Who we are

This page covers risinglabs.co, our contact form, the concept homepages we design for businesses, and the emails we send to businesses.

The data controller for everything on this page is Rising Labs. For anything about your data, email [email protected].

The short version

  • Our analytics don’t use cookies and don’t save your IP address or your full browser string.
  • We set one small session cookie to remember which version of our buttons you saw. It holds no ID and nothing about you, and your browser deletes it when you close it.
  • If you fill in our form, we keep what you typed so we can reply and design your homepage.
  • If you run a business, we may have emailed you at your public business address. Reply “no” and we will never email you again.
  • We don’t sell personal data, and we don’t use advertising or social media trackers.

What our analytics script sends

Public pages load a small script from our own site, /js/script.js. It sends events only to our own server at risinglabs.co/api/event. It sets no cookies for visitors and does not write to localStorage or sessionStorage. (The only cookie it can set is rl_internal, below, when our own team opens a special link.)

On each page view it sends the page address, the page that linked you here, your window width, the page language, whether the page was a “not found” page, and a random id your browser makes for that one page view and does not keep. When you leave the page, it sends how many seconds you spent on it and how far you scrolled, as a percentage.

It also records clicks on our main buttons, phone and email links (without the number or address), links to other websites and file downloads (both without the link’s query string).

The script does nothing at all if your browser has Do Not Track switched on, sends Global Privacy Control, or reports itself as an automated browser. Our server makes the same check, and also ignores known bots, browsers that look automated, and traffic from data centres and hosting networks (for example, email security scanners that open links).

A second small script, /assets/js/rl.js, counts how often each version of our buttons is seen and clicked. It follows the same rules and sends only to risinglabs.co/api/e.

What we store from a visit

Like any website, every request reaches our server with your IP address and your browser’s user-agent string. We use them only to make a short visitor id and, for the user-agent, to work out the labels below. To make the id, we combine them with a secret value that changes every day, run that through a one-way hash (HMAC-SHA-256) and keep only the first 16 characters. Your IP address and your full user-agent are never saved. Because the secret changes daily, the same person gets a different id the next day, so nobody can be followed from one day to the next.

For each page view we store:

  • the time and date, the page path (without its query string) and that daily visitor id;
  • where you came from, as a source name such as “Google” or “Facebook”, plus any utm_source, utm_medium and utm_campaign tags in the link;
  • your country, as reported by Cloudflare for the request (we never look up your IP ourselves);
  • labels worked out from your user-agent: device type (mobile, tablet or desktop), browser name and operating system, for example “Chrome / Android / mobile”;
  • a screen-size group (Mobile, Tablet, Laptop or Desktop), your browser language, time on page and scroll depth.

For button and link clicks we store the event name, the page, the time, the daily visitor id, and which button or outside site it was (without its query string). Button tests are also counted as plain daily totals per version, page and device type, with no visitor id.

We use this to see which pages and buttons work and to fix what doesn’t. We rely on legitimate interest for this, and we have chosen the cookie-free, IP-free set-up to keep the impact on you as small as we can.

Cookies

Our analytics use no cookies. The site itself can set three small cookies:

  • rl_ab: remembers which version of our buttons and headings you were shown, so the page doesn’t change each time you load it. It looks like 1.hero-c.nav-a.pricing-b. It holds no id and nothing about you. It is a session cookie, so your browser deletes it when you close it. It is not set if your browser sends Do Not Track or Global Privacy Control.
  • rl_country: set only if you choose a country in the footer switcher, so we show prices in your currency. It lasts one year.
  • rl_internal: set only on our own team’s browsers (by a special link or when we sign in to our internal dashboard), to keep our own visits out of the numbers. It lasts up to 400 days.

You can delete these cookies in your browser settings at any time. The site works the same without them.

If you use our contact form

The form asks for your name, business name, town, email, phone number (optional) and a message. With it we store the time, the page you sent it from, your device type, the versions of our buttons you were shown, and the same kind of daily visitor id described above. We use that id only to stop spam (no more than three messages per visitor in ten minutes).

Your message is saved in our database on Cloudflare and we read it in our private dashboard. We use it to reply to you and to design the homepage you asked for. We rely on the fact that you asked us to do this.

We delete form messages automatically 24 months after your last message to us, unless you become a client. We delete them sooner if you ask.

Concept homepages and preview links

We sometimes design a free concept homepage for a business before we get in touch. These are built only from details the business already publishes, such as its name, town, phone number, address and services. They live at private, unlisted links and are hidden from search engines.

When a preview link we sent (risinglabs.co/m/…) is opened, we record which concept it was, the time, device type, country, how it was reached, and the daily visitor id. While the concept page is open we also record time on page and scroll depth. That tells us whether the design was seen, so we know whether to follow up.

We keep these view records for 12 months, then delete them automatically.

If we emailed or called you

We email small local businesses that look like they could use a better website, mostly in New Zealand and Australia. We only write to business email addresses that the business publishes itself, for example on its website, Facebook page or directory listing, and only about its website.

We send these emails from [email protected] through Zoho Mail. To do this we keep the business name, the public business email, country, region and town, the type of business, links to its public website or social pages, a short note on why we got in touch, when we emailed, and whether you replied and how.

We rely on legitimate interest: offering a relevant service to a business at the address it has chosen to publish. Every email tells you how to opt out. Reply “no” and we will never email you again.

To make sure of that, we keep a do-not-contact list for as long as we send cold email. It holds only the email address and the date you opted out, nothing else.

Other outreach records are deleted 24 months after our last email to you.

Now and then we may also phone a business on its public number about our services. If you ask us to stop, we will.

Who processes the data

These companies process data for us when we use their services:

  • Cloudflare hosts risinglabs.co. It handles every request, including your IP address, to serve the page, and tells us the country a request came from. Our analytics, button-test totals, form messages and concept-view records are stored in a Cloudflare D1 database.
  • Zoho Mail is where we send and keep our email, including replies to our outreach.

These are international companies, so your data may be processed outside your country, including in the United States, under their own data-protection terms. We don’t sell personal data, and no advertising or social media company receives data from this site.

How long we keep things

  • Visit and click records: about 26 months (800 days). After that they are deleted and only daily totals remain: visitors, page views, visits, bounces, time on site and conversions, with no visitor ids. The clean-up runs when we open our dashboard, so the exact day can vary a little.
  • Button-test totals: plain daily counts with nothing personal in them, kept while they are useful.
  • Form messages: 24 months after your last message to us, unless you become a client.
  • Concept view records: 12 months.
  • Outreach records: 24 months after our last email to you.
  • Do-not-contact list: for as long as we send cold email. Email address and opt-out date only.

These deletions run automatically: the database clean-up when we open our dashboard, and the outreach clean-up whenever we update our outreach records, so the exact day can vary a little.

We will delete anything sooner if you ask, except the do-not-contact entry that stops us emailing you.

Your rights

You can ask us to show you the data we hold about you, correct it, delete it, or stop using it. You can object to our emails at any time, and we will stop. Because we never store your IP address, we usually can’t find your visits in our analytics, but we can find anything linked to your name, business or email.

If you are unhappy with how we handle your data, you can complain to your local regulator: the Privacy Commissioner in New Zealand, the OAIC in Australia, or your data protection authority in the UK or EU.

How to reach us

For any privacy question or request, email [email protected]. We will reply within a month, and usually much sooner.

Changes

We will update this page when our analytics, the form or the way we contact businesses changes, and change the date at the top.