Privacy Policy

Who We Are

Merkaba Web Portals ("Company," "we," "us," or "our") operates the website located at designmywebsitenow.com and any associated landing pages, subpages, and digital properties (collectively, the "Site"). We are a web design and digital marketing studio providing premium website design, development, and online marketing services to clients.

This Privacy Policy explains how we collect, use, disclose, and protect information about you when you visit our Site, submit a form, respond to an advertisement, or otherwise interact with us — including when we send you SMS text messages.

By using the Site or providing your information, you agree to the practices described in this Privacy Policy. If you do not agree, please do not use the Site or provide your information.

Information We Collect

Information You Provide Directly

Information Collected Automatically

How We Collect Information

• Contact and inquiry forms — when you fill out a form on our Site requesting information or a quote
• Facebook/Instagram advertisements — when you click a lead form ad or visit our Site via a Meta ad, Meta may share lead data and behavioral signals with us pursuant to Meta's Data Policy
• SMS opt-in forms — when you provide your phone number and expressly consent to receive text messages
• Email correspondence — when you email us directly
• Cookies and tracking pixels — automatically as you browse the Site (see Section 8)
• Third-party referrals — when a partner or client refers you and shares your contact information with your knowledge
• Payment processor — Stripe may share limited transaction metadata with us to confirm payment status

How We Use Your Information

We use personal information for the following purposes, based on the legal grounds indicated:

• Provide and fulfill services — design, develop, and deliver websites and marketing materials you have engaged us for (contract performance)
• Respond to inquiries — communicate with you about your project, proposal, or questions (legitimate interest / contract)
• Send SMS text messages — only to contacts who have expressly opted in; for appointment reminders, project updates, promotional offers, and service information (consent)
• Send marketing emails — only to contacts who have not opted out, consistent with CAN-SPAM (legitimate interest / consent)
• Run and optimize advertising campaigns — measure ad performance, build lookalike audiences, retarget site visitors via Meta and other advertising platforms (legitimate interest / consent where required)
• Process payments — facilitate secure transactions through Stripe (contract performance)
• Comply with legal obligations — maintain records, respond to lawful requests, and enforce our Terms and Conditions (legal obligation)
• Improve our services — analyze usage patterns to improve the Site and our offerings (legitimate interest)
• Fraud prevention and security — detect and prevent unauthorized access or abuse (legitimate interest)

SMS & Text Message Communications

SMS Program Details

• Program name: Merkaba Web Portals SMS Notifications
• Sender: Merkaba Web Portals (designmywebsitenow.com)
• Supported carriers: AT&T, T-Mobile, Verizon, Sprint, Boost Mobile, U.S. Cellular, MetroPCS, and most major U.S. carriers. Carriers are not liable for delayed or undelivered messages.
• Message types: Transactional (project/service updates), promotional (offers and new services), and informational (reminders)
• How we obtain consent: Via an explicit opt-in checkbox on contact forms and landing pages, which requires affirmative action (unchecked by default). We maintain timestamped opt-in records including the form, IP address, and consent language presented
• Opt-out method: Reply STOP (any time, confirmed via one final text). Opt-out is processed within 24 hours
• Re-opt-in: After opting out, you may re-enroll by texting START or by submitting a new consent form
• Data use: Phone numbers collected for SMS are used only for the stated messaging program. They are not sold or shared for third-party marketing

10DLC & Toll-Free Number Compliance

Our SMS campaigns are sent through registered 10-digit long code (10DLC) numbers or toll-free numbers registered with The Campaign Registry (TCR) and major U.S. wireless carriers. Our registration includes the use case type, message content samples, and opt-in method descriptions required by CTIA Messaging Principles and Practices. All campaigns comply with carrier filtering policies and CTIA Short Code Monitoring Handbook standards.

Prohibited content (as defined by CTIA) — including spam, phishing, malware, illegal content, and content involving controlled substances — is never sent via our messaging programs.

Advertising & Meta Pixel

Meta Pixel (Facebook Pixel)

Our Site uses the Meta Pixel (also known as the Facebook Pixel), a tracking code provided by Meta Platforms, Inc. The Meta Pixel collects information about your actions on our Site (such as pages visited, forms submitted, and buttons clicked) and sends that data to Meta to help us:

• Measure the effectiveness of our Facebook and Instagram advertising campaigns
• Deliver targeted ads to people who have visited our Site or taken actions on it (retargeting)
• Build "Custom Audiences" and "Lookalike Audiences" for ad targeting
• Improve ad relevance and reduce ad costs

Data collected through the Meta Pixel may include your IP address, browser information, and behavioral signals. This data is transmitted to Meta and is subject to Meta's Privacy Policy. Meta may use this data across its own platforms consistent with Meta's policies.

You can opt out of Meta's use of your data for advertising purposes by visiting Facebook Ad Preferences or using the Digital Advertising Alliance's opt-out tool at optout.aboutads.info.

Lead Generation Ads

If you submit a lead form through a Meta advertisement (Facebook or Instagram Lead Ad), the information you provide — including your name, email, and phone number — is shared with us by Meta pursuant to Meta's Lead Ads Terms. We use that information to contact you about our services as described in this Privacy Policy. If you provided SMS consent through the ad form, that consent is recorded and you may receive text messages from us.

Other Advertising Platforms

We may also use Google Ads, Google Analytics, and other advertising platforms. Each platform's data practices are governed by its own privacy policy in addition to this one.

