Who we are
Web Design Awards (“we”, “us”, “our”) is operated by Higglo Digital LLC and recognises outstanding work across web, product, and brand at webdesignawards.io - including our agency directory, project-brief matching, certifications, and jobs board. This Privacy Policy describes the personal data we collect, including data about people who have never created an account, how we use it, who we share it with, and the rights you have. For privacy questions, contact mike@webdesignawards.io.
Information we collect
- IdentifiersEmail address, username, and a bcrypt-hashed password. If you sign in with Google or GitHub, we receive a provider ID, your name, and your email from that provider. We also support passwordless “magic link” sign-in by email; a verified link used to claim an agency listing can automatically create an account or grant the agency role for that email address.
- ProfileOptional first name, last name, timezone, bio, title, affiliation, and profile image URL. If you have a public profile page, your display name, username, bio, role, submission activity, and a local time derived from your timezone are visible to anyone.
- Billing profileIf you make a purchase, we retain a Stripe customer ID and any billing details you enter (company name, legal name, tax ID, billing address). Card data is handled by Stripe - we never see or store card numbers.
- Roles and accessYour account role (individual, company, agency, judge, editor, admin) and the timestamp of your last global logout.
- Saved activityNominees you mark as a favorite, linked to your account and visible only to you.
- Entry detailsProject name, website URL, description, categories, tech stack, and the agency or studio behind the work.
- Contact dataSubmitter email, applicant email, and (when relevant) client email.
- MediaThumbnail and full-size images you upload, stored on Cloudflare R2.
- Social linksOptional Instagram, X/Twitter, TikTok, Facebook, and YouTube URLs you provide for the entry.
- Judging recordsScores assigned by judges across design, UX, performance, accessibility, and other criteria, plus winner and Site of the Month status.
- Brief detailsIf you submit a project brief through Get Matched, we collect your name, email, phone number, company name, company website, and project details (budget, timeline, industry, description), plus your IP address and browser user agent for spam prevention.
- Shared with a matched agencyWhen an agency pays to unlock your brief, we send your full contact details and project description to that agency so they can reach out to you directly. That agency's own use of your information is governed by its own privacy practices, not this policy.
- Your choiceSubmitting a brief is optional. Email mike@webdesignawards.io at any time to have an unmatched brief removed, or to stop it being offered to further agencies.
- Claim requestsIf you claim an agency listing, we collect the email, name, and message you provide, plus your IP address and browser user agent for verification and abuse prevention. We verify claims by matching your email domain to the agency's website or, failing that, by manual review and a one-time emailed code.
- Directory sourcingSome agency listings are compiled from public sources - agency websites and public directories such as Clutch, DesignRush, G2, Dribbble, and Awwwards - including a business contact email where publicly listed. We use Anthropic's Claude API to help structure this public information into a listing. Listed agencies can ask us to update or remove a listing at any time.
- Outreach to compiled listingsWe may email agencies compiled this way to invite them to claim or upgrade their listing. These emails include a working unsubscribe/delist link.
- Outreach to prospective entrantsTo invite designers and agencies recognised on similar industry sites to submit their own work, we may look up a business's publicly associated contact (name, job title, business email) using third-party contact-data providers such as Lusha, or from the business's own public website, and send a one-time invitation. Reply or email mike@webdesignawards.io at any time to stop future outreach.
- Job postingsEmployers who post a job provide a company name, company website, contact email, job details, and how to apply (an email address or an external link). This is displayed publicly on the listing.
- Website and design reviewsIf you purchase a website review, SEO certification, or web design certification, we collect your email, company name, and website URL to carry out and deliver the review.
- Company spotlightIf you purchase a spotlight placement, we collect a purchase email (kept private) and the company profile you provide - tagline, bio, website, logo, client logos, and stats - which is displayed publicly for the sponsored placement.
- Subscription recordEmail address, signup timestamp, referer, source, status (active/bounced), and a unique unsubscribe token.
- AttributionUTM parameters (source, medium, campaign, term, content) captured at the moment you subscribe.
- Anonymous voter IDAn “anon_id” cookie is set so we can prevent duplicate votes. We do not link this to your identity unless you are signed in.
- Message dataName, email, message body, optional website URL, and topic.
- Request metadataSubmission timestamp, referer, IP address, and user agent. Used for spam filtering and abuse prevention.
- Comment contentIf you leave a comment, we store the text, your display identity (your account username and image if signed in, or the name you enter if posting without an account), your IP address, and its moderation status. Comments are public once approved and are also governed by our comment policy.
- Analytics eventsPageviews, navigation, and product events (e.g. signups, submissions, completed purchases).
- IdentifiersA persistent visitor ID and a 30-minute session ID stored in your browser, plus saved attribution data.
- Technical signalsIP address, browser, device, operating system, and referrer.
- Crash and error reportsIf the site hits a client-side error, we may email our engineering team a report containing the error message and stack trace, the page you were on, and your IP address and browser/user agent - used only to fix bugs, not for tracking.
How we use your information
- Run the serviceCreate and authenticate accounts, accept and judge nominee submissions, host the awards archive, and tally votes.
- Process paymentsTake payment for premium nominations, rushed judging, certifications, job postings, and other paid features via Stripe, and email receipts.
- Match and referShare project brief details with paying agency partners so they can contact you about work you're looking for.
- Reach prospective entrantsIdentify and invite designers, studios, and agencies recognised elsewhere to submit their own work or list their agency.
- CommunicateSend transactional emails (confirmations, password resets, judging updates) and - if you subscribed - our newsletter. You can unsubscribe at any time.
- Improve the productAnalyse aggregated usage so we can make pages faster, content better, and the submission flow clearer.
