or end the call. When our AI assistant is on a call, it says that it is an AI. We use recordings and transcripts to keep an accurate record of what was discussed and agreed, to follow up, and for quality and training. We never sell them. The companies that provide our phone system, AI assistant and video meetings (§5) may use recordings and transcripts to improve their own services, including to train their AI models, under their own terms. How long we keep them is in §7.
A note on unfinished forms: on the free discovery call, free marketing audit and value calculator forms, once you have typed your name and a valid email address, we may save them, along with your business name and type of business if you have entered those, before you press submit. If you do not finish, we may send you up to two emails about the form you started. We never call or text you about an unfinished form, and every one of those emails carries an unsubscribe link.
3What we record about the submission
When you submit a form, our systems record the following automatically, so that we can demonstrate a submission was genuine and that consent was properly obtained:
| Recorded | Why |
|---|---|
| IP address | Establishes where a submission came from; part of a defensible consent record |
| Date and time (US Eastern) | An authoritative timestamp, taken by our server rather than your device |
| Browser type | e.g. Chrome, Safari |
| Device type | e.g. desktop, mobile |
| The exact consent wording shown to you | So there is no argument later about what you agreed to |
| How you reached the site | The page you submitted from; the website that referred you and the page you landed on; any campaign tags in the link you followed (source, medium, campaign, term and content); the ad click identifier Google, Meta or Microsoft added to that link, if there was one and you have not opted out of advertising; and the date of your first visit. We keep this for your first visit and for your most recent visit from a campaign link, so we can tell which campaign or website brought your inquiry |
This is a deliberate, documented practice. If you consent to text messages, we keep the sentence you consented to alongside the consent itself.
How we know how you reached the site. When you arrive, this website notes in your own browser how you got here, in a storage entry called zolley_attr (listed in our Cookie Policy): the campaign tags and ad click identifier in the link you followed, the website that referred you, the page you landed on, and the date. It keeps your first visit and your most recent visit that came from a campaign link, and it expires 90 days after it last changed. Nothing in it is sent to us until you submit a form. When you do, it travels with your inquiry and is saved on your record with us, and the ad click identifier lets us match the inquiry to the ad click it came from, including by reporting it back to the platform that ran the ad.
Ad click identifiers follow your advertising choice. If you have switched off Advertising in Your Privacy Choices, or your browser sends a Global Privacy Control signal, this website does not store or send ad click identifiers, and deletes any it already stored. Campaign tags, the referring website and the landing page are still recorded, because they describe the link you followed rather than coming from an advertising tool, and they are only ever used by us.
4Analytics and advertising
We use four tools to understand how this website is used and to measure our advertising. They run when a page loads, and you can switch them off at any time (§8).
| Tool | Provider | What it does | What it receives |
|---|---|---|---|
| Google Tag Manager | Google LLC | Loads the tools below, and only the ones your choices allow | The page address and standard browser information |
| Google Analytics | Google LLC | Counts visits and completed forms in aggregate, so we can see which pages and campaigns work | The pages you view, how you arrived (including any campaign tags in the link you followed), your approximate location, your device and browser, and a random identifier. We do not send it your name, email address, phone number or form answers. |
| Microsoft Clarity | Microsoft Corporation | Heatmaps and recordings of how pages are used: where people click, scroll and get stuck | Clicks, scrolling and page layout, your device and browser. What you type into a form field is masked and is not recorded. |
| Meta pixel and Conversions API | Meta Platforms, Inc. | Measures whether our ads on Facebook and Instagram lead to inquiries, and helps show our ads to people likely to be interested in them | The pages you view, the fact that you completed a form, and a random identifier. When you submit a form, our backend also sends Meta your email address, phone number and name in hashed (one-way scrambled) form, so Meta can match the inquiry to an ad it showed. |
The cookies these tools set are listed, with how long each lasts, in our Cookie Policy.
When you submit a form, our backend reports that conversion directly to Google Analytics and to Meta, as well as your browser doing so. Both respect the same choices: if you have switched off Advertising, nothing is sent to Meta; if you have switched off Analytics, nothing is sent to Google Analytics. The inquiry itself always reaches us, because sending it is what you asked us to do.
What we still do not do:
- We do not add your browsing history to your record. The record we keep about you (§§2 and 3) holds what you typed, the submission record, and how you reached the site: the page you landed on, the page you submitted from, the referring website, campaign tags and, unless you opted out of advertising, the ad click identifier. It does not hold the other pages you viewed, a session recording, or the identifiers that the analytics and advertising cookies in our Cookie Policy use.
- No data purchased from brokers, and no enrichment of what you give us.
- No tracking of children. This site is not directed at anyone under 18 and we do not knowingly collect their information.
