Privacy Policy

This Privacy Policy describes how JM Automated Solutions, LLC ("we," "us"), Carlsbad, California, handles personal information on jmautomated.com. The site is for business and plant enquiries from visitors in the United States. If you are a California resident, section 7 describes your rights under California law.

1. What we collect

What happens while you browse. Unless you choose “Reject all” (or turn the categories off in “Cookie settings”) or your browser sends Global Privacy Control, two things happen as you use our pages. Microsoft Clarity records your clicks, scrolling, mouse movement and the pages you move between as you use them, with the text on the page and anything you type into a form masked in your browser before it is sent. The LinkedIn Insight Tag, the Google tags (Google Analytics and the Google Ads tag) and the Meta Pixel send your page visits and interactions directly from your browser to LinkedIn, Google and Meta as you browse. Separately, if you type a message in the MILO chat and send it, the message is sent to OpenAI, or to Anthropic if OpenAI does not respond, to write a reply; the chat sends messages only when you use it, whatever your cookie choice. Sections A to D give the details.

A. Website analytics (on by default)

Microsoft Clarity records how visitors use our pages (session recordings, heatmaps, clicks, scrolling and mouse movement) so we can find what is confusing or broken. It is set to strict masking, so the text on the page and anything you type into a form are masked in your browser before any recording data is sent to Microsoft. Clarity sets first-party cookies (_clck and _clsk) and receives your IP address and browser and device information. Microsoft handles this data under the Microsoft Privacy Statement.

Google Analytics 4 receives the pages you view, events such as clicks and form sends, the referrer, browser and device information and approximate location, with the Analytics cookies _ga and _ga_*. Google receives your IP address with each request. Google Signals is turned on in our Google Analytics settings, so Google may associate Analytics data with the Google accounts of signed-in users for cross-device reports and ads. The Google Analytics retention in section 2 is unchanged.

Our own first-party analytics record which public pages and buttons are used. A record can include the page, the referrer, the country, the browser family, and the event (for example, a page view or a button click). It does not set its own cookies, and these records do not include your IP address. A stored page address can include an ad click ID (such as gclid or fbclid) if you arrived from an ad.

These three run unless you turn analytics off or your browser sends Global Privacy Control (see sections 5 and 6).

Cloudflare Web Analytics runs on every visit, whatever you choose in the cookie banner. It sets no cookies, does not use local storage, and does not track you across other websites. We use it only for aggregate visit counts, such as page views, referrers, countries, browsers and page load times.

B. Advertising (on by default)

The LinkedIn Insight Tag tells LinkedIn which pages were viewed so LinkedIn can show us aggregate reports about visitors who are LinkedIn members (for example their industry or job function) and measure and target LinkedIn ads. It receives the pages you view, your IP address, browser information and LinkedIn cookie IDs (such as li_fat_id on our site and LinkedIn's own cookies). LinkedIn does not give us the names of visitors. See the LinkedIn Privacy Policy.

The Google Ads tag receives the pages you view, conversion events (such as a form sent or a click on a phone, email, booking or WhatsApp link), your IP address, browser information and Google advertising cookies (_gcl_au and Google's own advertising cookies), so we can measure and target our ads.

The Meta (Facebook/Instagram) Pixel runs in your browser, and Meta's Conversions API sends the same events to Meta from our server, not only from your browser. Both use the same event ID so Meta counts each event once.

For every page view, and for events such as a click on a contact, booking or WhatsApp link, opening or using the MILO chat, and starting or finishing the instant estimator, our server sends Meta: the event name, time and event ID, the page address (without the part after a "?"), your IP address, your browser's user agent, the Meta cookie IDs _fbp and _fbc if your browser has them, and an external_id, which is a SHA-256 hash of the _fbp cookie ID.

