Your information and privacy choices.

Parabox Digital is a web design and development studio based in Sacramento, California, United States. We are the party responsible for the personal information described here: the controller, in the language of the European and UK regulations, and a business under California law.

Questions, requests or complaints about this policy go to hello@paraboxdigital.com.

This policy covers paraboxdigital.com and its three free tools: the Parabox Digital QR Studio at qr.paraboxdigital.com, the Parabox Digital Scorecard at score.paraboxdigital.com (also served at paraboxdigital.com/score) and the Parabox Digital Roadmap at roadmap.paraboxdigital.com. It covers the four sites themselves, and the inquiries that reach us through them.

It does not cover work we carry out inside a client's own systems. On a client project we normally act as a processor on that client's instructions, and their privacy notice governs the data involved. It also does not cover sites we link to, including LinkedIn and Instagram. Once you follow a link out, that company's policy applies. Nor does it cover the scan counts behind a client's own tracked QR codes: those are that client's records, kept on their instructions, and their notice governs them.

The contact form, on the home page and at /contact, asks for your name, your email address and what the site needs to do. It also asks, optionally, for the type of project, your current website and a timeline. Everything in that message is up to you, so please leave out anything sensitive you would rather not put in an email.

The booking form at /book asks for your name and your email address. Its other questions are optional: what you need, your current website, a budget to launch and a monthly budget (each as a range), a timeline and a note. If you are keeping your current site, it also asks what that site runs on.

The Partner application at /partner asks for your name, your email address and your business's name, along with what the business sells, what a good year would look like and what a marketing department should do first. It also asks, optionally, for the business's website, where its customers come from, who handles its marketing, its monthly marketing spend (as a range) and what it has tried.

Form submissions are transmitted through Web3Forms, a form delivery service, which passes the message to our inbox. We use it so the site can send mail without running a server of its own.

When you send the booking form, the page asks Cal.com, our booking service, for free times in your time zone. Confirming a time sends Cal.com your name, email address, time zone and a note of your answers, and Cal.com emails you the confirmation and a calendar invitation. If the times cannot load, Cal.com's own booking page opens inside ours with the same details filled in. The link we give people we have met in person opens the calendar straight away and asks only for a name and email address.

The plan questionnaire, on /pricing and at /pricing/fit, sends us nothing. Its answers stay in your browser tab (section 07). The link to the booking form at the end carries them as short codes in its address, so the form can fill in its note, and they reach us only if you send that form.

The Scorecard asks nine questions about your business, each answered with a tap, and then for an email address. When you send it, your address, your answers and a summary of the result are kept in our database, and a copy is emailed to our inbox through Web3Forms. The Roadmap asks for an email address so we can send you a printable copy of the plan you picked. The address and that plan are kept in our database, one record per address, a copy is emailed to our inbox through Web3Forms, and we send the printable copy by hand.

If you email or call us directly instead, we hold whatever you send: your address or number, and the contents of the exchange.

The studio letter is a separate thing entirely, and is covered in the next section.

The signup in the footer asks for one thing: an email address. No name, no company, nothing else. It is used to send the monthly letter and for nothing else. We do not sell it, rent it, or pass it to anyone who wants to sell you something.

The list is run on Mailchimp, and your address is stored there. Nothing from Mailchimp loads while you are reading this site. The signup carries no script: pressing Subscribe hands the address to Mailchimp directly and opens their own confirmation page in a new tab, which is the first and only moment they are contacted. Mailchimp then emails you a confirmation link, and no letter is sent until you follow it. An address that is never confirmed stays on Mailchimp's side as an unconfirmed record and receives nothing; ask us and we will delete it.

Mailchimp records the ordinary things a mailing service records about the letters it sends (whether one was opened, and which links in it were followed), so we can tell whether anyone is reading. It is told nothing about what you do on this website, and the analytics described below are told nothing about the letter.

Every letter carries an unsubscribe link, and one press is enough. You can also write to us and we will take the address off. Subscribing and inquiring are separate: sending the contact form does not put you on the list, and leaving the list does not affect an enquiry.

Some information arrives simply because the page loaded. None of it is used to build a profile of you.

• Server logs. This site is hosted on Vercel. Like any web host, Vercel processes the IP address, browser and page requested to serve the site and to defend it from abuse.
• Vercel Web Analytics. A page-view count with no cookies and no persistent identifier. It reports totals (pages, referrers, countries), not people. This one runs whether or not you accept cookies, because it does not store anything on your device or single you out.
• Fonts. The typeface is served from this site, not from a third party. Loading a page does not send your browser to Google for the font.

