Data, Analytics & Privacy

Recording when a visitor completes something that matters — a call, a form, a booking, a purchase. Without it you are measuring traffic, which says nothing about whether the site earns its keep.

In practice Traffic up 40% and calls flat is a real and common outcome. Only conversion tracking makes that visible before you renew the contract.

Asking visitors for permission before running non-essential tracking. Required in the EU and UK and increasingly expected under US state privacy laws.

In practice Worth handling properly even for a purely local business. Tourism traffic means overseas visitors, and the rules follow the visitor rather than the business.

Unauthorized access to information you hold about customers or staff. Most US states, North Carolina included, require you to notify affected people — so the response plan matters as much as the prevention.

In practice The reportable cost is rarely the stolen data. It is the notification, the remediation, and the local reputation damage that follows.

A security flaw in third-party code your site relies on — a plugin, a theme, a library. It is the most common way small business sites get compromised, and it has nothing to do with anyone targeting you specifically.

In practice Attackers scan the whole internet for one known-vulnerable plugin version. Being small and local is not protection.

Information customers gave you directly — your email list, booking history, service records. As tracking across sites keeps getting restricted, it is the only marketing data you genuinely control.

In practice A clean customer list you own outlasts every platform algorithm change. It is the most durable marketing asset a small business can build.

The current version of Google Analytics, which records everything as events rather than pageviews. It answers what people did on your site — but only for the actions someone deliberately set up tracking for.

In practice Installed and never configured, GA4 tells you how many people visited. Configured properly, it tells you how many of them called.

A vendor fix closing a known flaw. The window between a patch being published and attackers scanning for unpatched sites is short — often days.

In practice Which is why “we update quarterly” is not a maintenance plan. Publishing the patch also publishes the vulnerability.

An automated service checking your site every few minutes and alerting you the moment it goes down. Without it you find out when a customer mentions it — usually well after the money was lost.

In practice A site down over a summer Saturday is a weekend of bookings gone. The monitoring costs a few dollars a month.

Tags appended to a link that tell your analytics where the click came from. They are how you distinguish the postcard from the Facebook post when both send people to the same page.

In practice Free, permanent, and impossible to add retroactively. Tag the link before the campaign runs or the data is simply gone.