When you send a form, our server also sends your email address, first name, last name and phone number (if you gave one), each converted to a SHA-256 hash, and the Pixel in your browser sends the same details, hashed by Meta's code before they leave your browser. A click on our booking link is sent as an event, but the booking itself is made on Google's booking page, and we do not send Meta the details you enter there.

Meta uses this to match the events to Meta accounts so we can measure and target our ads. Our server does not send Meta your message, your project description or any other text you type in a form. The Pixel sends the event name and event ID with no other event details from us; like every Meta Pixel, Meta's code in your browser also sends the page address, the referrer and your browser's user agent with each event. We have turned off the Pixel's automatic button-click and page-metadata events. Google tags receive the event and the form type, not your name, email, phone or message.

Hashing is pseudonymization, not anonymization: Meta can match a hash to an account it already holds, so hashed contact details are still personal information, and we treat them that way.

None of this is sent to Meta, from your browser or from our server, when you turn advertising off (with “Reject all”, “Cookie settings” or the Do Not Sell or Share page) or when your browser sends Global Privacy Control.

The LinkedIn, Google Ads and Meta tools run unless you turn advertising off or your browser sends Global Privacy Control. Your browser's tracking protections, your Meta ad preferences and your Google ad settings also apply.

C. Contact and assessment forms

If you use a form on jmautomated.com, we receive the name, email address, and project description you submit, plus the phone number and company if you add them, and a Cloudflare Turnstile token used only to filter bots. A feasibility study also includes the product, the defect, and any line conditions you choose to add. We store this so we can reply and assess that enquiry. Unless you opted out or your browser sends Global Privacy Control, the hashed email, first and last name and phone are sent to Meta to measure and target our ads (see section B). The form contents are not shared with data brokers. You can email us to delete it.

D. MILO chat

If you use the MILO chat window, the messages you type (the last few turns of the conversation, sent from your browser) go to our chat service on Cloudflare Workers, which passes them to OpenAI (model GPT-4o mini) to write a reply. If OpenAI does not respond, the same messages go to Anthropic (Claude) instead. We do not store chat conversations in a database. Cloudflare keeps standard request logs for the chat service for a few days, without the message text, and OpenAI and Anthropic handle the messages under their own API data policies. Chat messages are not sent to Meta or Google for advertising. Please do not send confidential or sensitive information in the chat.

E. Stored in your browser

The site stores a few things in your own browser: your cookie choice (the jm_consent cookie and local storage, kept for 12 months), a note that you have seen the "Opt-Out Request Honored" message if your browser sends Global Privacy Control, your instant-estimator answers (local storage) so you can come back to them, and Cloudflare Turnstile data used to filter bots on forms. The cookies set by the tools in sections A and B are listed in section 2.

F. Payments

Payments are processed by PayPal. Card and bank details go to PayPal, not to us. We receive the payment confirmation, the amount, and the name and email on the payment.

2. How long we keep it

We keep personal information only as long as we need it for the purposes above. Each company in section 3 also keeps the data it receives under its own policy; the periods below are the ones those companies publish.

• Form submissions on our website's servers: 90 days, then the copy is deleted automatically. Records of blocked spam submissions, without the message text, are kept 30 days. When you submit a form, our spam filter holds your IP address for up to five minutes to limit repeat submissions, then discards it. The IP address is also passed to Cloudflare Turnstile with the bot check.
• Your enquiry in our email and contact records: the website emails each submission to our business mailbox through Google Workspace (Gmail). We keep enquiries, and any replies and contact records about them in our email, for 24 months after our last contact with you, then delete them. Email us at any time and we'll delete them sooner, unless we need to keep something for a legal reason.
• Our first-party analytics records: 90 days.
• Your cookie choice (jm_consent): 12 months, then we ask again.
• Microsoft Clarity: session recordings 30 days; heatmap and click data, and recordings we label or mark as favorites, up to 9 months. Cookies: _clck 1 year, _clsk 1 day.
• Google Analytics 4: user-level and event-level data 14 months (our Google Analytics data retention setting; Google offers 2 or 14 months); aggregated reports are kept by Google. Cookies: _ga and _ga_* about 13 months (400 days).
• Google Ads tag: kept under Google's retention policy; Google says it anonymizes advertising data in server logs by removing part of the IP address after 9 months and cookie information after 18 months. Cookie: _gcl_au 90 days.
• LinkedIn Insight Tag: LinkedIn removes members' direct identifiers within 7 days and deletes the remaining pseudonymized data within 180 days. Cookie on our site: li_fat_id 30 days, set only when you arrive from a LinkedIn ad.
• Meta Pixel and Conversions API: Meta may keep event data for up to 2 years, and deletes hashed contact details after matching them. Cookies: _fbp 90 days, _fbc 90 days (set only when you arrive from a Meta ad).
• Cloudflare Web Analytics: no cookies. Cloudflare keeps the full visit data for 7 days and aggregated data for about 6 months.

3. Who else sees it

Unless you opt out or your browser sends Global Privacy Control, your IP address, device and browser information and the pages you view go to Microsoft (Clarity), Google (Google Analytics and the Google Ads tag), LinkedIn (Insight Tag) and Meta (Pixel and Conversions API), as described in sections A and B. Meta also receives the hashed contact details from a form you send. These companies can work out an approximate location (country, region or city) from your IP address. Microsoft, Google, LinkedIn and Meta can collect information about your online activities over time and across different websites when you use our site.

Form contents go to JM Automated Solutions so we can reply: the website sends us a notification email and an alert to our own notification system. Our service providers use personal information only to provide their service to us. They are grouped by what they do:

Sources of business contact information

These are not service providers for this website. We use Apollo and Hunter to find business email addresses and contact details. They receive no visitor data from this site.

Content tools and publishing research

We make presentations with Gamma and publish our research on Zenodo. Neither receives visitor data from this site.

The fonts on this site are served from our own website, so loading a page does not contact Google Fonts. We do not share personal information with data brokers.

4. Your rights

Anyone can email sales@jmautomated.com to ask for a copy, a correction, or deletion of a form or chat they sent, or to opt out of sharing. We confirm a request within 10 business days and respond within 45 calendar days (see section 7). We do not need a copy of a government ID for a site enquiry. California residents have the rights in section 7.

5. How opting out works

• "Reject all" in the cookie banner, the Do Not Sell or Share My Personal Information page, or turning both categories off in "Cookie settings" turns off all five tools: Microsoft Clarity, Google Analytics, the Google Ads tag, the LinkedIn Insight Tag and the Meta Pixel, together with our first-party analytics and Meta's Conversions API.
• They stop on the page you are on, the cookies they set on our site are deleted, and on later pages our server no longer sends their code to your browser.
• In "Cookie settings" you can also turn off only Analytics (Clarity, Google Analytics and our page-event log) or only Advertising (LinkedIn, Google Ads and Meta).
• After you opt out, the site shows "Opt-Out Request Honored", and the Do Not Sell or Share page shows each tool as off.
• We save your choice for 12 months in this browser. If you clear your cookies or use a different browser or device, make the choice again there.

6. Global Privacy Control

Global Privacy Control (GPC) is a setting in some browsers and extensions that tells websites you do not want your personal information sold or shared. We treat it as a valid request to opt out of sale and sharing for that browser. Our server checks for the signal on every page request. When it is present, the page is sent without the code for Microsoft Clarity, Google Analytics, the Google Ads tag, the LinkedIn Insight Tag and the Meta Pixel, so none of them load, and our server does not send your activity to Meta or keep a first-party analytics record of your visit. The site shows "Opt-Out Request Honored". You do not need to do anything else. If GPC conflicts with a choice you made earlier in our cookie settings, we follow GPC.

