Privacy Policy

1. Who we are

Growth For Legal is a marketing agency that works exclusively with law firms in the United States. We run search, paid media and web design for our clients. This policy explains what happens to information when you visit growthforlegal.com, book a call with us, or email us.

We are not a law firm, and nothing on this site creates an attorney–client relationship.

2. What this policy covers

It covers this website and the emails, calls and proposals that follow from it. It does not cover:

• Websites we build or run for client law firms. Each of those has its own privacy policy, and the firm decides what happens to the data collected there.
• Information we handle on a client's instructions rather than our own — see section 9.
• Third-party sites we link to.

3. Information we collect

Information you give us

You can read every page on this site without telling us anything. You give us information when you:

• Book a call. The calendar on our Get Started pages is an embedded Cal.com booking form. Your name, email address, time zone and answers to a couple of qualifying questions are typed into Cal.com, which passes the booking to us.
• Email us or reply to us — including anything you attach.
• Give us access to an account during a scoping conversation or audit. If you grant us access to an ad account, analytics property, Search Console or a CRM, we can see what that account contains.

Information collected automatically

Our host, Vercel, logs every request to the site: IP address, browser and device user agent, the page requested, the referring page and a timestamp. That is ordinary server logging, and we use it to keep the site up and to investigate abuse.

The Meta Pixel records page views and one booking event, described in section 4.

Information from other sources

Meta gives us aggregate advertising reports — how many people saw an ad and how many booked a call — not a list of who they were. Clients and contacts occasionally pass on someone's details when they refer them to us.

We do not buy contact lists.

4. Cookies, pixels and what this site loads

This site sets no cookies of its own. It loads four third-party services, three of which can see your IP address:

• Meta Pixel — loads on every page. It sets Meta's own cookies (chiefly _fbp), records a page view, and records a booking event when a call is successfully scheduled. We have switched off Meta's automatic event detection, so the only events sent are the two we declare — the pixel does not scrape the page and invent events from the buttons you click. We use it to measure which ads produce booked calls and to build advertising audiences. What Meta then does with it is governed by Meta's privacy policy.
• Cal.com — the booking calendar on both Get Started pages is served inside an iframe by Cal.com, which sets its own cookies. Anything you type into that calendar reaches Cal.com first. See Cal.com's privacy policy.
• Google Fonts — two typefaces load from Google's font service, so Google receives your IP address and user agent when a page loads. No cookie is set.
• Vercel — our host and content delivery network, which produces the request logs described above.

Controlling this. Blocking third-party cookies in your browser stops the Meta Pixel from associating your visit with a Meta account, and privacy-focused browsers and extensions block the pixel outright. Meta's own ad preferences control how Meta uses activity it has already collected. You can also email us and we will suppress your information from our advertising audiences.

5. How we use information

• To reply to you, run the call you booked, and prepare whatever we said we would prepare for it.
• To deliver, report on and invoice for our services if you become a client.
• To measure which ads, pages and channels produce booked calls, and to improve the ones that do not.
• To keep the site secure and diagnose faults.
• To send you email you asked for, and to stop sending it when you ask.
• To meet our legal, tax and accounting obligations.

We do not use anything you share during a scoping conversation to help a competing firm. We take one firm per practice area per market, which is the operational version of that promise.

If you are in the UK or EU: we rely on your consent for advertising cookies, on the necessity of taking steps at your request before entering a contract when you book a call, on the performance of our contract once you are a client, and on our legitimate interest in running and securing our own website.

6. When we share information

We do not sell personal information for money, and we do not share the contents of your enquiry with anyone outside our team.

Information is shared with:

• Service providers that run parts of our business — Vercel for hosting, Cal.com for scheduling, plus our email, storage and accounting providers. Each receives only what it needs to do its job.
• Meta, through the pixel described in section 4. Several US state privacy laws define "sale" and "share" broadly enough that advertising pixels count as sharing personal information for cross-context behavioural advertising, even though no money changes hands. Section 8 covers how to opt out.
• Anyone we are legally required to share with — a court order, a lawful request from an authority, or where sharing is necessary to protect someone's safety or our legal rights.
• A buyer or successor, if the business is ever sold, merged or reorganised. Where the law requires notice, you will get it.

