Privacy policy

This policy explains what information Xiobo Creative, LLC (“Xiobo”, “we”, “us”) collects when you visit www.xiobocreative.com or contact us, how we use it, and the choices you have.

The short version: we count visits with our own simple counter, without cookies and without third-party analytics, and we use what you send us only to reply to you and, if we work together, to run your project.

What we collect

When you browse the site

This website is a set of static pages hosted by Hostinger. Like most web servers, Hostinger’s servers keep standard access logs: your IP address, browser and device type, the page you asked for, the page that sent you here, and the date and time. These logs are used to deliver the site, keep it secure and fix errors. They are kept for a limited time under our host’s standard settings.

Visit counts

To see which pages are useful and how people find us, our own server counts visits. Nothing goes to Google Analytics or any other outside service. For each page view it records:

• the page, how long it was on screen and how far down it was read,
• the website that sent you here (just its name, like google.com) and any campaign tag in the link,
• your device type (phone, tablet or computer), browser and operating system, your browser’s language and time zone, and your screen width,
• how fast the page loaded for you,
• which buttons and outside links were clicked, and whether a page wasn’t found.
• whether the chat was opened, a first message was sent or an email was left (not what was written).

It doesn’t use cookies and doesn’t keep your IP address. To count a visit as one person for the day, the server combines your IP address and browser into a scrambled code that changes every day and can’t be turned back into either. Your browser keeps one small note, the time of your last page view, so we can tell a returning visit from a new one. It contains no ID and is never sent to us.

If your browser sends Global Privacy Control or Do Not Track, nothing is counted. Search engine and other bots aren’t counted either. The counts are stored on our own server and only we can see them.

We don’t use advertising pixels or tracking cookies, and we don’t build profiles of visitors. Our fonts are served from our own server, so loading a page doesn’t send your data to a font service.

When you use the chat

The chat on our pages goes to Ben or Ingrid, not to a bot or an AI. When you write in it, our own server keeps your messages, the page you wrote from and your device type (phone, tablet or computer), so we can answer you. If you give your name and email address, we keep them too, add the conversation to our list of leads, and may email you our reply if you leave the page before it arrives. Your browser keeps a code for your conversation, so the chat stays open when you change pages. You can remove it by clearing this site’s data in your browser. To have a conversation deleted, email us.

When you use the contact form

The contact form asks for your name, email address and company, plus details about your project: the type of work, your timeline and your message. When you send it, our own server emails it to our studio inbox, which is also hosted by Hostinger. We don’t pass it to a third-party form service or a marketing tool.

When you use the free website check

If you check a website at /website-check, our server opens that site’s home page the way a visitor would, and asks Google PageSpeed Insights how fast it loads on a phone. Google receives only the website address. We keep the report (the address, what we found and a screenshot of the home page) so its link keeps working; within 24 hours the same site gets the same report instead of a new check. Ask us any time and we’ll delete it. We count how many checks come from your connection to stop abuse, without storing your IP address.

If you ask for the full report by email, we keep your email address and the business name you type, email you the report and may write once to ask if you have questions. We don’t add you to a mailing list or share your details.

When you join the referral program

If you sign up at /referrals, we keep your name, email address and the phone number or email you use for Zelle, so we can send you your link, email you about the businesses you refer and pay your rewards. When a business reaches out through your link, we tell you its name and where it is in the process. We don’t share your details with the businesses you refer.

If you open a referral link, your browser keeps the code for 30 days so the form can tell us who referred you. It’s stored only in your browser and contains nothing but the code.

When you use your client page

If we build your website, you get a private page at /client to follow your project. To sign in, you enter your email address and we email you a link that works once and expires in 15 minutes; there’s no password. If we send you a proposal, its email has a link that opens your page until the proposal expires. We keep:

• the email addresses that can sign in to your project, your name and your business’s name;
• your project’s details: its steps and dates, the link to your preview, the updates we post, your payments and your documents;
• when you open, accept and sign your proposal. When you sign the agreement we keep the name you type, the time, your IP address, your browser’s name and a fingerprint (a hash) of the exact text you signed, so both of us can prove what was agreed;
• your payments: Stripe handles your card or bank details on its own secure form, and we never see or store them. Stripe tells us the amount, whether it went through, the kind of payment (for example “Visa ending in 4242”) and the link to your receipt;
• the files and text you send us for your site (your logo, photos, menu, hours), stored on our server outside the public website, only for building and running your site;
• the changes you send us and when you approve your design;
• a sign-in session for 30 days, in a cookie your browser keeps only for our site. It holds a random code, nothing about you, and signing out deletes it.

