Privacy Policy.

This policy explains what MakeAndUpdate LLC collects through makeandupdate.com and the client portal, where it goes, how long it stays, and what you can do about it. MakeAndUpdate is a studio of one, so “I” in this policy means me, Nicholas Cabel, acting for MakeAndUpdate LLC.

Updated September 27, 2026: this version adds Microsoft Clarity, lists every detail stored with an inquiry (including your IP address and browser), names the Gmail inbox that receives inquiries, covers the client portal and Stripe payments, and adds a full list of cookies and similar storage.

MakeAndUpdate LLC is a web design, development and AI integration studio in West Chester, Pennsylvania. It is run by one person, Nicholas Cabel, and operates https://makeandupdate.com and the client portal at auth.makeandupdate.com. For anything in this policy, email nicholas@makeandupdate.com.

When you send an inquiry through the contact form, the free-audit form on /get-started/, a /promo/ page or the chat window, I receive:

• What you type: your name, email address and message, plus anything optional you fill in: company, phone number, your current website address, the services you are interested in, project type, platforms, budget, timeline and how you found me.
• What is recorded with it automatically: the date and time, your IP address, your browser’s user-agent string, the page you sent it from, which form you used, which of the site’s two announcement banners you were shown, and, if you arrived from a Google ad, the ad click ID (gclid, gbraid or wbraid) from the link.

Each inquiry is saved on my web host in a log file, a database and a CSV backup file (the CSV leaves out your IP address and browser). When a separate MySQL database is switched on, a copy goes there too. Older inquiries may also sit in a CSV backup from an earlier version of this site. Each inquiry is also emailed to two inboxes I read: a Gmail inbox (Google) and my domain inbox at makeandupdate.com. That email includes your IP address. You then get an automatic confirmation email that repeats your project type, the page, the time and your message.

Project ratings. This site used to have a form for rating a finished project. It no longer accepts ratings. Ratings sent through it before (the score, and a name, project and comment if given, with the page, IP address and browser user-agent string) were emailed to my domain inbox and are kept in a log file, a database and a CSV file on my web host.

Files and photos. Files you email me, files stored for your project on cloud.makeandupdate.com, and photos taken for your project with your permission.

Server logs. Like any website, my web host keeps standard access logs: IP address, browser, the page requested and the time. I look at them only to investigate errors or abuse.

A banner asks before any analytics, advertising or session-recording tool loads. Until you press Accept, none of them load, and the site works the same whichever you choose.

Set without asking (they keep the site working, or remember a choice you made):

• mau_consent_v1 (browser storage, until you clear it): remembers whether you accepted or declined.
• mau_ab_banner (cookie, 90 days): which of two announcement banners you see. It is set on your first visit, before you answer the banner, and the version you saw is recorded with any inquiry you send.
• mau_chat_closed (cookie, 180 days) and mau_chat_auto (browser storage): stop the chat window opening by itself once you have closed it.
• mau_chat_state (browser storage for this tab only): keeps your chat conversation, including the name, email and phone number you type, until you close the tab.
• mau_lang_choice (browser storage): remembers which language version of the site you are using (visiting a French or Spanish page counts as choosing it), or that you dismissed the offer of one.
• mau_offer_seen_v2 (browser storage): remembers when you saw the offer pop-up, so it does not keep coming back.
• mau_announce_<code> (browser storage): when an announcement bar is shown above the menu and you close it, remembers that, so it stays closed. The code is made from the announcement’s wording, so a new announcement shows again.
• On the client portal, a session cookie keeps you signed in. Signing in also sets mau_authed (cookie, 7 days, renewed each time you open your account page), which holds only the value 1. This website reads it for one thing: to show Dashboard instead of Sign in in the menu.

Only after you press Accept:

• Google Analytics 4 (Google LLC) sets _ga and _ga_<ID> cookies, which Google keeps for up to 2 years by default, to count visits and show which pages are used.
• Meta Pixel (Meta Platforms, Inc.) sets _fbp, and _fbc if you arrive from a Facebook or Instagram ad, to measure my ads and to show ads on Facebook and Instagram to people who visited this site.
• Microsoft Clarity (Microsoft Corporation) sets _clck and _clsk, and Microsoft sets its own cookies, such as MUID, on Microsoft domains. Clarity records how the page is used, including clicks, scrolling and mouse movement, to build heatmaps and session replays.

The ad landing pages (/get-started/ and /promo/) load Google Analytics only.

