Privacy & Accessibility

Agency — operated by Work With Agency LLC

Effective September 12, 2026. Last updated September 26, 2026.

The short version: This is a marketing website. If you fill in our contact form, we get your name, email, and message by email, and we use them to write back. We also use Google Analytics to see which pages people read, which sets cookies and collects an approximate location from your IP address. We do not sell your information, we do not share it for advertising, and we do not run ad trackers. You can ask us what we hold about you and ask us to delete it, and we will. The rest of this page is the same story told carefully.

Who we are

Agency is a transformation consultancy in New York City. We work alongside executive teams on their hardest strategic priorities.

The legal entity behind this website is Work With Agency LLC, doing business as Agency, located in New York, New York. We operate the website at www.workwithagency.co.

For privacy law purposes, Work With Agency LLC is the controller of the personal information described here. That means we decide what gets collected and why.

Contact: hello@workwithagency.co

We have not appointed a data protection officer. We are small enough that privacy questions come to us directly, at the address above.

What we collect, and why

There are only two ways this website collects anything about you.

Information you send us

When you fill in the contact form, you give us:

Your name — So we know who we are talking to
Your email address — So we can reply
Your message — Because that is the point of the form

The form is handled by Netlify, the company that hosts this site: it stores each submission and emails it to our inbox. A person reads it and replies. Nothing more happens to it automatically.

One request: please don’t put sensitive details in the message box. We don’t need your health information, your government ID numbers, your financial account details, or anything about your race, religion, politics, union membership, or sexual orientation, and we would rather not receive them. If you send them anyway, we will hold them under the same terms as everything else in this policy and delete them when we no longer need the message.

You can also just email us directly. If you do, we hold your email the same way we hold a form submission.

Information collected automatically

Google Analytics. We use Google Analytics 4 to understand which pages people visit and how they found us. It sets cookies and similar identifiers in your browser, and it collects:

The pages you view, how long you stay, and what you click
The site or search that sent you here
A randomly generated identifier for your browser or device
Your device type, browser, operating system, and screen size
An approximate location — country, region, and city — derived from your IP address
The language your browser is set to

Google acts as our service provider and processor for this. They handle the data on our instructions and are not permitted to use it for their own purposes. Google states that for visitors in the EU, the UK, and Switzerland, it discards IP addresses before logging them, using them only to derive that coarse location first.

We have turned off the settings that would let Google use our analytics data for advertising personalization, and we have turned off Google Signals. We do not use advertising pixels, retargeting tags, or any tracker beyond Google Analytics itself.

Hosting and security logs. Like every website, ours sits on a server that keeps short-lived technical logs — IP address, time of request, page requested, browser type. These exist so the site can be delivered to you and so we can spot abuse or failures. We don’t use them for anything else.

Fonts. The site’s type is served by Adobe Fonts and Google Fonts. When a page loads, your browser fetches the font files from their servers, which see your IP address the way any web server does. Neither sets a cookie for it. Adobe counts which fonts are served, for licensing, and nothing more.

The legal categories, for the record

Some privacy laws ask us to describe what we collect using their own vocabulary. In those terms, we collect:

Identifiers — name, email address, IP address, cookie and device identifiers
Customer records information — name and email address, again, as that category defines it
Internet or network activity — how you move through this website
Approximate geolocation — country, region, and city, inferred from your IP address, never precise location
Professional information — your company and your role, if you mention them in your message

We do not knowingly collect biometric data, precise geolocation, audio or visual recordings, education records, or financial account information.

We don’t gather sensitive personal information to work anything out about you. If some arrives in a message, we use it only to reply, and we disclose it to no one. We build no profiles and make no automated decisions about you.

The sources are equally short: you, and your browser.

Why we are allowed to do this

If you are in the UK or the EU, the law wants us to name a legal basis for each thing we do. Ours are:

Replying to your inquiry — our legitimate interest in answering people who ask about our services. If your message is a first step toward working together, we also rely on your request that we take steps before entering a contract.
Analytics — your consent, where consent is required for the cookies involved. You can withdraw it at any time, and Section 8 explains how.
Keeping the site running and secure — our legitimate interest in operating a website that works and isn’t being abused.
Meeting our legal and tax obligations — compliance with laws that apply to us.

Giving us your information is entirely voluntary. Nothing here is a statutory or contractual requirement. The only consequence of not filling in the form is that we can’t write back.

Who else sees it

A short list, because it is a short list.

