Privacy Policy

[Selatos]

My employer wants the privacy policy for the website I am coding for them to read as follows:

Privacy Statement

For each visitor to our Web site, our Web server automatically recognizes no information regarding the domain or e-mail address. We collect the e-mail address of those who communicate with us via e-mail, aggregate information on what pages consumers access or visit, user specific information on what pages consumers access or visit and information volunteered by the consumer, such as survey information and/or site registrations.

The information we collect is used for internal review and is then discarded, used to improve the content of our Web page, used to customize the content and/or layout of our page for individual consumer and used by us to contact consumers for marketing purposes.

If you do not want to receive e-mail from us in the future, please let us know by sending an e-mail or writing and telling us that you do not want to receive e-mail from our company.

yet, because they don't understand that i use IP tracking in a few of the scripts, that can't be entirely true. I was wondering if domain and IP are the same, and if they have similarities, can i still keep track of user IPs and say i am NOT tracking domains?

I'm relatively new, and not afraid to admit it, and i thought i'd turn to the best for help.

[bvarvel]

Well it's kinda like lying through obscurity. Most non-technical users will assume that no information is indeed being collected but since it specifically states:

"no information regarding the domain or e-mail address"

technically your not collecting domain or email information. you're just collecting other information and not specifically mentioning it. it's a questionable practice at best, and if anyone really wanted to legally contest it, I don't imagine they would have much problem doing so.

[Selatos]

ok well i have been in contact with them over the past few minutes and we have changed a few lines to read as follows:

For each visitor to our Web site, our Web server automatically recognizes no information regarding the domain or e-mail address, with the exception of IP addresses which will be used for the sole purpose of user tracking.

Is there less lying involved there?

[bvarvel]

I think you're probably a little better coverered there. However - people tend to be a little leary of being tracked, - in one of our privacy policy we mention that the IP addresses are only recorded to protect the site (i.e. hackers attacking the site)

[Selatos]

should i make it clear that its for use with the shopping cart?

Let me further explain my choices for the shopping cart. As far as i know, most people use sessions or cookies for their shopping carts. immediately i ruled out cookies, because some people dont accept cookies for fear of hackage, and other have different reasons for not accepting them. Sessions dont like me very much, so i decided to try something new. I developed a way to use IP addresses and MySQL databases to store shopping carts. combined with a shopping cart object, i created my own personal shopping cart, which i like, although i havent gotten all of the bugs out yet. i suppose this isnt the topic of the forum, but does anyone see anything that is fundamentally wrong with this idea?

[bvarvel]

I can see one problem right off the bat. What if you have several users that work from behind a firewall with a shared net connection. To the outside world, they all appear to have the same IP address (the one from the router that connects their network to the internet). For example, I do consulting work for Xerox... they have thousands of users across the country... as far as the internet is concerned though, they all come from one of six IP addresses. just food for thought!

[Selatos]

thanks for the insight. The problem mysteriously dissapears when you register because of the way i designed it, the object uses your IP if you arent registered. if you logged in with a user name(I DID use sessions for this, because its about as far as i trust them)then that is substituted for your IP address. The only purpose of using IPs is for people that dont have time to fully register....and because my employer insisted on letting people purchase stuff without registering......unfortunately, its my sister, so i cant just tell her that this NEEDS to happen, or something else NEEDS to be done differently....i need a spine....

[bvarvel]

Well if she insists that it must be done this way, then it's ultimately her problem. I guess she's going after the impulse purchase and doesn't want to lose sales because of a rigorous registration process. I guess in this situation what you're doing is about all you can do. Keep in mind though that this may cost her money in the long run if she starts getting a bunch of chargebacks. good luck! i know where you're coming from.

[Selatos]

the fact of the matter is that they still need to supply almost all of the information that would be taken by the registration process, so its not saving too much time. i might add a checkbox to the end of the form saying "register as a user to save important information for quick purchasing in the future"