Privacy Policy
Effective date: July 27, 2026 Last updated: July 27, 2026
The short version
We do not sell your information. Not your contact info, not your business data, not anything.
What we collect from you. Inquiry and questionnaire responses (name, company, email, phone, website, industry, goals, budget), plus what your browser hands over automatically when you visit.
What we collect about your business. During an engagement we look at your website, your analytics, your search performance, your social accounts, your reviews, and your competitors. Some of that comes from public sources and research tools. Section 4 lists exactly which ones.
Your confidential stuff stays confidential. We see revenue, margins, customer lists, and strategy. We don’t talk about it, and we’ll sign your NDA.
Sometimes we handle your customers’ data, not just yours. If we run your email list or your ad accounts, we’re processing data about your customers on your behalf. That makes you the controller and us the processor, and Section 7 explains what that means and what we commit to.
Ads and analytics. We run GA4, Google Ads, Meta, and Microsoft Clarity on our own site. Clarity records mouse movement and clicks. Opt-out links are in Section 6.
Your rights. Access, correct, delete, port, opt out. Email us. Appeal if we say no.
Full policy below.
1. Who we are and scope
1.1 GR Studio & Co. is a division and assumed name of Gabe Rene LLC, a Texas limited liability company based in Kerrville, Texas.
1.2 This Policy covers grstudioco.com, related subdomains, proposal and client portals, and personal information we handle in the course of commercial engagements.
1.3 The general Gabe Rene LLC Privacy Policy at gaberene.com/privacy also applies. Where the two conflict on a GR Studio & Co. matter, this Policy controls.
1.4 Two roles. For most information described here, Gabe Rene LLC is the controller. For personal data we process on a client’s behalf under an engagement, the client is the controller and we are the processor. Section 7 covers that.
2. Information you give us
| Category | Examples |
|---|---|
| Business contact | Name, title, company, work email, phone, business address |
| Company profile | Website, industry, size, locations, years in business, service area |
| Engagement information | Goals, challenges, budget range, timeline, decision process, current vendors |
| Questionnaire responses | Answers to our commercial intake, brand audit, and project questionnaires, delivered through Dubsado and Jotform |
| Competitive information | Competitors you name and how you position against them |
| Brand and business materials | Logos, style guides, existing copy, photography, product information, pricing, performance data |
| Transaction information | Invoices, payment records, amounts, dates, status |
| Communications | Email, text, form messages, call and meeting notes, and recordings where you have consented |
Confidential business information. Clients regularly share revenue, margins, customer lists, CAC, churn, and strategic plans. This is handled under the confidentiality obligations in our Terms of Service Section 8 and under any NDA between us.
3. Information collected automatically on our site
3.1 IP address, browser and device type, operating system, screen size, language, referring URL, pages viewed, time on page, scroll depth, clicks, navigation paths, and access times, collected via cookies, pixels, tags, local storage, and server logs, deployed through Google Tag Manager.
3.2 Microsoft Clarity provides anonymized session replays and heatmaps recording mouse movement, clicks, taps, and scrolling. It masks text input by default.
3.3 Google Analytics 4, Google Ads, and Meta (including server-side Conversions API events) collect advertising and conversion data.
4. Research we perform on your business
4.1 Brand audits, competitive analysis, and strategy work require research. During an engagement, or in preparing a proposal, we may collect information about your business, your competitors, and your market from:
| Source | What it provides |
|---|---|
| Your public website and social profiles | Content, messaging, visual identity, structure |
| Search engines and SERP data tools | Rankings, visibility, competitor positions, AI search presence |
| SEO and technical crawl tools | Site health, on-page issues, performance, backlinks |
| Business listing and review platforms | Google Business Profile, reviews, ratings, local presence |
| Brand identity data providers | Logos, colors, fonts as published by your brand |
| Public web research and AI research tools | Market context, industry landscape, competitor intel |
| Analytics accounts you grant us access to | Your GA4, Search Console, ad accounts, social insights |
4.2 This research uses publicly available information and data you authorize us to access. We do not use tools that scrape private accounts, we do not attempt to access anything without permission, and we do not purchase personal data about individuals.