Google LLC, as our analytics provider. Website usage data only. Google processes it on our instructions.
Our email and productivity provider, which hosts the inbox your message lands in. They store it; they don’t use it.
Netlify, Inc., our website hosting provider, which serves the site, keeps the technical logs described above, and receives and stores contact form submissions before emailing them to us.
Adobe Inc. and Google LLC, as our font providers. Your browser fetches the site’s type from their servers; they see that request, and nothing else.
Our professional advisers — lawyers, accountants — if a specific matter ever requires it. This has not been routine and we don’t expect it to be.
Law enforcement or a regulator, if we are legally required to hand something over. We would tell you unless we were legally barred from doing so.
A successor, if the business is ever sold or merged. Your information would move with the rest of the business, under this policy, and we would post notice here first.

Each of these is bound by a contract or by law to protect what it holds and to use it only for the purpose we’ve given it.

What we do not do

We think this is as important as the list above, so it gets its own section.

We do not sell your personal information. We have not sold any in the last twelve months, and we have no plans to.
We do not share your personal information for cross-context behavioral advertising or targeted advertising. We have not in the last twelve months.
We do not use your information for profiling that produces legal or similarly significant effects.
We do not run advertising pixels or retargeting tags on this site.
We do not add you to a mailing list because you filled in the contact form. If we ever start a newsletter, you will have to ask for it.
We do not use your inquiry to train AI models.

How long we keep it

We keep information for as long as it is useful for the purpose we collected it, and then we get rid of it. In practice that means we hold on to something while a conversation is live or could reasonably restart, while we have a legal or tax reason to keep it, and no longer.

Here is what that works out to:

Contact form submissions and emails that don’t lead anywhere — Around 24 months after we last hear from you
Correspondence with clients and active prospects — While the relationship is live, then around 7 years — the period we need for tax, contract, and legal record-keeping
Google Analytics user and event data — 14 months. This one is automatic: Google deletes it on that schedule whatever we do
Aggregated analytics reports — visit counts, page popularity, with no individual identifiers — Indefinitely, because they are no longer about any particular person
Server and security logs — A short period set by our hosting provider, typically days to a few weeks

A word about what these numbers are. They are the criteria we work to and the schedule we review against, not a guarantee about any particular email. We are a small firm, and a message occasionally sits in an archived folder past the point where we meant to clear it. When we find it, we delete it. We tell you this because we would rather describe how we actually work than promise a precision we can’t audit.

What you can count on: if you ask us to delete something, we do, within the time limits in Section 8, unless a law requires us to keep it. That request is the reliable route, and it is open to you at any time.

Where your information goes

We are a US business and our systems are in the United States. If you contact us from outside the US, your information will be transferred here and stored here.

For visitors in the UK and EU, that transfer needs a legal safeguard. Google, our analytics provider, certifies under the EU-U.S. Data Privacy Framework and its UK Extension, and relies on the European Commission’s Standard Contractual Clauses where the framework doesn’t cover a transfer. Our email, hosting and font providers are under equivalent arrangements.

If you want copies of the safeguards we rely on, email us and we will send them.

Your choices and your rights

Things you can do right now, without asking us

Turn off analytics in your browser. Install Google’s opt-out add-on at tools.google.com/dlpage/gaoptout, and Google Analytics stops collecting your activity on this and every other site.
Clear or block cookies in your browser settings. Every major browser lets you do this, and blocking ours won’t break anything on this site.
Send a Global Privacy Control or Do Not Track signal. Some browsers and extensions broadcast an automatic opt-out. If yours does, Google Analytics never loads on this site, wherever you are. We don’t sell or share personal information, so there is nothing else for it to switch off.
Stop emailing us. We only have what you send us.

Rights you can exercise by writing to us

Depending on where you live, privacy law gives you some or all of the following. Some of these laws may not apply to a firm our size. We’d rather not make you work out which ones do, so we offer all of them to everyone who asks.

You can ask us to:

Tell you what we hold — the categories of personal information we’ve collected about you, where it came from, why we collected it, who we’ve disclosed it to, and the specific pieces themselves.
Give you a copy in a portable, machine-readable format, or send it directly to someone else where that’s technically feasible.
Correct anything wrong.
Delete it.
Restrict what we do with it while we work out a disagreement.
Object to our use of it where we are relying on legitimate interests. If you object, we stop unless we have compelling grounds that override yours — and on a marketing website, we usually won’t.
Withdraw consent you have given, at any time. That doesn’t undo what we did before you withdrew it.
Opt out of any sale, sharing, targeted advertising, or profiling. We don’t do these, so there is nothing to opt out of — but the right is yours regardless.
Limit our use of sensitive personal information. We don’t use it for anything beyond replying to you, so this changes nothing — but again, the right is yours.

And we will never deny you a service, charge you a different price, or give you a worse experience because you exercised any of these rights.

