Privacy policy

Last updated: November 1, 2026 · Version 1.2

1. Who we are

InboundHook is a marketing and automation agency. We help businesses get found, capture inquiries, follow up and book appointments. InboundHook is run by Janeth Araceli González Ramírez, who is responsible for your personal information (the responsable under Mexican law). Address: Calle Miguel Alemán 6110 Int. B, Col. Pedregal de Santa Julia, Tijuana, Baja California, C.P. 22604, Mexico. Privacy department: contact@inboundhook.com.

This policy explains what personal information we collect, why, who we share it with, how long we keep it, and the choices you have. It applies to inboundhook.com (English and Spanish), our chat and booking tools, our emails and messages, our calls and meetings, and our dealings with prospects, clients and suppliers.

Two roles, explained plainly.

• Our own data. When you visit our site, book a call, chat with us or become a client, we decide how your information is used. This policy covers that.
• Our clients' customers' data. When a business hires us, we may handle information about its customers and leads (for example, to run its CRM, ads or follow-up). That information belongs to our client, and we use it only to provide services to that client, under our contract with them. If you are a customer of one of our clients, that business's privacy notice applies, and you should send privacy requests to that business. We'll help them respond (section 10).

2. What we collect, where it comes from, and why

• Contact details (name, email, phone, business name, role, website, city): from you (booking form, chat, email, calls), from business directories and websites when we research a business, and, for the personal messages in section 6, from our own contacts or the person who introduced us. We use them to answer you, hold the call you booked, prepare the free plan or proposal you asked for, deliver our services and send the messages described in section 6.
• What you tell us (goals, service interests, questions, messages, meeting notes): from you, for the same reasons. Share only what you choose.
• Appointment details (date, time, video link, attendance): from our booking tool and calendar, to schedule, confirm and remind.
• Call recordings: only when we tell you at the start of a video call and you agree, so our notes are accurate. Saying no doesn't change anything else.
• Public business information (business name, address, phone, website, Google Business Profile, reviews, ads, search visibility): from public sources, to prepare a free plan, decide whether a business may be a fit and contact the business about our services (section 6).
• Communication preferences and consent records (which messages you agreed to, when, where, the wording shown, opt-outs): so we send only what you agreed to and honor opt-outs.
• Visit details (the page you landed on, the site that sent you, campaign tags in the link (UTM parameters), ad click IDs such as gclid and fbclid): from your browser, to know which marketing brings visitors and bookings, and to attach that source to your booking.
• Analytics data (pages viewed, clicks on our buttons, plays of our website demo and the business type selected in it, whether our scorecard was finished and whether it suggested a call, general device and location data): from Google Analytics in your browser (section 7), to understand how visitors find and use the site.
• Technical data (IP address, browser and device type, pages loaded, cookies set by embedded tools): from your browser, our host and our booking and chat tools, to run and secure the site and tools and prevent abuse.
• Client account and billing (billing contact, contract, invoices, payment status): from you and our payment processor, for contracts, billing, tax and accounting.

We do not ask for sensitive information (health, financial account numbers, government IDs, precise location, biometric data, etc.) through our site. Please don't send it to us. If a client's project could involve sensitive data, special rules apply (section 10).

3. How we use it

• To provide what you asked for: reply, book and run calls, prepare plans and proposals, deliver contracted services, support you.
• To run the business: contracts, billing, tax, accounting, record-keeping, security, fraud and abuse prevention, legal claims.
• To follow up about our services: a reasonable number of follow-ups after you contact us or book a call, by email, or by phone if you gave us your number for that. You can stop them at any time.
• Marketing you opted into: newsletters, guides and offers, only with your separate opt-in (section 5).
• To improve our marketing: understand which campaigns, pages and channels bring inquiries, using visit details and analytics.
• To improve our services: using aggregated or de-identified information that does not identify you.
• To comply with law and respond to lawful requests.

We don't use your information for unrelated purposes without telling you first and, where the law requires, asking for your consent.