4.3 Research about competitors is limited to publicly available business information about those companies. It is not personal information about individuals except where a named individual is a public-facing business figure (a founder or spokesperson whose role is public).
4.4 Where we access your analytics or advertising accounts, we access only what the engagement requires and only for as long as it requires. Tell us when to remove our access and we will. If you forget, we will ask at close-out.
5. How we use information
To respond to inquiries and prepare proposals; to enter into and perform engagements; to research, audit, plan, produce, and deliver work; to schedule and staff production; to invoice and keep financial records; to support and communicate with you; to send marketing you opted into; to operate, secure, and improve the Site; to measure our own advertising; to display work in our portfolio subject to Terms of Service Section 9; to protect our rights and prevent fraud; and to comply with law.
6. Cookies and your controls
| Control | How |
|---|---|
| Cookies generally | Block or delete in your browser |
| Google Analytics | tools.google.com/dlpage/gaoptout |
| Microsoft Clarity | clarity.microsoft.com/terms |
| Meta advertising | Meta Ad Preferences in your account settings |
| Google advertising | adssettings.google.com |
| Industry opt-out | optout.aboutads.info and optout.networkadvertising.org |
Global Privacy Control. We honor the GPC signal as a valid opt-out of targeted advertising and sharing where applicable law requires. We do not currently respond to “Do Not Track,” as there is no consistent standard for it. Where required, we operate Google Consent Mode v2.
7. When we process data on your behalf
7.1 Some engagements involve us handling personal data about your customers, subscribers, leads, or employees. Examples: managing your email marketing platform, running your ad accounts, implementing tracking and conversion measurement, building forms that collect leads, or migrating a customer list.
7.2 In those engagements you are the controller and we are the processor. You decide the purpose and means. We act on your documented instructions.
7.3 Our commitments as processor. We will:
(a) process personal data only on your documented instructions, including for international transfers, unless law requires otherwise; (b) ensure our personnel and contractors with access are bound by confidentiality; (c) implement appropriate technical and organizational security measures; (d) engage a subprocessor only where reasonably necessary to perform the engagement, and remain responsible for its performance; (e) assist you, taking into account the nature of processing, in responding to data subject rights requests; (f) assist you with security, breach notification, and impact assessment obligations; (g) notify you without undue delay after becoming aware of a personal data breach affecting your data; (h) delete or return your personal data at the end of the engagement, at your election, except where law requires retention; and (i) make available information reasonably necessary to demonstrate compliance with this Section.
7.4 Your obligations as controller. You are responsible for having a lawful basis for the processing, for providing required notices to your data subjects, for obtaining any necessary consents, and for the accuracy and lawfulness of data you provide us. Do not send us a purchased list, a scraped list, or data you do not have the right to use. If you do, that is your liability and Section 20 of our Terms applies.
7.5 Data processing agreement. Where GDPR, UK GDPR, CCPA, TDPSA, or another law requires a data processing agreement, we will execute one. Send yours or ask for ours. Where a signed DPA exists, it governs and supersedes this Section to the extent of conflict.
8. How we share information
8.1 We do not sell personal information and have not in the preceding twelve months.
8.2 We share with:
| Recipient | What and why |
|---|---|
| Dubsado | CRM, proposals, contracts, invoices, questionnaires |
| Jotform | Intake and audit questionnaires |
| Flodesk | Email marketing, opt-in contacts only |
| Google (Tag Manager, Analytics, Ads, Workspace, Search Console) | Analytics, advertising, email, search performance |
| Meta | Advertising and conversion measurement |
| Microsoft (Clarity, Bing Webmaster) | Analytics and search performance |
| Netlify | Website and proposal portal hosting |
| Stripe, Intuit QuickBooks | Payments and accounting |
| Research and SEO data providers | Audit and competitive research, per Section 4 |
| Contract crew (designers, developers, editors, second shooters, videographers, drone operators) | Only what the work requires. All bound by confidentiality. |
| Professional advisors and insurers | As needed |
| Legal recipients | As required by law, subpoena, or court order, or to protect safety |
| A successor | In a merger, acquisition, or sale of the business |
8.3 Targeted advertising. We run Google and Meta ads for our own marketing. Under Texas and California law that may count as “targeted advertising,” or as “sharing” for cross-context behavioral advertising under the CCPA, even though no money changes hands. You may opt out. See Sections 6 and 9.