When we send you an invoice

If you’re a design client, we keep your name, your company, the email addresses invoices go to and the work we do for you (job numbers, descriptions, dates, prices). Each invoice comes by email with a private link to a page where you can see it and pay it; anyone with that link can open that one invoice, so keep the email to yourself. We note when the page is first opened. Your page at /client/account (same email sign-in as above) shows the work we’re on, your invoices and your payments. Stripe creates the invoice and its PDF and handles your payment details on its own secure form; we never see or store them.

Your client page isn’t counted by our visit counter. If someone asks for a sign-in link with an address that isn’t one of our clients’, no email is sent.

When you book a call

If you book a call at /book, we keep your name, your email address, your business name and website if you give them, your notes and the time you picked. We add the call to the calendar of Ben or Ingrid in Apple iCloud, and we email you a confirmation with a calendar invite, a reminder one hour before the call, and a private link to change or cancel it. Anyone with that link can see and change that one call, so keep the email to yourself. The call itself is a Google Meet video call.

If you write to us through the website about a new website and we do not hear back, we may send you up to two short follow-up emails, one week and one month later. They stop when you reply, when you book a call, or when you write “stop”.

When you email us

If you write to hello@xiobocreative.com, we receive your email address, your name if you include it, and whatever you choose to send, including attachments.

How we use it

• To reply to you and talk about your project.
• To prepare a proposal and, if we work together, to run the project.
• To keep the site working, secure and free of spam, and to see which pages are useful.
• To meet our legal obligations.

We don’t add you to a mailing list, and we don’t sell or share your personal information with advertisers or data brokers.

Who else sees it

• Hostinger, our hosting and email provider, stores the website, its server logs and our mailbox.
• Stripe, our payment processor, when you pay us on your client page or pay an invoice. Stripe receives your payment details and your email address and handles them under its privacy policy. Buy-now-pay-later options like Klarna, if you choose them, also receive what they need to approve the payment.
• Google, when you use the website check (it receives the address of the site being checked, to measure its speed on a phone) and when you join a call on Google Meet.
• Apple, when you book a call: the call, with your name, email, business and notes, goes into Ben’s or Ingrid’s iCloud calendar.
• Tools for client projects. If we work together, we may use everyday tools such as file sharing or video calls to run the project. We’ll tell you which ones.
• When the law requires it. We may disclose information to comply with the law, or to protect our rights or the rights of others.

How long we keep it

Your client page stays available while we work together and for as long as we host your site, so you can look back at your project. Ask us any time and we’ll delete it. We keep contact form messages and emails only as long as we need them for our conversation and, if we work together, for the project and the business records the law requires us to keep. After that, we delete them.

Server logs are kept for a limited period by our host and then deleted automatically. Visit counts don’t identify anyone; we keep them to compare how the site does over time.

Your choices and rights

You can ask us to:

• tell you what personal information we have about you,
• correct it,
• delete it.

To make a request, email hello@xiobocreative.com. We may need to confirm it’s you, for example by replying to the address you used to contact us, and we’ll respond within 30 days.

Depending on where you live, for example in California, the EU or the UK, local law may give you additional rights, and we’ll honor them. If you’re in the EU or UK, we handle contact messages so we can reply to you and take the steps you ask for before any agreement, and we keep server logs and visit counts based on our legitimate interest in running a secure, useful website. You can also complain to your local data protection authority.

Links to other sites

This site links to other websites, including the sites for our own apps, getimageshrink.com and hiitduo.com, and our LinkedIn and Instagram pages. Each has its own privacy policy, which applies when you visit it. Our apps’ privacy practices are explained on their own sites.

Children

This site is meant for businesses and isn’t directed to children under 13. We don’t knowingly collect information from them.

Security

We serve the site over HTTPS and limit access to our inbox to the people who need it. No way of sending or storing data online is completely secure, so we can’t guarantee absolute security.

Changes to this policy

If we change how we handle information, we’ll update this page and the date at the top before the change takes effect.

Contact

Questions about this policy or your information: hello@xiobocreative.com, Xiobo Creative, LLC.