Detroit Web Agent
Grosse Pointe Park, MImatt@detroitwebagent.com(313) 992-1219
DWA · Detroit Web Agent
Menu

Legal · In writing

Privacy Policy

What I collect, why, who else touches it, and how you can see it or get it deleted. Written to be read, not skimmed past.

Last updated October 4, 2026

Who's responsible

Detroit Web Agent, 15121 Kercheval Ave, Grosse Pointe Park, MI 48230 is responsible for the information described here. Questions go to Matt: matt@detroitwebagent.com or (313) 992-1219.

What you give me

  • The site-check form: your name, phone number and website.
  • Waitlist sign-ups: the email and phone number you enter.
  • The AI assistant on this site: what you type into the chat. If you give your name and a way to reach you there, those details and a short excerpt of what you wrote are saved as a lead.
  • Calls and texts to DWA's line: your phone number, the time, the text messages, and any voicemail you leave.
  • Clients: your business details, onboarding answers, photos and content, and access to the accounts you connect.
  • Billing: Stripe processes every card and bank payment. DWA never receives or stores your full card number or bank account number. I see what Stripe shows a business owner, such as the name on the account, the amount and the last four digits. Stripe's own privacy policy, at stripe.com/privacy, covers what it does with payment details.

What's collected automatically

When you visit, analytics tools record the pages you view, roughly where you are, your device and browser, and how you got here. The Cookie Policy lists each tool.

On our marketing pages (never on checkout or sign-up), Sentry logs site errors (the error message, the page address without its query string, and your browser type) and PostHog counts page views and clicks without cookies or session recording; neither receives what you type into forms, and both stay off if your browser sends Do Not Track.

SiteRadar, DWA's own visitor analytics, looks up which network a visit comes from so it can name companies that browse from their own business network. It doesn't use cookies, and the raw IP address isn't stored. Home, mobile and VPN visitors aren't identified.

The companies that host this site and its database keep standard server logs, including IP addresses, for security and troubleshooting.

How it's used

  • To answer you: a call back or a text within one business day.
  • To deliver the services you buy, and to bill for them.
  • To see which pages and ads work, so the site gets better.
  • To keep the site and accounts secure, and to meet legal and tax obligations.

Your phone number isn't used for marketing texts you didn't ask for, and it isn't shared with anyone for their marketing.

Who else handles it

A small set of service providers process information for DWA, only to run the business:

  • Vercel (website hosting) and Supabase (database and back-end functions).
  • Twilio (calls and texts).
  • Anthropic (the AI model behind the site's assistant and DWA's drafting work).
  • Stripe (payments), Resend (email delivery) and DWA's business email provider.
  • Google Analytics, the Meta Pixel, PostHog (site analytics and ad measurement) and Sentry (error tracking).

For clients, the platforms you connect, such as Google, LinkedIn, Meta and YouTube, receive what's published to them on your behalf.

Information may also be disclosed if the law requires it, or to a company that takes over the business (see the Terms).

DWA doesn't sell personal information for money. The Meta Pixel and Google Analytics do let those companies see that you visited this site, which some state laws treat as "sharing" for advertising. The Cookie Policy explains how to turn that off.

Information about a client's customers

When DWA runs a service for a client, such as missed-call text-back or an AI assistant on the client's own website, it handles that client's customers' information (callers' numbers, texts, chat messages, form leads) on the client's behalf. It's used only to provide that service to that client. The client's own privacy policy applies to its customers.

Connected accounts and deleting your data

To publish for you, DWA asks you to connect your own Facebook, Instagram, LinkedIn, YouTube, X or Google Business Profile account. You do that yourself, on the platform's own sign-in and permission screen.

  • What's accessed: only the permissions needed to publish content you've approved and to read basic analytics, such as reach and engagement on those posts. Nothing is posted without approval in the Client Hub.
  • How it's stored: the access token the platform issues is encrypted before it's saved. It's never shown to anyone, including you.
  • What it's not used for: DWA doesn't sell or share this information, doesn't send unsolicited messages, and doesn't scrape your accounts.

To disconnect an account, open the Client Hub, go to Account, and disconnect it under Social accounts. That deletes the stored token right away, and DWA can no longer reach that account.

You can also remove DWA's access from the platform itself, for example in Facebook under Settings, then Business Integrations. Either way works.