How to make a request

Email hello@workwithagency.co with the word “Privacy” in the subject line, or use the contact form on this site. Those are both fine; pick whichever is easier.

Tell us what you want and give us enough detail to find you — usually the email address you used when you contacted us. We may ask a question or two to confirm you are who you say you are, because handing your information to the wrong person would be worse than a slow reply. We use anything you send for verification only, and then we delete it.

If someone is acting for you. An authorized agent can make a request on your behalf. We will ask for written permission signed by you, and we may ask you to confirm it directly.

How long we take. We aim to reply within 45 days. If a request is complicated we may take up to another 45 days, and we will tell you why before the first 45 are up. For requests under UK or EU law, we reply within one month and may extend by two months for complex requests, telling you why.

Free of charge, unless a request is clearly excessive or repetitive — in which case we will tell you the cost before doing anything, and you can withdraw.

If we say no

We will tell you why in writing.

If you are in the US, you can appeal. Reply to our decision and say you are appealing. A different person will look at it, and we will respond within 45 days with our conclusion and the reasoning behind it. If we still say no, we will give you a link to submit a complaint to your state attorney general.

If you are in the UK or EU, you can complain to your data protection authority. In the UK that is the Information Commissioner’s Office at ico.org.uk. In the EU it is the supervisory authority in the country where you live or work. You can do this whether or not you come to us first, though we would appreciate the chance to fix it.

Children

This website is for people doing business with a consultancy. It is not directed at children, and we do not knowingly collect personal information from anyone under 16.

We have no actual knowledge of having sold or shared the personal information of anyone under 16, because we don’t sell or share anyone’s.

If you believe a child has sent us something, email hello@workwithagency.co and we will delete it.

How we protect it

We keep access to the inbox limited to the people who need it, we use multi-factor authentication on the accounts that hold your information, and we work with established providers who encrypt data in transit and at rest.

No system is perfect and we won’t claim otherwise. If a breach ever affected your information, we would notify you and the relevant regulators as the law requires.

If we add new tools

We may add a customer relationship management system, an email newsletter, or scheduling software as the business grows. If we do, we will update this policy before those tools start collecting anything, change the date at the top, and describe plainly what the new tool does. If a new tool would require your consent, we will ask for it rather than assume it.

We will not quietly repurpose information you gave us for one reason into something you didn’t sign up for.

Changes to this policy

We review this page at least once a year and update it whenever our practices change.

The effective date at the top tells you which version you’re reading. If a change materially affects how we handle information we already hold about you, we will make more noise about it than a quiet date change — we will post a notice on this page, and email you where we reasonably can.

Getting in touch

Privacy questions, requests, and complaints all go to the same place:

Email: hello@workwithagency.co
Or: the contact form on this website

A person will read it.

Governing law

This policy is governed by the laws of the State of New York, without regard to its conflict of laws rules. Nothing here limits any right you have under the privacy law of the place where you live, and where that law gives you more than this policy does, that law wins.

Accessibility

We want everyone to be able to read this site and reach us, including people who use a keyboard instead of a mouse, a screen reader, magnification, or other assistive technology.

The standard we work to

We aim to meet the Web Content Accessibility Guidelines (WCAG) 2.1 at Level AA, the standard published by the World Wide Web Consortium.

What we have built in

Keyboard. Every link, button, and form field can be reached with the Tab key, and shows a visible outline when it has focus. A Skip to content link comes first on every page.
Screen readers. Pages are organized with headings and landmarks, images carry text descriptions, and the contact form’s fields are labeled and announce their errors.
Zoom. On a computer, browser zoom enlarges the text to 200% and beyond, and the page rearranges into a single column. On phones and tablets, pinch to zoom.
Motion. If your device is set to reduce motion, the scroll animations are replaced by still versions of each scene. The one thing that moves on its own, the strip of client logos, has a pause control.
High contrast. A high-contrast mode darkens the type on the site’s colored backgrounds. If your phone or computer is set to increase contrast, we turn it on for you automatically, and you can switch it on or off yourself below. The site also works with the high-contrast themes in Windows.

How we check

We test with automated checkers and by hand: with a keyboard alone, at browser zoom, with a screen reader, and in high-contrast mode, in current versions of Chrome and Safari. We last reviewed the site in September 2026.

Tell us about a barrier

While we aim to make our site accessible for all, it may not be fully accessible for everyone. If the site is not accessible for you in any way, please email hello@workwithagency.co with “Accessibility Suggestion” in the subject line.

We will try to reply to you in a reasonable amount of time. We’ll continue to review the site regularly and fix what we find.

This statement was last updated September 25, 2026.