We write this in plain English, because that is how we write everything. This page explains what we collect when we build and run your website, why we collect it, who we share it with, and the choices you have. Gnarlywhal serves businesses in the United States, and this policy is written for people in the United States.
Who we are
Gnarlywhal builds and maintains websites for local businesses. Gnarlywhal is a brand operated by Digital Star Marketing LLC ("Gnarlywhal," "we," "us"). When this page says "you," we mean a business owner who asks us to build a site, a customer, a business we reach out to, or anyone who visits this website.
What we collect
Information you give us
- Your name, business name, and the web address you send us.
- Contact details: your email and mobile phone number.
- Details about your business that you tell us, such as your services, service area, hours, and license numbers.
- Payment details, if you become a paying customer. Our payment processor, Stripe, handles your card. We never see or store your full card number.
- For the Engine, the access you grant us to your Google Business Profile, social accounts, and similar tools so we can do the work for you.
- Anything you send us by text or email, including photos, voice notes, and the answers to our questions.
Information about your customers
When you use the Engine, you may share details about your own customers with us, for example a name and number for a review request, or a lead that reaches you through the website we built. We use those details only to do that task for you. Today we draft those messages for you to send yourself. We don't text or email your customers on our own.
Information already public about your business
Before you ever pay us, we research your business the way a customer would. We gather information that is already public: your existing website, your Google Business Profile, your reviews, and your public listings, including the business phone number and address shown there. We use this to build your free preview and to decide which businesses to contact. We are not pulling private data, we are surfacing what is already out there about you. We keep a record of the businesses we research and contact, including when a business asks us not to contact it again.
Information collected automatically
When you visit gnarlywhal.com, Google Analytics records things like the pages you view, your device and browser type, your approximate location based on your IP address, and how you found us. It uses cookies to do this. Our hosting provider, Cloudflare, processes your IP address to deliver the site and protect it from abuse. We don't run ads, and we don't place advertising or retargeting pixels on our site.
How we use it
- To build your website and show it to you before you pay.
- To run the Engine: once a week we text you, report your results from Google, and turn your reply into posts, pages, and review responses.
- To keep your website, Google profile, and reviews current.
- To take payment and send you receipts.
- To send the 10% donation to the cause you choose.
- To answer you when you reach out.
- To decide which local businesses to contact, and to keep track of our conversations with them.
- To understand how people use our website, so we can make it better.
- To protect our services from fraud, spam, and abuse.
- To keep the records the law requires, including records of texting consent and opt-outs.
Text messages
The Engine works by text, so consent matters. When you text HEY to (910) 679-9400, you agree to receive text messages back from us about your business and your account. Before any recurring automated texts start (lead alerts, a weekday note, a Friday summary), we ask you once by text and you confirm with YES. Message frequency varies, usually between one and ten texts a week. Message and data rates may apply.
You can stop at any time by replying STOP, and get help by replying HELP. We will never sell your phone number, and we only text you about your own business and your account. Your consent to texts is not a condition of buying a website from us.
No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging opt-in data and consent will not be shared with any third parties, except the text messaging provider that delivers our messages.
If you give us your email address, we use it to send what you asked for, such as your free check or your preview, plus receipts and messages about your account. We may also send a small number of emails about our services. Every marketing email includes an unsubscribe link, and we honor it. Stripe sends payment receipts and card reminders by email on our behalf.
Who we share it with
We do not sell your information. We share it only with the service providers that help us run Gnarlywhal, and only as much as they need to do their job:
- Hosting and infrastructure (Cloudflare) to serve your website, store our records, protect our sites from abuse, and run a backup AI model.
- Text messaging (Twilio) to send and receive the Engine's texts.
- Payments (Stripe) to take payments, send receipts, and let you update your card or cancel.
- Google to read your business results and publish updates to your profile, with your permission, and Google Analytics to measure visits to our website.
- AI providers (for example, Anthropic, OpenAI, and Google) to help research, write, and design. We send them only what the task needs.
- Email services that deliver our email.
- The charity you choose, which receives your business name with the donation made in your name.
We may also share information if the law requires it, or to protect our rights, safety, or property. If our business is ever sold or merged, your information may transfer as part of that deal, and this policy will still apply to it.
None of the sharing above includes your text messaging opt-in data or consent. Your mobile number and your consent to receive texts are never shared with or sold to anyone for their marketing.
We don't share your information for targeted advertising, and we don't give it to anyone for their own direct marketing.
Connecting your Google account
If you connect your Google Business Profile or another Google account, we use that access only to do the work you asked for, such as reading your profile's results and publishing the updates you approve. We don't use Google user data for advertising, we don't sell it, and we don't use it to train AI models. Our use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements. You can remove our access at any time in your Google account settings.
How long we keep it
- Customers: for as long as you are a customer, and for a reasonable period after so we can meet legal, tax, and record-keeping obligations.
- Businesses we have researched or contacted: while it is useful for our outreach. We delete it when you ask, except a short note that you asked not to be contacted, which we keep so we never contact you again.
- Texting consent and opt-out records: at least four years, because that is how long the law allows claims about texting to be brought.
- Website visit data: for the retention period set in our Google Analytics account.
If you ask us to delete your information, we will, unless we are required to keep some of it.
Your choices and rights
- Ask what information we hold about you, and get a copy.
- Ask us to correct it or delete it.
- Stop our texts by replying STOP, and stop our emails with the unsubscribe link.
- Ask us to stop contacting your business. We'll add you to our do-not-contact list.
- Withdraw the access you granted to your Google or social accounts at any time.
- Close your account.
We honor these requests for everyone in the United States, whatever state you live in. Some states, such as California, Colorado, Texas, and Virginia, give their residents specific privacy rights under their own laws, and we offer the same choices to everyone. We'll ask you to confirm it's really you before we share or delete anything, we'll answer within 45 days, and we won't treat you differently for asking.
To make a request, email hello@gnarlywhal.com or text (910) 679-9400.
Do Not Track
Some browsers can send a Do Not Track signal. There is no common standard for these signals, so our site doesn't respond to them. We don't allow other companies to track you across websites through our site for advertising. Google Analytics does collect data about your visits to our site, and you can block it with Google's opt-out browser add-on.
Security
We protect your information with encrypted connections, trusted providers, and access limited to the people who do the work. No method of storing or sending data online is perfectly secure, so we can't promise absolute security. If a breach ever affects your personal information, we'll tell you without unreasonable delay and notify the North Carolina Attorney General, as North Carolina law requires.
Children
Gnarlywhal is for businesses and is not intended for anyone under 18. We do not knowingly collect information from children, and if we learn we have, we delete it.
Changes to this policy
When we change this policy, we post the new version here with a new effective date at the top. If a change materially affects how we use your information, we'll tell customers by email before it takes effect.
Contact us
Questions about your privacy? Email us at hello@gnarlywhal.com or text (910) 679-9400. Gnarlywhal is operated by Digital Star Marketing LLC in Wilmington, North Carolina.