To have all of your data deleted, email matt@detroitwebagent.com and say so. Everything is deleted within 30 days, except anything the law requires DWA to keep, such as tax records.

YouTube API Services

If you connect a YouTube channel, DWA uses YouTube API Services. By connecting, you also agree to be bound by the YouTube Terms of Service. Google's privacy policy is at policies.google.com/privacy.

DWA's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

  • Upload (youtube.upload): DWA uploads a video to your own channel only after you, or DWA during your first 30 days, approve it in the Client Hub.
  • Read-only (youtube.readonly): DWA reads your channel name and basic video statistics, such as views and likes, to confirm the right channel is connected and to build your monthly report.
  • DWA does not sell or share this data, does not use it for advertising, and does not transfer it to anyone except as needed to provide the service to you or as the law requires.

To stop access, disconnect YouTube in the Client Hub (Account, then Social accounts), which deletes the stored token right away. You can also revoke DWA's access at myaccount.google.com/permissions. To delete your data, see the section above.

YouTube data we access, and how we protect it:

  • Data accessed: your channel ID and channel name (to confirm the right channel is connected), basic statistics and the processing status of videos DWA uploaded for you, and the video file you approved for upload. DWA does not access your viewers' data, your comments, your subscribers' personal information or your private videos.
  • Data stored: the OAuth access and refresh tokens Google issues, plus the channel ID, channel name, and the video IDs and links of what DWA uploaded. Nothing else from YouTube is kept.
  • Encryption: tokens are encrypted with AES-256-GCM before they are saved in DWA's Supabase database, and the encryption keys are kept separately from the database. All traffic uses TLS (HTTPS). Tokens are only ever handled by server-side functions, never sent to a browser, and database access rules (row-level security) block every other account from reading them.
  • Least privilege: DWA asks for only two permissions, youtube.upload and youtube.readonly. Each upload happens only after the post is approved in the Client Hub.
  • Retention and deletion: when you click Disconnect, the stored tokens are erased immediately. Channel details and upload records are deleted within 30 days of a disconnect or of your request, except anything the law requires DWA to keep. To ask, email matt@detroitwebagent.com.
  • No sale or sharing: YouTube data is never sold, rented, shared with third parties, used for advertising, or used to train AI or machine-learning models. The only people who can see it are you and the DWA staff who run your account.
  • Limited Use: DWA's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. The data is used only to provide the upload and channel-confirmation features you asked for. No person reads it except where you give permission, for security or abuse investigation, or where the law requires.
  • Revoke at any time: myaccount.google.com/permissions. Revoking stops all access straight away.

How long it's kept

Leads and client records are kept as long as they're needed to serve you and to meet tax and legal record-keeping rules. There's no fixed deletion schedule yet. Ask, and anything that isn't legally required to be kept will be deleted.

When a client leaves, they get a full export of their data first.

Your choices

  • Ask to see, correct, export or delete the information DWA has about you. Email or call; you'll get a reply within one business day.
  • Stop texts at any time by replying STOP. See SMS Terms.
  • Limit analytics and ad tracking with the options in the Cookie Policy.

Privacy rights under state law

Some states, including California, give their residents specific rights over personal information: to know what's collected, to get a copy, to correct it, to delete it, and to opt out of its sale or its use for targeted advertising. DWA honors requests to see, copy, correct or delete your information from anyone, wherever you live. DWA doesn't sell personal information; to limit ad measurement by the Meta Pixel and Google Analytics, use the options in the Cookie Policy.

  • To make a request, email or call using the contact details below. An authorized agent can also ask on your behalf.
  • Before sharing or deleting anything, DWA confirms the request really comes from you, usually by replying to the email address or phone number on file.
  • You'll get a first reply within one business day, and a full answer within the time the law allows (45 days in most states).
  • Using these rights never changes the price or the quality of the service you get.

Security

Access to your information is limited to the people and services that need it, and payment details stay with Stripe. No system is perfectly secure, so if something ever goes wrong that affects your information, you'll hear about it directly.

Children

This site and DWA's services are for businesses and adults. They aren't directed to children under 13, and DWA doesn't knowingly collect their information.

Changes

When this policy changes, the new version is posted here with a new date.

Contact

Matt Michels, Detroit Web Agent, Grosse Pointe Park, MI. Email matt@detroitwebagent.com or call or text (313) 992-1219.