Sharing Your Information

We do not sell, rent, or trade your personal information. We may share your information with the following categories of recipients only as necessary:

Cookies & Tracking Technologies

We use cookies, web beacons, pixel tags, and similar technologies to operate the Site and support advertising. Cookies are small text files stored in your browser.

You may control cookies through your browser settings. Note that disabling cookies may affect Site functionality. Your browser manufacturer's website has instructions for managing cookies:

• Google Chrome
• Mozilla Firefox
• Apple Safari
• Microsoft Edge

Data Retention

We retain personal information for as long as necessary to fulfill the purposes described in this policy, unless a longer retention period is required by law:

• Client project records: retained for 7 years after project completion for tax and legal compliance
• Contact form submissions: retained for 3 years unless you request deletion
• SMS opt-in records: retained for 4 years from the date of consent (TCPA statute of limitations)
• Email marketing records: retained while your subscription is active, plus 3 years
• Payment records: retained for 7 years per IRS requirements
• Analytics data: retained in aggregate form for up to 26 months (Google Analytics default)

When retention periods expire, we securely delete or anonymize personal information.

Security

We implement commercially reasonable administrative, technical, and physical safeguards to protect your personal information from unauthorized access, disclosure, alteration, or destruction. These include:

• TLS/SSL encryption for all data transmitted to and from the Site
• Secure, environment-variable storage for API keys and credentials (never in source code)
• Access controls limiting who can access personal data
• PCI DSS-compliant payment processing via Stripe (we never store raw payment card data)
• HTTPS enforced site-wide via Vercel hosting infrastructure

No method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security. In the event of a data breach that affects your rights or freedoms, we will notify affected individuals as required by applicable law.

California Privacy Rights (CCPA / CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

• Right to Know: You may request that we disclose the categories and specific pieces of personal information we have collected about you, the sources, the business purposes for collection, and the categories of third parties with whom we share it.
• Right to Delete: You may request that we delete personal information we have collected about you, subject to certain exceptions.
• Right to Correct: You may request that we correct inaccurate personal information we maintain about you.
• Right to Opt Out of Sale or Sharing: We do not sell personal information. We do share limited data with advertising partners (Meta, Google) as described in this policy. You may opt out of such sharing by contacting us.
• Right to Limit Use of Sensitive Personal Information: We do not use sensitive personal information for purposes beyond those permitted by CPRA.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of these rights.

How to Submit a California Privacy Request

To exercise your CCPA/CPRA rights, contact us at:

• Email: admin@designmywebsitenow.com
• Subject line: "California Privacy Request"

We will respond to verifiable consumer requests within 45 days (extendable by an additional 45 days with notice). You may designate an authorized agent to submit requests on your behalf, in which case we may require verification of the agent's authority.

Categories of Personal Information Collected (12-Month Look-Back)

• Identifiers (name, email, phone, IP address) — collected
• Commercial information (service inquiries, project scope) — collected
• Internet or other electronic network activity (browsing behavior on our Site) — collected via cookies and Meta Pixel
• Geolocation data (general location from IP) — collected
• Inferences drawn from personal information (ad audience segments) — created by Meta based on Pixel data

EU & UK Privacy Rights (GDPR / UK GDPR)

If you are located in the European Economic Area (EEA) or the United Kingdom, the General Data Protection Regulation (GDPR) or UK GDPR applies to our processing of your personal data.

Legal Bases for Processing

• Contract performance — processing necessary to deliver services you have engaged us for
• Legitimate interests — analytics, fraud prevention, and direct marketing where our interests are not overridden by your rights
• Consent — SMS communications, advertising cookies, and marketing emails where we rely on your opt-in
• Legal obligation — compliance with applicable laws and court orders

Your GDPR Rights

• Access: Request a copy of personal data we hold about you
• Rectification: Request correction of inaccurate data
• Erasure ("Right to be Forgotten"): Request deletion of your data (subject to legal retention requirements)
• Restriction: Request that we limit processing of your data
• Portability: Receive your data in a structured, machine-readable format
• Object: Object to processing based on legitimate interests, including profiling for direct marketing
• Withdraw Consent: Where processing is based on consent, withdraw it at any time without affecting prior processing

International Transfers

Our services are based in the United States. If you are located outside the U.S., your information will be transferred to and processed in the U.S. and other countries. We rely on appropriate safeguards — including Standard Contractual Clauses (SCCs) with sub-processors — for international data transfers from the EEA and UK.

How to Exercise GDPR Rights

Contact us at admin@designmywebsitenow.com with subject line "GDPR Request." We will respond within 30 days. You also have the right to lodge a complaint with your local supervisory authority.

Children's Privacy (COPPA)

Our Site and services are directed to adults and are not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected information from a child under 13, please contact us immediately at admin@designmywebsitenow.com and we will promptly delete such information.

Users between 13 and 18 years of age should review this policy with a parent or guardian before providing any personal information.

Third-Party Links

Our Site may contain links to websites operated by third parties (including client portfolio sites). This Privacy Policy does not apply to third-party websites. We encourage you to review the privacy policies of any third-party site you visit. We are not responsible for the content, data practices, or privacy policies of third-party sites.

Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last Updated" date at the top of this page. For significant changes, we may provide additional notice (such as an email notification or a prominent notice on our Site). Your continued use of the Site after any changes constitutes your acceptance of the updated policy.

We encourage you to review this page periodically. Prior versions are available upon request.

Contact Us

If you have questions about this Privacy Policy, want to exercise your privacy rights, or need to report a concern: