Privacy Policy

CodeAspen LLC is a software studio headquartered in Houston, Texas. We build web platforms, automation and integrations, data and internal tools, and AI features for businesses across the United States.

• Contact form — your name, email, company, what you need and your message, plus a phone number if you add one
• Chat — everything you type to our AI chat assistant, including any contact, company or project details you share, such as name, email, phone, industry, budget and timeline
• Booking a call — the name, email and notes you enter in the booking calendar (Section 04, Scheduling)

• IP address and browser details — received by our hosting provider with every request. We store them with each lead from the contact form or chat, and keep a hashed IP address with each chat to limit abuse.
• Site activity — the page that referred you, the pages you visit and how you use them (Section 04, Analytics)
• Our visitor and conversation IDs — described in Section 06
• Campaign tags and ad click IDs — from the link you followed to reach us (Section 06)
• Error and reliability data — such as error messages, the page address, your browser and our visitor ID, used to keep the site working

We do not knowingly collect:

• Social Security numbers or government-issued identification numbers
• Financial account or payment card information through this website
• Biometric data
• Precise geolocation data
• Health or medical information
• Information from children under the age of 13

• Responding to you — to reply to your inquiry and follow up by email or phone
• Service delivery — to deliver services you engage us for and send project updates and invoices
• Running the website — to operate, secure and improve the site, including analytics, abuse prevention and fixing errors
• Campaign attribution — to see which links and campaigns bring people to the site
• Advertising — to measure our ads and show them to past visitors, when ad tools are on (Section 05)
• Legal — to comply with the law and respond to lawful requests

We use service providers to run the website, and we share personal information with them only so they can provide their service to us.

We may also share information with professional advisors, such as lawyers and accountants, and with authorities when the law requires it. Advertising platforms are covered in Section 05.

We may use ad measurement tools from Google, Meta and TikTok to learn which of our ads bring people to the site and to show our ads to people who have visited it. When they are on and you have not opted out, they may set cookies and collect information about your device and the pages you visit here, and the platforms may connect it with your activity on other websites and apps over time. When you send the contact form or share contact details in the chat, we may also send them limited details, such as a hashed name, email address or phone number, your IP address, browser details and the ad click ID from the link you followed, to measure and improve our ads. Each platform handles this information under its own privacy policy.

We do not sell personal information for money, and we do not sell sensitive data.

Do Not Track and Global Privacy Control

We treat a Global Privacy Control (GPC) or Do Not Track (DNT) signal from your browser as an opt-out of ad tracking. With either signal, the ad tools do not load, our cookies do not keep ad click IDs from links, and nothing from your contact form or chat is sent to ad platforms. These signals do not change our analytics, chat or contact form, which work the same either way.

Opt out of ad tracking

Besides a browser signal, you can opt out in two ways:

• In this browser. The button below saves a cookie that keeps ad tracking off in this browser, from the next page you load, for up to 2 years or until you clear your cookies or press it again. It also deletes the ad click IDs our cookies hold in this browser.
• By email. Write to daniyal@codeaspen.com with "Ad opt-out" in the subject, from the address you use with us. Our servers will then stop sending anything tied to that address to ad platforms. To also keep the ad tools in your browser off, use the button or a browser signal.

You can also limit ads at the source, in Google's My Ad Center, Meta's ad preferences and TikTok's ad settings, or across many companies at YourAdChoices and the Network Advertising Initiative. Those choices are run by others and do not change what this website does.

We set these first-party cookies:

• Visitor ID (_ca_visitor_id) — a random ID set on your first page view, for every visitor. It links your visits, analytics events and chats to the same browser, and to a lead record if you send one. It is stored with chats, leads and error logs in our database, and sent to our analytics provider with chat and error events. It is never sent to ad platforms. Lasts up to 2 years.
• Conversation ID (_ca_conversation_id) — points to your current chat in our database. Scripts on the page cannot read it. Lasts 30 days.
• Campaign tags and ad click IDs (_ca_utm_*, _ca_gclid, _ca_fbclid, _fbc, _ca_ttclid) — if the link you followed carries campaign tags or an ad click ID, we save them for up to 90 days and store them with a chat or contact form you send. When Meta's tools are on, we also store Meta's browser cookie (_fbp) that way. If you have opted out, we skip the ad click IDs and Meta's cookie. When ad tools are on, a click ID may go to the platform that issued it (Section 05).
• Ad opt-out (ca_ads_optout) — remembers that you opted out of ad tracking (Section 05). Lasts up to 2 years.