Nothing analytical loads until you accept it. Google Analytics and Microsoft Clarity are not in the page as it arrives; the scripts are injected only after you press Accept, and no request is made to googletagmanager.com or clarity.ms before that. Decline, and they are never fetched at all.

If you accept:

• Google Analytics 4 records which pages are visited, roughly where from, and how people move through the site. It is also told how far each form got and which answers were picked in the plan questionnaire, and never what you typed.
• Microsoft Clarity records session replays and heatmaps (pointer movement, clicks and scrolling), so we can see where a layout is failing. Everything you type into a form field on these sites is masked out of those recordings. What you send us reaches us by email and is never part of a replay. Boxes you tick and answers you tap are not masked, so a replay can show which ones you picked, including a budget or spend range. Keyboard input outside form fields is not masked and may appear in a replay, for example keys pressed for a display easter egg. The studio's own words (headings, labels, hints, the errors the form raises) are left legible, so a heatmap shows which sentence was read instead of a column of grey blocks.

Clarity is also told a few plain facts about the page you were shown, so that a heatmap can be read one condition at a time rather than as an average of all of them: which page of this site it was, whether it was light or dark, whether a colour palette was on, which city the corner clock is showing, roughly how wide your window was, and whether you asked your system for reduced motion. It is told the same about what happened on the page: how far the contact, booking or Partner form got (started, stopped by a validation error, sent, or failed to send); for a booking, whether free times were shown, a time was chosen and the call was booked, and which link led to the form; which plan the questionnaire suggested; which question was opened on the FAQ; whether you pressed the like button; which display controls and sliders you used; and, if you arrived at an address that does not exist, which link you took out of the error page. Each of these is a fixed label written by the page. None names you, and none carries anything you typed.

Your answer covers the QR Studio and the Scorecard too. Both run the same two tools behind the same banner, and read the same answer, so accepting or declining in one place settles it for all three sites. You are asked once. The Roadmap runs no analytics at all.

The cookies we set, then the ones Google Analytics and Clarity set. Our three display cookies exist only once you use a display control, whatever you answered the banner.

pbx-consent

Ours, not theirs. The answer you gave this banner, so it stops asking. It is set for paraboxdigital.com and its subdomains, which is how the QR Studio and the Scorecard honour the same answer. 6 months.

pbx-theme

Ours. Whether you chose the light or dark theme, written only when you press the theme control. It is set for paraboxdigital.com and its subdomains, so the free tools open in the theme you chose. 1 year.

pbx-palette

Ours. The colour palette you picked from the theme control. Written when you pick one, renewed on each visit while one is set, and shared with the subdomains the same way. 1 year.

pbx-retro

Ours. Set when you switch on the retro display, removed when you switch it off, and shared with the subdomains the same way. 1 year.

_ga, _ga_<id>

Google Analytics. Distinguishes one browser from another. Up to 2 years.

_clck

Microsoft Clarity. Persists a Clarity user ID. 1 year.

_clsk

Microsoft Clarity. Joins the page views of one session. 1 day.

CLID, MUID and similar

Set by Microsoft on its own domains when Clarity runs. Up to 1 year.

We run no advertising, remarketing or conversion tags of any kind. You can change your answer at any time: reopen the cookie choice, or clear the cookies from your browser settings.

Eight values are kept in your browser's local storage. Your browser does not send local storage with requests, and only the site that wrote a value can read it. Four of these values also have a cookie copy, listed in section 06, and those copies do travel with each request to our sites. Three never leave your device in any form. The last one below is sent only in the one case described there.

pbx-theme

Whether you chose the light or dark theme. Until you choose, the site follows Sacramento time of day.

pbx-palette

The optional colour palette you opened from the theme control. It stays until you pick another.

pbx-retro

Whether you switched on the retro display. It is removed when you switch it off.

pbx-reduce-motion

Whether you turned motion off with the Reduce motion button in the footer. Until you press it, the site follows your system's setting.

pbx-tz

The city whose local time the corner clock shows. Until you pick one, it is Sacramento.

pbx-consent

A second copy of the answer you gave the cookie banner. The record that counts is the cookie in section 06; this copy is what keeps the banner quiet in a browser that drops that cookie early.

pbx-like

Whether you pressed the like button at the bottom of the home page. It is what keeps the heart filled when you come back. It never leaves your browser, and pressing the button again takes the like back.

pbx-uid

A random id with nothing personal in it. It is created only if you press like while a like count is running, and it is sent with that one request so that the same browser is not counted twice. If no count is running, it is never created and nothing is sent.

Clearing your browser's site data removes all eight, along with our cookies in section 06, and the banner will ask again on your next visit.