Changing your mind. Cookie settings, also in the site footer, brings the banner back. If you decline after accepting, the site deletes the analytics cookies it can reach, tells Clarity to erase its cookies, and reloads the page, and nothing loads after that. Cookies that Google, Meta or Microsoft set on their own domains can only be removed in your browser settings.

I use inquiry details to reply to you and follow up about a possible project, to send the confirmation email, and to see which pages, ads and banners bring inquiries in. IP address and browser details help me spot spam and abuse. Only I, and collaborators I authorize on an active project, have access.

This site’s code does not pass your name, email address, phone number or message to Google Analytics, Meta or Microsoft Clarity. Clarity hides what you type into form fields and what you write in the chat window.

I do not sell, rent or trade the details you send me.

If you have a client account at auth.makeandupdate.com, I store:

• your email address, your plan, billing status, amounts due, notes I keep about the account, and when it was created;
• sign-in codes, kept only in hashed form and valid for 10 minutes, with the IP address that asked for each one;
• the websites and domains you add, the update requests and replies you send, and your link page;
• a profile photo, if you add one. If you do not, the portal shows a default picture from Gravatar, so a hashed form of your email address is sent to Gravatar (Automattic Inc.);
• if you subscribe to the newsletter: your email address, IP address, browser user-agent string and the date. If you unsubscribe, your email address stays on an opt-out list so you are not emailed again.

Payments. When you pay an invoice online, the portal sends Stripe (Stripe, Inc.) your email address, your portal account number, the invoice lines and a reference number, and Stripe runs the checkout. Your card details go straight to Stripe; I never see or store them. When tax applies, Stripe also asks for your billing address.

Portal pages load their fonts from Google Fonts, so Google receives your IP address when you open them.

These companies handle some of this data for me:

• Namecheap: web hosting. The site, the inquiry and rating records, and the portal database live on its servers.
• Google: the Gmail inbox that receives every inquiry, Google Analytics 4 after you accept cookies, and Google Fonts on portal pages. Google’s privacy policy applies.
• Meta Platforms: the Meta Pixel, after you accept cookies. Meta’s privacy policy applies.
• Microsoft: Clarity session recording and heatmaps, after you accept cookies. Microsoft acts as a data controller for Clarity data and handles it under the Microsoft Privacy Statement.
• Stripe: online card payments for portal invoices. Stripe’s privacy policy applies.
• Gravatar (Automattic): default profile pictures in the portal.
• My email service: sends the confirmation email and portal sign-in codes.
• Embedded content: client case-study screenshots and logos remain the property of the respective brands.

Nothing deletes inquiries, ratings or portal data automatically. They stay until I delete them, or until you ask me to (see below). Emails stay in my inboxes until I delete them. Google, Meta and Microsoft keep what their tools collect under their own retention settings.

You can ask for a copy of what I hold about you, ask me to correct it, or ask me to delete it, by emailing nicholas@makeandupdate.com. I respond to verified requests within 30 days. If you sent a form by accident, reply to the confirmation email with “please delete” and I will remove the record.

What a deletion covers. I remove your inquiry from every copy on my web host (the log file, the database, the MySQL copy when it is on, and the CSV backups), and I delete the emails about it from both inboxes by hand. For a portal account, email me and I will close the account and delete its data; the portal cannot yet do this by itself. Data that Google Analytics, Meta or Microsoft Clarity already collected is held by those companies under their own policies.

If you are located in the EU/UK, you have rights under GDPR including access, rectification, erasure, and objection to processing. California residents have similar rights under the CCPA.

Interest-based advertising. Because this site uses the Meta (Facebook) Pixel, some U.S. state privacy laws (such as California’s CCPA/CPRA) treat the resulting data as “shared” for targeted advertising. You can turn the Pixel off on this site by choosing Decline under Cookie settings. You can also opt out through your Facebook ad preferences and the industry tools at optout.aboutads.info and youradchoices.com, or email me to opt out directly.

This site is for business inquiries and is not directed to children under 13. I do not knowingly collect personal information from children under 13, and I do not ask anyone’s age. If you think a child has sent me information, email me and I will delete it.

If this policy changes, I will update the “Last updated” date above and post the new version at this address. Material changes will be noted at the top of the policy for at least 30 days.

Questions about privacy: MakeAndUpdate LLC, West Chester, Pennsylvania, nicholas@makeandupdate.com.