- Protect the serviceDetect spam, rate-limit abusive traffic, prevent duplicate voting, and investigate security issues.
- Comply with lawMeet tax, accounting, and other legal obligations, and respond to lawful requests.
Legal bases (UK / EU users)
If you are in the UK or EEA, we rely on the following lawful bases under the UK GDPR / GDPR:
- ContractCreating your account, processing submissions, fulfilling purchases, and providing support.
- Legitimate interestsSecuring the service, preventing fraud and abuse, measuring traffic, improving the product, and reasonable B2B marketing to businesses and professionals such as inviting agencies to list or submit work - balanced against your rights, and you can object at any time.
- ConsentMarketing emails and any other optional communications or features that specifically ask for permission. You can withdraw consent at any time.
- Legal obligationRetaining payment and tax records for the periods required by law.
Service providers and sub-processors
We use the following processors to operate the site. Each is bound by their own terms and privacy policy, and we share only what each one needs to do its job.
- MongoDB AtlasDatabase hosting for accounts, submissions, newsletter records, and judging data.
- StripePayment processing, checkout, and billing. Card details go directly to Stripe.
- ResendSends transactional emails (account, judging, receipts) and the newsletter.
- Cloudflare R2Object storage for images you upload with a nominee entry.
- VercelApplication hosting.
- Google Analytics 4Page and event analytics. Analytics starts automatically when you visit the site.
- Upstash RedisCaching and rate limiting (e.g. throttling abusive newsletter signups).
- Google & GitHub OAuthOptional sign-in providers. We receive your provider ID, name, and email when you choose to sign in with them.
- Anthropic (Claude)AI processing used to help draft blog content and press releases, and to help structure publicly available information into agency directory listings.
- LushaA B2B contact-data provider we use to find publicly-associated business contacts when inviting designers and agencies who aren't yet on the platform.
International transfers
Our processors operate in the United States and the European Union, so personal data may be transferred to and processed in those regions. Where required, we rely on Standard Contractual Clauses, the UK International Data Transfer Addendum, or equivalent safeguards offered by each provider.
Data retention
- Account dataHeld for as long as your account is active. Deleted on request - see “Your rights”.
- Nominee submissionsRetained as part of the public awards archive even after account deletion, since the archive is a historical record. Personal contact fields (applicant/client emails) are removed on request.
- Project briefsUnmatched briefs are kept while we are actively trying to find you a match, then deleted; briefs that have been unlocked by an agency are kept as a record of that transaction.
- Newsletter recordsHeld until you unsubscribe. Unsubscribed records are kept briefly to honour the opt-out.
- Payment and tax recordsRetained for the period required by law (typically up to seven years).
- Server logs and analyticsAggregated or rotated on a rolling basis (typically 30-90 days for raw logs).
Data security
We protect your data with HTTPS in transit, bcrypt-hashed passwords, scoped credentials for each service, rate limiting, and access controls on administrative endpoints. Images you upload are re-encoded before storage, which strips embedded metadata such as EXIF location data. No system is perfectly secure, so we cannot guarantee absolute security, but if we become aware of a breach affecting your data we will notify you and the appropriate regulators as required by law.
Your rights
Depending on where you live, you have some or all of the following rights over your personal data:
- AccessRequest a copy of the personal data we hold about you.
- CorrectionAsk us to fix anything that is inaccurate or incomplete.
- DeletionAsk us to delete your account and personal data. Some records (e.g. tax) must be kept by law.
- PortabilityReceive your data in a structured, machine-readable format.
- Object or restrictObject to or restrict processing based on our legitimate interests, including direct marketing.
- Withdraw consentWithdraw marketing consent at any time - it does not affect the lawfulness of prior processing.
- Object to analyticsObject to analytics processing based on our legitimate interests by contacting us, and use browser controls to block or clear analytics cookies and storage.
- Opt out of outreachIf we've contacted you as a prospective agency or entrant using publicly sourced or third-party contact data, reply or email mike@webdesignawards.io to stop future outreach.
- ComplainLodge a complaint with your local data protection authority (e.g. the UK ICO or your EU member-state regulator).
California residents have additional rights under the CCPA/CPRA, including the right to know, delete, correct, and opt out of the “sale” or “sharing” of personal information. The one place payment is connected to personal information is our project-brief matching service (see “Sharing your information”): when an agency pays to unlock a brief, that may be considered a “sale” or “sharing” of the submitter's contact details under California's broad definitions. We do not otherwise sell or share personal information with advertisers or data brokers. To opt out of brief-sharing, don't submit a project brief, or email us to remove an unmatched one; to exercise any other right, email mike@webdesignawards.io - we will respond within the timeframes required by applicable law.
Account deletion
You can delete your account at any time from your account settings or by emailing mike@webdesignawards.io. Deletion permanently deletes your account record - profile, login credentials, and saved contact details - from our database; this cannot be undone. Submissions that have already been published in the awards archive remain visible as a historical record; on request we will remove personal contact fields (applicant and client emails) from those entries. An open project brief that hasn't been matched is deleted along with your account; a brief already unlocked by an agency may remain in that agency's own records outside our control.
Automated decision-making
Award decisions are made by human judges. We do not use automated decision-making or profiling that produces legal or similarly significant effects on you.
Children’s privacy
Our services are not directed to anyone under 16. We do not knowingly collect personal information from children. If you believe a child has given us their information, contact mike@webdesignawards.io and we will delete it.
Changes to this policy
We may update this Privacy Policy as the product evolves or the law changes. The “Last updated” date at the top of this page reflects the latest version. For material changes we will post a notice on the site and, where appropriate, email registered users.
Contact us
Questions, requests, or complaints about this policy or your data: mike@webdesignawards.io. We aim to respond within 30 days.