Five more values are kept in session storage, which your browser clears when you close the tab. None of them is sent anywhere.

pbx-fit

Your answers to the plan questionnaire, so a reload or a trip to the booking form does not lose them.

pbx-intro

That the home page's opening animation has already played.

pbx-editor-mode

That you turned on editor mode, so it stays on from page to page.

pbx-machine-from

The page you left for the plain-text version of the site, so that version can link you back.

pbx-like-quiet

That the like count did not answer this visit, so the page stops asking for it.

The site also runs optional interaction scripts: a custom cursor, display easter eggs, and a draggable element on the error page. These run entirely in your browser, and apart from the analytics events in section 06 they send nothing to us. What they keep is listed above.

Where the UK or EU GDPR applies, our legal bases are:

• Your request. Answering an inquiry, holding a call you booked and sending a copy you asked for from a free tool are steps taken at your request before entering a contract.
• Consent. Analytics and session replay run only on the consent you give at the banner. The studio letter runs on the consent you give by submitting the signup, which is a separate answer to a separate question. Either may be withdrawn at any time. The banner reopens from the link in section 06, and every letter carries an unsubscribe link.
• Legitimate interests. Keeping the site up, secure and free of abuse, and keeping records of who asked us for what.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. No data from this site is traded, rented or handed to advertisers.

It does pass through the suppliers who make the site work, each acting on our instructions:

• Vercel: hosting, delivery and the cookieless page-view count.
• Upstash: storing the like count, which is a list of the random ids described in section 07 and nothing else.
• Neon: the database that keeps Scorecard and Roadmap requests.
• Web3Forms: delivering form submissions, and copies of Scorecard and Roadmap requests, to our inbox.
• Cal.com: showing free times and holding the call, if you book one through /book.
• Mailchimp (Intuit): storing the studio letter list and sending the letters, if you subscribed.
• Google: the mailbox those inquiries land in, and Google Analytics, if you accepted.
• Microsoft: Clarity session replay and heatmaps, if you accepted.

We may also disclose information where the law requires it, or to establish or defend a legal claim.

These suppliers are based in the United States, so information about visitors in the UK, EEA or Switzerland is transferred there. Where those transfers require a safeguard, they rely on the European Commission's Standard Contractual Clauses or an equivalent approved mechanism.

• Inquiries, bookings and free tool requests. Kept while we're talking, and for up to 24 months after the last contact, so we have the history if a project resumes. Ask, and we delete it sooner.
• Client project records. Kept for the length of the engagement and for as long afterwards as our tax and legal obligations require.
• Studio letter address. Kept until you unsubscribe, and removed from the list when you do.
• Google Analytics. Retained for up to 14 months, then deleted by Google automatically.
• Microsoft Clarity. Recordings are deleted after 30 days.
• Your like. The random id stays in the like count until you press the heart again, which takes it back out. Clearing your browser's site data removes your copy of the id, so the like stays counted but you can no longer take it back.
• Like rate limiting. To stop the count being inflated, the like endpoint keeps a small tally against a one-way hash of the network address it was called from. It holds a number, never an address, and it expires within the hour.
• Server logs. Short-lived, held by our host on its own rolling schedule.

The site is served over HTTPS, and form submissions are encrypted in transit. Access to the inbox and analytics accounts is limited to the people who need it and protected by two-factor authentication.

No method of transmission over the internet is completely secure, and we can't guarantee absolute security, but we can tell you plainly what we hold, which is the list above and nothing more.

Wherever you are, you can ask us to tell you what we hold, send you a copy, correct it, or delete it. Write to hello@paraboxdigital.com and we'll respond within 30 days.

California residents have the right to know the categories and specific pieces of personal information collected, the sources and the purpose; the right to delete; the right to correct; and the right to opt out of sale or sharing, though as above, we do neither. You may use an authorised agent, and we will never treat you differently for exercising any of these rights.

UK, EEA and Swiss residents additionally have the right to object to or restrict processing, the right to data portability, the right to withdraw consent at any time, and the right to complain to your supervisory authority: the ICO in the UK, or your national data protection authority in the EEA.

We do not currently respond to browser Do Not Track signals. Because analytics stay off until you accept them, declining the banner achieves the same result.

This site is aimed at businesses and is not directed at children. We don't knowingly collect information from anyone under 16. If you believe a child has sent us something, write to us and we'll delete it.

If what we collect changes, this page changes with it, and the date at the top moves. Material changes to how we handle information already collected will be flagged on the site rather than made quietly.

Parabox Digital
Sacramento, California, United States

Email hello@paraboxdigital.com
Show phone number