5Who else touches it
| Who | What they do | What they receive |
|---|---|---|
| Cloudflare, Inc. | Runs the endpoint that receives our forms, and provides Turnstile, the invisible bot check on every form | Your submission passes through them; Turnstile sees a signal about your browser, not your form contents |
| HighLevel Inc. and its affiliate LeadConnector LLC, with Twilio Inc. and Sinch (Mailgun) behind their telephone and email delivery | Stores your record; sends our emails and texts; runs the booking calendar; hosts the images on this site and any file you attach to a support ticket; runs our phone system and our AI phone assistant, which records and transcribes a call when we announce it at the start | Everything in §§2 and 3, and the audio and transcript of calls it records |
| Google LLC | Serves the two typefaces this site uses; runs Google Tag Manager and Google Analytics (§4) | Your IP address when a page loads; the analytics data in §4. Never your name, email, phone or form answers |
| Meta Platforms, Inc. | Runs the Meta pixel and Conversions API (§4), unless you switch off Advertising | The advertising data in §4, including your email, phone and name in hashed form when you submit a form |
| Microsoft Corporation | Runs Microsoft Clarity (§4), unless you switch off Analytics | How pages are used, with form fields masked |
| Zoom Video Communications, Inc. | Hosts our video meetings, and records and transcribes them when we announce it at the start | The meeting's audio, video, chat and transcript, and the names and email addresses of the people in it |
The bot check on every form is Cloudflare Turnstile. It runs invisibly and looks at signals from your browser rather than at anything you typed. Cloudflare's Turnstile privacy policy describes what it processes and why. Disclosing it here is a condition of using Turnstile.
Selling and sharing
We do not sell what you type into a form on zolley.com. But the Meta pixel and Conversions API give Meta information about your visit so that we can measure and target our advertising. California law calls that sharing for cross-context behavioral advertising, and other states may treat it as targeted advertising or a sale. You can opt out at any time: use the Your Privacy Choices link at the foot of any page and switch off Advertising, or turn on Global Privacy Control in your browser, which we honor as the same opt-out automatically. Opting out on one browser does not carry to another, because we do not know they are both you.
On our lead-generation websites the position is different, and we say so there. If you ask to be contacted about a service on one of those sites, your inquiry is passed to a business that provides it. Privacy law calls that a sale. Each of those sites carries its own notice, its own consent wording naming who may contact you, and its own Do Not Sell or Share My Personal Information link. We do not move information between those sites and this one.
We will disclose information if the law requires it, or to protect our rights, safety, or property.
If Zolley is sold or merges. If Zolley, LLC merges with another company, is acquired, or sells all or part of its business, the information described in this policy may pass to the new owner as part of that transaction. The new owner must go on using it as this policy describes, or tell you before it uses it any other way.
6What we use it for
- To reply to you, and to do the thing you asked for: book the call, send the audit, open the ticket
- To contact you by phone and text, including marketing calls and texts and including by automatic dialing or prerecorded voice, only if you specifically consented on the form, and never as a condition of buying anything
- To keep a record that consent was given, in case it is ever questioned
- To keep an accurate record of calls and video meetings we record or transcribe, to follow up on them, and for quality and training (§2)
- To understand how this website is used and whether our advertising works (§4), unless you have switched that off
- To run our business: invoicing, support, and improving how we work
We do not use your information to make automated decisions that produce legal effects for you.
7How long we keep it
We keep personal information only as long as we need it for the purpose we collected it:
| What | How long |
|---|---|
| An inquiry that never became a client | 24 months from last contact, then deleted |
| A client relationship | For the life of the relationship, then 7 years for tax and contractual records |
| Consent records | 5 years from the last message sent |
| Support tickets and attachments | 24 months |
| Call and meeting recordings and transcripts | If you are a client: for the whole engagement, plus 5 years after it ends. Otherwise: 2 years from our last contact. Longer only while a dispute, complaint or legal hold needs them. We delete one sooner if you ask, unless we need it for a legal reason |
| Suppression records (you opted out) | Kept for as long as we operate |
| Your privacy choices (the Your Privacy Choices setting) | In your browser for 1 year; our record of the choice for 5 years, like any other consent record |
| How you reached the site (§3) | On your record with us, for as long as the rest of that record under the periods above. In your browser, the zolley_attr entry expires 90 days after it last changed; clearing this site's data in your browser deletes it sooner |
| Analytics and advertising data (§4) | Held by the provider, not by us: Google Analytics keeps event data for 14 months; Microsoft Clarity keeps recordings for 30 days; Meta keeps data under its own terms |
Why consent records are kept for five years. A TCPA claim has a four-year limitation period, and the consent record is the evidence. Keeping it protects you as much as us: it is the proof of what you were actually shown.
Why client recordings are kept for five years after an engagement. Five years is how long a claim over a written contract can be brought in Florida, and a recording is often the clearest record of what was agreed.
Why a suppression record is permanent. Deleting it would mean losing the record that you asked not to be contacted, which would defeat the point. It is your number on a do-not-contact list and nothing more, and it is never used for marketing.