7. How long we keep it

• Enquiries that do not become clients — deleted within 24 months of our last contact.
• Client records — kept for the length of the engagement and for seven years afterwards, which is what tax and contractual record-keeping require.
• Server logs — retained on our host's rolling schedule, typically around 30 days.
• Advertising data held by Meta — retained on Meta's schedule, not ours. Use Meta's controls to reach it.

You can ask us to delete sooner. See section 8.

8. Your privacy rights

Which rights you have depends on where you live — California, Colorado, Connecticut, Virginia, Texas and a growing list of other states each have their own statute, as do the UK and EU. Rather than make you work out which applies, we run the same process for everyone. Email info@growthforlegal.com and tell us what you want:

• A copy of the personal information we hold about you, and where it came from.
• Correction of anything inaccurate.
• Deletion.
• To stop receiving email from us.
• To opt out of the advertising sharing described in sections 4 and 6.
• For UK and EU residents: restriction of processing, objection to processing, portability, and the right to complain to your data protection authority — in the UK, the Information Commissioner's Office.

We reply within 45 days for US state requests and within one month for UK and EU requests, and we will tell you if we need longer. We may need to verify your identity first, and an authorised agent may act for you with written permission. We will not treat you differently, charge you more or give you a worse service for exercising any of this.

Do Not Track and Global Privacy Control

Some browsers send a "Do Not Track" header, and some send a Global Privacy Control signal. There is no settled standard for how a site like this should respond, and this site does not currently change its behaviour when it receives one. The browser controls in section 4 work, and so does emailing us.

9. Information we handle for client firms

Running a law firm's marketing means handling information that belongs to the firm and its prospective clients: enquiries submitted through the firm's site, call tracking records, CRM exports and ad account data. Some of it identifies people who contacted a lawyer about a legal problem, which is about as sensitive as personal information gets. We treat it accordingly.

• We act on the firm's instructions, as its service provider — not for our own purposes.
• We use it only to run and report on that firm's marketing. We do not merge it into our own marketing, and we never advertise to those people on our own behalf.
• Clients own their ad accounts, analytics, website, content and call tracking outright, from day one. When an engagement ends, access returns to the firm and we delete our working copies.
• If you contacted a law firm and want your information removed, contact that firm. They decide, and we act on their instruction.

10. Security

The site is served only over HTTPS, with HSTS enabled so browsers refuse to fall back to an unencrypted connection. Access to client accounts and reporting is limited to the people working on that account. No system is perfectly secure, and we will not pretend otherwise — but if a breach affects your information, we will tell you and the relevant authority where the law requires it.

11. Where your information is processed

We are based in the United States, and our providers process and store information there. If you are visiting from the UK, the EU or elsewhere outside the US, using this site or contacting us means your information is transferred to the United States, where privacy law differs from your own. Where a transfer mechanism is required, we rely on the standard contractual clauses our providers include in their terms.

12. Children

This site sells marketing services to law firms. It is not directed at children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has given us information, email us and we will delete it.

13. Links to other sites

We link to client sites, tools, articles and legal resources. Once you follow a link, that site's privacy policy governs, not ours. We have no control over what they collect.

14. Changes to this policy

When we change this policy we update the date at the top of the page. If a change materially affects what we collect or who we share it with, we will say so plainly at the top of the page rather than rely on you noticing a new date.

15. How to contact us

Privacy questions, requests and complaints all go to the same place, and a person reads them:

• Email — info@growthforlegal.com
• Post — [Legal entity name and mailing address — see PLACEHOLDERS.md]

If you are unhappy with how we handled a request, say so in the same thread and we will escalate it. UK and EU residents can also complain to their national data protection authority.