You can turn on Global Privacy Control in Firefox's privacy settings, or use a browser or extension that sends it, such as Brave or DuckDuckGo. While your browser sends the signal, you don't need to use the banner or the Do Not Sell or Share page. If you'd like confirmation, the Do Not Sell or Share page shows "Opt-Out Request Honored" and each tool as off.

Do Not Track: our site does not change its behavior in response to a browser's "Do Not Track" setting. We honor Global Privacy Control as described above.

7. California privacy rights

This section applies to California residents and describes the rights given by the California Consumer Privacy Act, as amended by the California Privacy Rights Act.

Personal information we collected in the last 12 months

• Identifiers (name, email, phone, IP address, cookie and device IDs such as _clck, _ga, _gcl_au, li_fat_id, _fbp and _fbc). Source: you and your browser. Used to reply to enquiries, to keep the site secure and filter bots, for analytics, and to measure and target our ads. Disclosed to our service providers, to Microsoft and Google for analytics, and shared with LinkedIn, Google and Meta for advertising, unless you opt out.
• Internet or other electronic network activity (pages viewed, clicks, scrolling and mouse movement, referrer, browser and device type, the fact that a form was sent). Source: your browser. Used for aggregate visit counts through Cloudflare Web Analytics on every visit, and for analytics and advertising unless you opt out. Disclosed to Cloudflare for visit counts and to Microsoft and Google for analytics, and shared with LinkedIn, Google and Meta for advertising, unless you opt out.
• Approximate geolocation (country, region or city inferred from your IP address, not precise GPS location). Source: your browser. Used for analytics and ad measurement. Your IP address goes to Microsoft, Google, LinkedIn and Meta through the tools in section 1, so it is disclosed and shared with them unless you opt out.
• Commercial information (payment records and the services you asked about). Source: you. Used for billing and the work itself. Disclosed to our payment providers (section 3). Not sold or shared.
• Professional information (company, role, and the line and product details you describe). Source: you. Used to scope the work. Not sold or shared.
• Sensitive personal information: we do not ask for it and we do not use any personal information to infer characteristics about you. Please do not send it in a form or chat.

Sale and sharing

In the last 12 months we have not sold personal information for money. Unless you opt out or your browser sends Global Privacy Control, we have shared identifiers, internet activity and approximate location with LinkedIn, Google and Meta for cross-context behavioral advertising ("sharing" under Cal. Civ. Code § 1798.140(ah)), and Meta has received hashed contact details from forms, sent from our server.

Your rights

• Know and access: what we collected, where it came from, why, and who received it.
• Delete the personal information we collected from you, with some legal exceptions.
• Correct inaccurate personal information.
• Opt out of sale and sharing on the Do Not Sell or Share My Personal Information page, with "Reject all" in the cookie banner, with "Cookie settings" in the footer, with Global Privacy Control, or by email or phone.
• Limit the use of sensitive personal information: we do not use sensitive personal information for purposes that would require this.
• No retaliation or discrimination for using these rights.

Global Privacy Control

We treat a Global Privacy Control signal as a valid request to opt out of sale and sharing for that browser, as described in section 6. When we detect it, the site shows "Opt-Out Request Honored".

How to make a request

To opt out, use the Do Not Sell or Share page, "Reject all" in the cookie banner, or Global Privacy Control. No account is needed, and we do not ask for verification to opt out. To know, delete or correct, email sales@jmautomated.com. To protect your information, we verify access, deletion and correction requests by matching the email or phone you used with us. An authorized agent can make a request with your signed permission, and we may ask you to confirm your identity with us directly. We confirm a request within 10 business days and respond within 45 calendar days. If we need more time we will tell you why, and the total will not be more than 90 days. We act on opt-out requests sent by email within 15 business days; opt-outs made on the site take effect in your browser right away.

8. Changes

We may update this policy. The effective date at the top will change.

9. Contact

Privacy requests and questions: sales@jmautomated.com
JM Automated Solutions, LLC, California, United States

We don't knowingly sell or share data of anyone under sixteen.