4. Artificial intelligence

We may use AI features in our tools (for example, a chat assistant that answers common questions or helps book a call, or tools that summarize or sort messages). When we do:

• what you type may be processed by our CRM provider (LeadConnector, by HighLevel) and the AI model providers it uses, to generate a reply;
• we tell you when replies may come from an automated assistant, and a person reads the conversation and follows up;
• a person reviews AI output before it's used for anything that matters to you (proposals, pricing, contracts). We don't use AI to make decisions that produce legal or similarly significant effects on you, and you may object to any decision made without human involvement;
• we don't put sensitive data into AI tools, and we choose settings that limit providers' use of inputs for model training where a tool offers that choice. We can't promise that no provider ever uses inputs to improve its services; each provider's terms apply.

5. Messages: email, text, calls

• Email. Every marketing email identifies us, includes our postal address and a working way to opt out (an unsubscribe link or replying "stop"). We honor unsubscribes promptly (within 10 business days at the latest).
• Text messages (SMS). Apart from the personal messages described in section 6, we text you only with your consent. Reply STOP to opt out. Message and data rates may apply; frequency varies. Consent to texts is never a condition of buying anything. We don't share your mobile number or text-message consent with third parties or affiliates for their marketing.
• Calls. We may call businesses at their listed business number during business hours. Tell us "don't call" and we'll stop. We don't record calls unless we tell you at the start and you agree.
• Chat and social messages. Our website chat is recorded and stored by our chat provider for us. If you message us on Facebook or Instagram, we reply there and may save the conversation in our CRM; Meta's own policies also apply to those channels.

Opting out of marketing doesn't stop messages we must send about a booking you made or a contract you have with us.

6. Business prospecting

We may contact businesses we think we can help, using business contact information that the business publishes (its website, Google Business Profile, directories). We contact businesses one at a time, by email, a manual phone call or a direct message to its public social media account, about our services. We may also write personally, by text, WhatsApp or direct message, to people we already know and to people who agreed to hear from us when someone introduced us. Each message is written and sent individually. We don't buy consumer lists, and we don't send text or WhatsApp messages to anyone we don't know unless they agreed first. Every email gives you a way to opt out (an unsubscribe link or replying "stop"); tell us to stop and we'll add you to our do-not-contact list.

7. Cookies, analytics and advertising

• Booking and chat. Our booking calendar and chat window are provided by our CRM and may set cookies needed for them to work.
• Visit details. This site keeps the campaign details of your visit in your browser's session storage until you close the tab. If you book a call, these details (including ad click IDs) are attached to your booking in our CRM.
• Google Analytics. We use Google Analytics to see how visitors find and use the site (pages viewed, the site or campaign that sent you, clicks on our buttons, and general device and location data). It sets cookies. We set it up not to collect your name, email or phone; Google uses your IP address to estimate a general location and doesn't store it in our reports. How Google uses this data: policies.google.com/technologies/partner-sites. You can block these cookies in your browser settings or with Google's opt-out add-on (tools.google.com/dlpage/gaoptout).
• Advertising. We don't use advertising pixels or upload contact lists to ad platforms. If we start, we'll update this policy first.

8. Who we share it with

We don't sell personal information and haven't in the past 12 months. We share it only with:

• Our CRM, booking, chat, email and SMS platform (LeadConnector, by HighLevel): to store contacts, run booking and chat and send messages.
• Our email, calendar and video-call provider (Google Workspace, including Google Meet): email, calendar, video calls and call recordings you agreed to.
• Google Analytics (Google): site analytics (section 7).
• Our website host (Hostinger): hosting the site; server logs.
• Our payment processor (Stripe): taking payments. Stripe processes card data under its own terms; we never see full card numbers.
• Telephone and SMS carriers, when we call or text: to deliver them.
• AI model providers used by our CRM's AI features, when a feature is on (section 4).
• Professional advisers (lawyers, accountants), under confidentiality: advice, tax, audits.
• Authorities, when the law requires, or to protect rights and safety.
• A buyer or successor, if the business is sold or merged, under this policy.

Our providers process data on our instructions and under their own security commitments. Some, like Google, may also use data under their own terms.