8.4 We do not share your confidential business information with anyone outside the people listed above who need it to perform your engagement.
9. Your privacy rights
9.1 We extend these rights to anyone who asks, regardless of residency:
| Right | Meaning |
|---|---|
| Know and access | Confirm what we hold and get a copy |
| Correct | Fix inaccurate information |
| Delete | Have your personal information deleted |
| Portability | Get your data in a portable format |
| Opt out of targeted advertising | Stop use of your data for targeted ads |
| Opt out of sale | We do not sell, but the right stands |
| Withdraw consent | Where consent is our basis |
| Non-discrimination | Exercising a right changes nothing about your service or price |
| Restrict or object (EU and UK) | Restrict or object to certain processing |
| Complain (EU and UK) | Lodge a complaint with your supervisory authority |
9.2 How. Email gabe@gaberene.com with the subject “Privacy Request,” or write to the address in Section 15.
9.3 If your request concerns data we process on a client’s behalf as processor, we will refer you to that client, who is the controller, and assist them in responding. We cannot act unilaterally on data that belongs to someone else’s business.
9.4 Timing. Forty-five (45) days, extendable once by another forty-five (45) with notice. EU and UK: one (1) month, extendable by two (2) months for complex requests.
9.5 Limits. We may decline deletion where we must keep information to complete a transaction, comply with law, exercise or defend legal claims, maintain tax and financial records, or preserve proof of rights granted under a contract. We will tell you the reason.
9.6 Free once per twelve-month period. We may charge for or decline manifestly unfounded, excessive, or repetitive requests, with an explanation.
10. Appeals
10.1 If we decline your request, email gabe@gaberene.com with the subject “Privacy Appeal,” including your original request and why you disagree.
10.2 We respond in writing within sixty (60) days with our reasons.
10.3 If we deny the appeal, you may complain to the Texas Attorney General at texasattorneygeneral.gov/consumer-protection, or to the authority in your jurisdiction.
11. Retention
| Data | Retention |
|---|---|
| Inquiries that never become engagements | Up to 3 years |
| Client records, deliverables, and correspondence | Term of engagement plus 7 years |
| Financial and tax records | 7 years |
| Signed SOWs, MSAs, licenses, and releases | Indefinitely, as proof of rights granted |
| Research and audit working data | 3 years after delivery |
| Client personal data we process as processor | Deleted or returned at close-out per Section 7.3(h) |
| Access credentials to your accounts | Removed at close-out, or sooner on request |
| Marketing list membership | Until you unsubscribe, plus a suppression record |
| Analytics and advertising | Per platform settings, generally 14 months in GA4 |
12. Security
12.1 We use reasonable safeguards: encrypted transmission (HTTPS/TLS), access controls and strong authentication on business accounts, password-protected proposal and audit portals, encrypted backups, and need-to-know access limits for contractors.
12.2 No system is completely secure and we cannot guarantee absolute security.
12.3 We will notify affected parties and authorities of a breach as required by law, including Texas Business and Commerce Code ยง 521.053, and will notify a client without undue delay of a breach affecting data we process on their behalf.
13. Children
The Site is a business-to-business site, intended for users 18 and older. We do not knowingly collect personal information from children under 13. If a commercial engagement involves photographing minors (a family-owned business, a youth-focused brand, a school), we do so with parent or guardian involvement and appropriate releases, and we do not publish a minor’s image without permission.
14. International transfers
We are in the United States and process information here. If you are outside the United States, your information is transferred to and processed in the United States. Where we transfer personal data out of the EEA or UK, we rely on Standard Contractual Clauses, the UK International Data Transfer Addendum, or an Article 49 derogation.
15. Third-party links, changes, and contact
15.1 The Site links to third-party services. We are not responsible for their privacy practices.
15.2 We may update this Policy. We will change the “Last updated” date and give additional notice for material changes.
15.3 Questions, requests, or complaints:
GR Studio & Co. A division of Gabe Rene LLC Attn: Privacy PO Box 1131 Ingram, TX 78025 gabe@gaberene.com 210.802.6055
Gabe Rene | Gabe Rene LLC | 210.802.6055 | gaberene.com