We also keep a few short-lived flags in your browser's session storage so analytics events are not counted twice. Our analytics provider sets no cookies. When ad tools are on and you have not opted out, Google, Meta and TikTok may set their own cookies. You can block or delete cookies in your browser settings; some features, such as chat, may not work without them.

Our website has an AI chat assistant. This is how it handles what you type:

• We store your messages and the replies in our database, with our visitor and conversation IDs and any campaign tags and ad click IDs from the link you followed (Section 06).
• To write replies, your messages go through our hosting provider's AI gateway to an AI model provider. If you share contact details, the same route writes a short summary of the chat, which may be emailed to us with the transcript.
• Before your messages are stored or sent to the AI model provider, we automatically remove patterns that look like Social Security numbers, individual taxpayer ID numbers (ITINs), payment card numbers and dates of birth.
• We set the gateway to use only AI providers that do not train on the prompts they receive, and we do not use your data to train AI models. The AI model provider keeps request data under its own retention policy.
• Replies are written by AI and can be wrong. Prices, timelines and other details from the chat are not binding; only a signed agreement is. The assistant makes no decisions with legal or similarly significant effects about you.
• Reset starts a new chat but does not delete the old one. To delete your chats, email us (Section 10).

We keep contact form submissions, chats and lead records for as long as we need them for the purposes in this policy, including any business relationship with you and our legal and accounting needs. Server logs and emails are kept under our providers' standard retention.

You can ask us to delete your information at any time (Section 10). Deletion covers the records we control; the AI model provider and any ad platform keep what they received under their own policies.

We use reasonable safeguards to protect the personal information we collect, including:

• Encryption in transit — all traffic between your browser and our servers uses HTTPS
• Encryption at rest — database records are encrypted at rest by our database provider
• Access controls — access to personal data is limited to people who need it
• Security headers and a Content Security Policy — including HSTS, X-Content-Type-Options and X-Frame-Options
• Rate limits — on the contact form and chat, to prevent abuse
• Validation — what you submit is validated on our servers, and database access rules add a second check

No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

You can ask us to tell you what personal information we hold about you, give you a copy, correct it, delete it, or stop using it for advertising (Section 05). Email daniyal@codeaspen.com with "Privacy request" in the subject, your name, the email or phone you used with us, and what you would like us to do.

We may need to verify your identity first. We will respond within 45 days, and if we cannot do what you ask, we will tell you why. You can make a request through an authorized agent; we may ask for proof that they act for you. We will not treat you differently for making a request.

Our website and services are not directed to children under the age of 13, and we do not knowingly collect personal information from children under 13. If we discover that we have inadvertently collected information from a child under 13, we will promptly delete that information. If you believe a child under 13 has provided us with personal information, please contact us at daniyal@codeaspen.com.

If a data breach affects your personal information, we will notify you and the relevant authorities as the law requires.

This website is operated from the United States. If you visit from outside the United States, your personal information will be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your country. By using this website and providing your information, you consent to that transfer, storage, and processing.

Our website may link to websites or services we do not operate. We are not responsible for their content, privacy policies, or practices, and we encourage you to review the privacy policy of every site you visit.

Any marketing email we send will:

• Identify the message as an advertisement (where applicable)
• Include our valid physical postal address
• Include a clear and conspicuous unsubscribe mechanism
• Honor opt-out requests within 10 business days

Emails about active work, such as project updates and invoices, are not marketing emails and will continue as needed.

We may update this Privacy Policy from time to time. When we do, we will revise the "Updated" date at the top of this page. For material changes that significantly affect how we handle your personal information, we will provide additional notice, such as an announcement on our website. Your continued use of our website after changes are posted means you accept the updated policy.

If you have questions or concerns about this Privacy Policy, our data practices, or your privacy, contact us at: