Privacy Policy

Last updated: 4 October 2026

This Privacy Policy explains how CREATED BY HYDRO LLC ("hydro", "we", "us", "our") collects and uses personal data when you visit hydro.website, get in touch with us, use our client portal at portal.hydro.website, or work with us. It also explains your rights and how to use them.

1. Who we are

We're CREATED BY HYDRO LLC, a limited liability company registered in the State of Wyoming, United States, trading as hydro. For the personal data described in this policy, we're the controller, which means we decide how and why it's used.

Postal address: 30 North Gould Street, Ste R, Sheridan, WY 82801, United States

Email: hello@hydro.website

When we build, host or run a website, platform or automation for a client, any personal data in it belongs to that client. For that data, we act as the client's processor and follow its instructions, and the client's own privacy notice applies.

2. The personal data we collect

Information you give us

Enquiries. When you fill in a form on our site, we collect what you enter: your name, business email address and phone number, your message, and, depending on the form, your website address, your current website platform, or what you need first. If you arrived from one of our Google ads and clicked "Accept all" on our cookie banner, the form also sends us the ad's click ID.
AEO Assessment. When you request an AEO Assessment, we collect your business email address and the website address you give us.
Conversations. When you email us, message us, or speak to us on a call, we collect what you share. We record and transcribe most calls with clients and prospects using Fathom, which also produces an AI summary. If you'd rather a call wasn't recorded, tell us and we won't record it.
Booking a call. If you book a call through our Calendly link, we collect your name, email address and anything you add to the booking.
Working together. When you become a client, we collect the names, job titles, email addresses and phone numbers of the people we work with, billing details, and anything you share in briefs, files, comments and approvals, including in our client portal, Slack, Trello and Figma. When you sign documents with us, our e-signature provider collects your name, email address and signature.
Payments. When you pay us by card, our payment provider, Stripe, collects your payment details, and we don't see or store your full card number. When you pay by bank transfer, we receive the payer's name and account details.
Reviews and testimonials. If you give us a review or testimonial, we collect your words and, with your permission, your name, job title, company and photo.

Information we collect automatically

Website use. If you click "Accept all" on our cookie banner, our analytics and marketing services collect your IP address, device and browser details, approximate location, the pages you visit, how you interact with them (including clicks, scrolling and, for Hotjar, recordings of your visit), and how you arrived on our site.
Google's cookieless signals. Before you choose, or if you reject cookies, Google Analytics and Google Ads send Google only limited signals without cookies, such as your IP address, the page you're on, the time and your browser type.
Security. Our website host and Cloudflare Turnstile collect technical details, such as your IP address and browser signals, to protect the site and our forms from abuse.
Emails. Our marketing emails tell us whether they were opened and which links were clicked.

Our Cookie Policy lists the cookies and similar technologies we use, and how to control them.

Information we get from others

Visitor identification. If you click "Accept all" on our cookie banner, Apollo.io, RB2B and Leadsy (Instantly's website visitor tag) may tell us which company you work for and, in some cases, who you are (such as your name, job title, work email and LinkedIn profile), based on your visit.
Business contact data. We get business contact details, such as names, job titles, work email addresses and company information, from B2B data providers (Apollo.io and Instantly) and from public sources such as company websites and LinkedIn.
Referrals. Clients and partners sometimes introduce us to people they think we can help.

You don't have to give us personal data, but without what a form or contract asks for, we may not be able to reply to you or work with you.

3. How we use your personal data, and our lawful bases

UK and EU data protection law requires us to have a lawful basis for each way we use personal data. Ours are:

Reply to your enquiry, prepare proposals and quotes, and arrange calls: taking steps at your request before a contract, or our legitimate interests in responding to business enquiries.
Run the AEO Assessment you ask for (fetching the public pages of the website you give us, grading them with AI and emailing you the report): taking steps at your request, and our legitimate interests in following up with business contacts who've asked for a report.
Deliver our services, manage our work with you, and run our client portal: performing our contract with your business, or our legitimate interests in working with the people at our clients' businesses.
Keep a record of our emails, calls and meetings with clients and prospects in our CRM: our legitimate interests in managing our business relationships.
Record and transcribe calls, so we have accurate notes and actions: our legitimate interests in keeping accurate records of what's agreed.
Invoice, take payments, keep accounts and meet tax obligations: performing our contract, and our legitimate interests in keeping accurate financial records and meeting our tax and legal obligations.
Add you to our mailing list and send you news about our work and services: our legitimate interests in marketing to business contacts, or your consent where the law requires it.
Contact businesses we think we can help, by email or LinkedIn, using business contact details: our legitimate interests in growing our business.
Analytics, to understand how our website is used and improve it: your consent.
Advertising, to measure our Google Ads and show our ads to people who've visited our site: your consent.
Count visits and ad results in aggregate from Google's cookieless signals, before you choose or if you reject cookies: our legitimate interests in measuring how our site and ads perform without cookies.
Share details of some website enquiries with our advertising agency, so it can see which campaigns bring enquiries: our legitimate interests in knowing which of our campaigns work.
Visitor identification, to find out which businesses and people visit our site so we can follow up: your consent.
Keep our website, forms and systems secure, and prevent spam and fraud: our legitimate interests in protecting our business and our users.
Publish reviews, testimonials and case studies: your consent for your name, photo and words, and our legitimate interests in showing our work.
Deal with legal claims, follow the law, and sell or reorganise our business: our legitimate interests, or legal obligation.

Where we rely on legitimate interests, we've balanced our interests against your rights, and you can object at any time (see section 9). Where we rely on consent, you can withdraw it at any time, without affecting what we did before.

4. Automated processing and AI

AEO Assessment. When you ask for an AEO Assessment, our system fetches the public pages of the website you give us, searches the web for public information about the brand, and uses Anthropic's Claude AI to grade the site on content, technical set-up, measurement and authority. It then emails you a report and a score. The score is about the website, not about you, and it isn't used to make any decision about you.

AI in our work. We use AI services, including Anthropic's Claude and Fyxer, to help us research, draft, summarise and organise our work. This can include the content of emails, call notes, CRM records and briefs, and our client portal uses AI to format project updates and tidy incoming emails. Our team reviews AI output before we rely on it. Automated messages, such as AEO Assessment reports, go out without a manual check.

Visitor identification. If you click "Accept all" on our cookie banner, the visitor identification services described above profile your visit to match it to a business or a person, and we may then email you about our services. You can object to this, or withdraw your consent, at any time.

We don't make decisions that have legal or similarly significant effects on you based solely on automated processing.

5. Who we share your personal data with

We don't sell your personal data. We share it only with the people and companies who help us run our business. Most of them act only on our instructions. Some, such as Google, Apollo.io and RB2B, also use the data for their own purposes, under their own privacy policies. They are:

Our team and subcontractors, who work with us on client projects and on our own sales and operations.
Website and hosting: Webflow (our website, forms and Webflow Analyze) and Cloudflare (website security and Turnstile spam protection).
Client portal and CRM: Supabase (our database, hosted in London) and Vercel (hosting).
Workspace and collaboration: Google Workspace (email, documents and calendar), Microsoft 365 (outreach email), Slack, Trello, Figma, Loom and Obsidian (our internal notes).
Email: Resend (emails our systems send, such as portal notifications, quotes, invoices and AEO Assessment reports), Mailchimp (our newsletters), Instantly (outreach email) and Tabular (email campaigns).
Sales and visitor identification: Apollo.io, Instantly (including its Leadsy visitor tag) and RB2B.
Analytics and advertising: Google (Analytics, Ads and Tag Manager), Hotjar and Wistia (our video player), and our advertising agency, which manages our Google Ads and receives details of some website enquiries so it can measure our campaigns. If you clicked "Accept all" on our cookie banner after arriving from one of our Google ads and then book a call through Calendly, we send Google Ads the ad's click ID and a hashed (scrambled) copy of your email address, so we can measure which ads lead to calls.
Calls and scheduling: Fathom (call recording, transcripts and summaries) and Calendly.
Automation: Zapier and Pipedream, which connect our systems, for example to send new contacts to Mailchimp and booked calls to Google Ads.
AI: Anthropic and Fyxer.
Payments and banking: Stripe, Mercury and Wise.
Documents: Dropbox Sign (e-signatures).
Professional advisers, such as accountants and lawyers.
Authorities, where the law requires us to share personal data, or to protect our rights.
A buyer or successor, if we sell or reorganise all or part of our business.

6. International transfers

We're a US company, and our team and service providers work in several countries, including the United States, the United Kingdom, Paraguay, Turkey, the Philippines, India and Australia. So your personal data will be transferred to, and stored in, countries outside the UK and the European Economic Area, some of which have less strict data protection laws. Our client portal and CRM database is hosted in London.

When we transfer personal data from the UK or the EEA, we rely on one of these safeguards:

adequacy regulations or decisions, including the UK Extension to the EU-US Data Privacy Framework where a US provider is certified;
standard contractual clauses approved by the UK or the European Commission (the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses with the UK Addendum); or
for occasional transfers where neither applies, the transfer being necessary to perform a contract with you or to take steps you've asked for.

Email us if you'd like more information about these safeguards, or a copy of them.

7. How long we keep your personal data

We keep personal data for the periods below, each set by the reason next to it. When a period ends, we delete the data or anonymise it.

Client records (contracts, proposals, briefs, files, messages, call recordings and portal accounts): kept for as long as we work together, then 10 years, because our T&Cs are governed by Wyoming law, which allows 10 years to bring a claim under a written contract.
Invoices, payments and accounting records: kept 7 years from the end of the tax year they relate to, because that's the longest period US tax rules generally ask businesses to keep records for.
Enquiries, AEO Assessment requests, prospects, business contact data, visitor identification data, and calls with people who don't become clients: kept 3 years from your last contact with us, such as a reply, a click or an enquiry, because that's the period the French data protection regulator (CNIL) sets for prospect data, and it covers a typical business sales cycle.
Mailing list: kept until you unsubscribe, because we only email you while you want to hear from us.
Website analytics: kept up to 14 months in Google Analytics, 365 days in Hotjar, and Webflow's own period for Webflow Analyze, because that's the longest period each service allows.
Unsubscribe and objection records: kept for as long as we need them, because that's how we make sure we don't contact you again after you've asked us not to.

8. How we protect your personal data

We use reputable providers, limit access to the people who need it, and take appropriate technical and organisational measures to keep your personal data secure. No system is completely secure, so if we ever have a breach that's likely to put your rights at risk, we'll tell you and the regulator where the law requires.

9. Your rights

Your right to object. You can object at any time to direct marketing, and we'll stop. You can also object at any time where we rely on legitimate interests, including profiling.

If UK or EU data protection law applies to you, you also have the right to:

access the personal data we hold about you and get a copy;
correct personal data that's wrong or incomplete;
delete your personal data;
restrict how we use it;
move personal data you gave us to another organisation (data portability);
withdraw your consent at any time, where we rely on consent; and
not be subject to decisions based solely on automated processing that have legal or similarly significant effects on you.

To use any of these rights, email us at hello@hydro.website. It's free, and we'll reply within one month (or tell you within that month if we need longer, as the law allows). We may ask you to confirm your identity first.

You can unsubscribe from our emails at any time using the link in each one, and change your cookie choices at any time using Cookie settings at the bottom of our website.

10. Complaints

If you're unhappy with how we've handled your personal data, please tell us first, by email to hello@hydro.website or by post to the address in section 1. We'll acknowledge your complaint within 30 days, look into it, keep you updated, and tell you the outcome without undue delay.

You also have the right to complain to a data protection regulator. In the UK, that's the Information Commissioner's Office (ico.org.uk, 0303 123 1113). In the EU, it's the data protection authority in the country where you live or work, or where the issue happened.

11. If you're in the United States

We don't sell personal data for money. Some US state laws treat certain advertising and visitor identification cookies as "selling" or "sharing" personal data. You can switch these off at any time by choosing "Reject all" in "Cookie settings". You can also email us at hello@hydro.website to ask what personal data we hold about you, or to ask us to delete it.

12. Children

Our services are for businesses, and our website isn't intended for anyone under 18. We don't knowingly collect personal data from children.

13. Other websites

Our site links to other websites, such as our clients' sites and social networks. Their privacy practices are their own, so please read their privacy policies.

14. Changes to this policy

We'll update this policy when our practices change. The date at the top shows when it last changed, and if we make significant changes, we'll say so on our website or tell you directly.

15. Contact us

Questions about this policy or your personal data: hello@hydro.website.