8Your choices
Text messages. Reply STOP to any message and they end. Reply HELP for help. Consent to messages is never a condition of buying anything from us; it is a condition of submitting a form that asks for your phone number, because a phone number you give us is a phone number we intend to use. If you would rather not consent, every form's alternative is to email us at [email protected] instead. The one form that asks for no phone number, the article subscription, carries no consent box at all. The full terms for our text messages are in our SMS Terms.
Phone calls. The same consent covers calls from us, including automated and prerecorded calls, to the number you gave. To stop them, tell the person who calls you or email [email protected]; any reasonable way of telling us counts. We add your number to our internal do-not-call list and stop calling within 10 business days at most.
Email. Every marketing email has an unsubscribe link. Transactional messages (a booking confirmation, a support ticket reply) are not marketing and do not carry one.
Analytics and advertising. Use the Your Privacy Choices link at the foot of any page. It has two switches: Advertising (the Meta pixel and Conversions API; switching it off is the "Do Not Sell or Share" opt-out) and Analytics (Google Analytics and Microsoft Clarity). Your choice takes effect immediately and is remembered on that browser for a year. If your browser sends a Global Privacy Control signal, Advertising is switched off for you automatically. Switching off Advertising also stops this website storing or sending ad click identifiers with your inquiry (§3). Blocking or deleting cookies in your browser settings also works, and does not break the site.
Access, correction, deletion, or a copy of your data. Email [email protected] or call (888) 503-3750, toll-free. We will respond within the timeframe the applicable law requires, and within 45 days regardless.
How we confirm a request is yours. We match the request to what we hold, usually the email address or phone number you used with us, and may ask you to confirm it from that address or number. We ask for no more than we need to confirm it is you, and use it for nothing else. If an authorized agent asks on your behalf, we ask for your signed permission and may confirm the request with you directly.
We will not discriminate against you for exercising any of these rights.
9Where your information is held
In the United States. If you are contacting us from outside the US, your information will be transferred to and stored in the US.
If you are in the UK or EEA, transfers of your personal information to us rely on the Standard Contractual Clauses approved by the European Commission, and the UK Addendum where applicable, together with the safeguards described in §14.
10California residents (CCPA/CPRA)
You have the right to know what we collect, to get a copy, to correct it, to delete it, and to limit the use of sensitive personal information.
On zolley.com we do not sell what you submit, but our use of the Meta pixel and Conversions API is "sharing" in the sense the statute means. You have the right to opt out of it: use the Your Privacy Choices link at the foot of any page (it is our "Do Not Sell or Share My Personal Information" link), or send a Global Privacy Control signal, which we honor automatically. Our lead-generation websites do sell, in the sense the statute means, and each carries its own Do Not Sell or Share My Personal Information link and honors Global Privacy Control signals.
You can ask us to delete information held about you across any Zolley property by emailing [email protected]; you do not need to know which site collected it.
We do not collect sensitive personal information as CCPA defines it. We do not knowingly collect the information of anyone under 16.
To exercise any right: [email protected] or (888) 503-3750, toll-free. You may use an authorized agent; §8 explains how we confirm a request.
11Other U.S. state privacy laws
A growing number of states give their residents privacy rights like California's, including Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia. Depending on the state, they include the right to access, correct, delete and get a copy of your information, and to opt out of targeted advertising, sale and profiling. We honor these requests from anyone, whichever state you live in, through the same contacts as in §8.
We use the Meta pixel for targeted advertising; you can opt out through Your Privacy Choices or with a Global Privacy Control signal (§8). We do not sell what you submit on our forms. Some states give you a right to appeal a refused request; if we refuse one, we will tell you how to appeal.
12If you are in the UK or EEA (GDPR)
Our lawful bases: consent for marketing messages, legitimate interests for replying to your inquiry and keeping our records defensible, and contract where we are working together. You have the rights of access, rectification, erasure, restriction, portability, and objection, and the right to complain to your supervisory authority.
This website is aimed at businesses in the United States, and its analytics and advertising tools (§4) run the same way for every visitor. If you are in the UK or EEA, you can switch them off at any time through Your Privacy Choices, and you can object to that processing by emailing [email protected].
13Do Not Track
Browsers send "Do Not Track" signals inconsistently and there is no agreed standard for honoring them, so this website does not respond to them. We do honor the Global Privacy Control signal: if your browser sends it, advertising measurement is switched off for you automatically on this website, and on every Zolley property.
14Security
Form submissions travel over HTTPS. Our backend holds its credentials server-side; the website never carries an API key. Access to the CRM is limited to people who need it. Turnstile filters automated submissions before they reach us.
No system is perfectly secure, and we will not claim otherwise. If a breach affects your information, we will notify you as the law requires.
15Links to other sites
Our footer links to our social profiles. These are plain links: nothing from those platforms loads on this site, and they learn nothing about your visit unless you click. Once you do, their policies apply.
16Changes
We will update this page and change the date at the top. Material changes will be posted before they take effect.
17Contact
[email protected] Zolley, LLC, 150 E Palmetto Park Rd #800, Boca Raton, FL 33432 · (888) 503-3750