9. Your choices and rights

You can ask us, free of charge (except copying or shipping costs, if any), to:

• access the personal information we hold about you and learn how we use it;
• correct it;
• delete it (subject to what we must keep by law, section 11);
• object to or limit a use, including all marketing;
• withdraw consent you gave;
• get a copy in a portable format.

How: email contact@inboundhook.com with the subject "Privacy request" (or "Solicitud ARCO" in Spanish) and say what you want. To protect you, we'll ask for proof of identity (for Mexican ARCO requests, an ID document; see the Aviso de privacidad) and use it only for that. You can use an authorized agent; we may ask for proof of authorization.

When: we confirm receipt promptly and answer within 20 business days, putting the decision into effect within 15 business days after that (Mexico's deadlines, which we apply to everyone). Where a law gives a different deadline (for example 45 days under California law), we follow whichever is shorter. Deadlines may be extended once where the law allows.

No discrimination: we won't treat you differently for using these rights. Shortcuts: the "unsubscribe" link in emails; reply STOP to texts.

Mexico. Residents have ARCO rights (access, rectification, cancellation, opposition), plus revocation of consent and limits on use. See the Aviso de privacidad integral. If you're not satisfied with our answer, you can go to Mexico's data-protection authority, the Secretaría Anticorrupción y Buen Gobierno.

California and other US states. Where a state privacy law applies to us, you have the rights that law gives (such as to know, delete, correct, and opt out of sale, sharing and targeted advertising). We honor these requests for everyone, whether or not a law requires it, except where an exception applies. If we deny a request, we'll tell you why.

10. Data we handle for our clients

When a business hires us, its customer and lead data stays its data. We act as its service provider (processor, or encargado):

• We use it only to deliver that client's services, as the client instructs and our contract allows.
• We don't sell it, don't use it to market InboundHook or anyone else, and don't combine it with other clients' data to build audiences or profiles.
• Ad audiences built from a client's data live in that client's ad accounts and are used only for that client.
• When the contract ends, we return or delete it as the contract says, except what the law makes us keep.
• We don't upload health, addiction-treatment, patient or other sensitive data to ad platforms. Clients in regulated fields need a separate written agreement before we handle any such data (including a HIPAA Business Associate Agreement where it applies). We don't claim to be HIPAA compliant.

If you are a client's customer, please contact that business first; we'll pass along any request we receive.

11. How long we keep it

We keep information only as long as we need it for the purposes above, then delete it or make it anonymous.

• Leads and prospects who didn't become clients: up to 24 months after our last interaction.
• Clients: the length of the contract, plus the period tax and commercial law require for records (5 years in Mexico).
• Opt-outs: for as long as needed to keep honoring them, keeping only what's needed to recognize you (such as email or phone and the date).
• Consent records: as long as the consent is used, plus 5 years to prove it.
• Visit details in session storage: deleted when you close the tab.
• Google Analytics data: up to 14 months.
• Call recordings: deleted within 90 days, unless needed for a dispute.
• Backups: overwritten on our providers' normal cycle.

12. Security

We use safeguards suited to the size of our business: access to our systems is limited to the people who run InboundHook, and each client gets its own separate CRM account. No system is perfectly secure. If a breach significantly affects your rights, we will notify you and the authorities as the law requires.

13. International processing

InboundHook operates from Baja California, Mexico, and serves businesses mainly in the United States and Mexico. Our providers may store or access data in the United States and other countries (our CRM provider says this can include India). When we transfer data to another company for its own purposes (not as our provider), we do so only as the law allows and, where required, with your consent.

14. Children

Our services are for businesses. We don't knowingly collect information from anyone under 18. If you think we have, contact us and we'll delete it.

15. Other sites

Links and embedded content from other companies (Google, Meta, etc.) follow those companies' policies.

16. Changes

We'll post changes here and update the date and version above. If a change significantly affects how we use information we already have, we'll tell you in advance and, where required, ask for consent again.

17. Contact

Janeth Araceli González Ramírez (InboundHook), Calle Miguel Alemán 6110 Int. B, Col. Pedregal de Santa Julia, Tijuana, Baja California, C.P. 22604, Mexico · contact@inboundhook.com · +52 663 199 4761