What I do with your information.

The short version

I run Beefed Up as one person. I ask for the least information I can get away with, I use it only for the reason you gave it to me, and I do not sell it, rent it, or trade it to anybody. There is no data broker on the other end of this website.

Two things collect information here. The contact form, when you choose to fill it out. And Google Analytics, which tells me how many people read a given blog post. That is the whole list.

If you want anything I hold about you deleted, email kael@getbeefedup.com and I will do it. You do not need to explain why, and I will not ask.

What I collect

When you fill out the contact form

The form on the contact page asks for your first name, last name, email address, and phone number, all required, plus your company name, company website, annual revenue range, and whatever you write in the message field, all optional. I ask for the revenue range because it is the fastest way to tell whether I am the right fit before either of us spends time on a call.

You choose what goes in that form. Nothing in it is collected automatically, and I would rather you leave a field blank than fill it with something you are not comfortable sending.

When you just read the site

Google Analytics records the pages you visit, roughly how long you stay, the approximate city your connection resolves to, the type of device and browser you are using, and the site or search that sent you here. It does not tell me your name, your email, or your exact location, and I have no way to connect that data to you as a person.

My host, Netlify, keeps standard server logs of requests to the site, including IP addresses, for a short period. That is ordinary web hosting infrastructure, not something I set up to watch you.

What I do not collect

• No accounts, no passwords, no logins. There is nothing to sign up for.
• No payment information. If we work together, invoicing happens outside this website and card details never touch it.
• No advertising or retargeting pixels. I run Google Ads for clients, but I do not run remarketing tags on my own site, so reading this page will not cause my ads to follow you around the internet.
• No comment section, no forums, no user-generated content.

Cookies, and what each one does

This site sets analytics cookies only. There is no consent banner because there is nothing here worth interrupting you over, but you are entitled to know exactly what is being set, so here it is in full.

_ga

Set by Google Analytics. Assigns a random identifier so a returning visitor is counted as one person rather than two. Expires after two years.

_ga_<container id>

Set by Google Analytics 4. Tracks the state of your current visit so a single session is not counted as several. Expires after two years.

Both are loaded through Google Tag Manager, which is a container for scripts rather than a tracker itself. Google Analytics is the only tag in the container.

You can block these outright. Every major browser lets you refuse cookies in settings, Google publishes a browser add-on that opts you out of Analytics entirely, and most content blockers stop it by default. The site works identically either way. Nothing on it is gated behind accepting a cookie.

How I use it

Contact form submissions are used to reply to you and, if it goes somewhere, to run the resulting project. That is the entire purpose.

Analytics data is used to decide what to write next. If a blog post about Google Ads budgets gets read three times as often as one about brand strategy, I write more about budgets. That is the depth of the analysis.

I do not run automated decision-making or profiling against anything collected here, and I do not build marketing lists out of contact form submissions. If I ever start a newsletter, it will be something you knowingly opt into on its own form, not a box I quietly add you to because you once asked about a website.

Who else sees it

I am the only person at Beefed Up, so internally the answer is just me. The services below process data on my behalf because the site has to run on something.

Netlify

Hosts the site and receives contact form submissions. US-based.

Google (Analytics and Tag Manager)

Receives the usage data described above. Governed by Google’s own privacy policy.

Resend

Delivers transactional email, which is how a form submission reaches my inbox. US-based.

Amazon S3

Stores images and files used on the site. No visitor data.

Beyond those, the only circumstance in which I would hand over your information is a valid legal order compelling me to. If that ever happens and I am permitted to tell you, I will.

How long I keep it

If you contact me and we do not end up working together, I keep the submission for about a year in case you come back, then delete it.

If we do work together, I keep project correspondence and records for as long as the engagement runs plus seven years, because tax and accounting rules require it.

Analytics data follows Google’s retention setting, currently fourteen months, after which it is deleted on their side automatically.

Any of this shortens the moment you ask me to delete something. The retention periods above are defaults, not commitments I am going to hold you to.

Your rights, and how to actually use them

Depending on where you live, you may have a formal legal right to see what I hold about you, correct it, delete it, or receive a copy of it. California residents have these rights under the CCPA as amended by the CPRA, and several other states have passed comparable laws.

I am going to skip the part where I explain the statutory process, because for a one-person business it is theater. Email kael@getbeefedup.com and tell me what you want done. I will confirm within a few days and complete it within thirty, which is the legal deadline anyway. There is no form, no portal, and no verification runaround beyond me making sure you are who you say you are.

Two disclosures the California law specifically requires, both of which are short here. I have not sold or shared personal information in the past twelve months, and I have no plans to start, which means there is nothing for a “Do Not Sell or Share My Personal Information” link to switch off. And I will never treat you differently, charge you more, or refuse to work with you because you exercised a privacy right.

If your browser sends a Global Privacy Control signal, it is honored by default, in the sense that the thing it opts you out of is something I was never doing.

How I keep it safe

The site runs over HTTPS everywhere. The third-party services listed above are all accessed with unique, randomly generated passwords stored in an encrypted password manager, with two-factor authentication turned on wherever the service supports it. The machines I work from are disk-encrypted and lock themselves when idle.

None of that is a guarantee, and I am not going to pretend otherwise. No system is perfectly secure. What I can commit to is that if a breach ever exposes your information, I will tell you directly and quickly rather than burying it.

Children

This site sells marketing services to business owners. It is not directed at children, and I do not knowingly collect information from anyone under thirteen. If you believe a child has sent me something, email me and I will delete it immediately.

Changes to this policy

If this policy changes, the updated version takes effect when it is published here and the date at the top changes with it. If a change materially affects what I do with information already collected, I will say so plainly at the top of the page rather than hoping you re-read it.

Who to contact

Kael Broersma, founder and the person responsible for privacy at Beefed Up.

• Email: kael@getbeefedup.com
• Phone: (623) 218-8121
• Cave Creek, Arizona, United States

Beefed Up is a service-area business. I work with clients across the Phoenix metro and remotely throughout the US, so there is no storefront address to publish. If you need something in writing on paper, email me and I will arrange a mailing address.