Privacy Policy

1. Information we collect

• Contact & business information you enter into our intake and quote forms — for example your name, business name, email address, what your business does, and what you want built. This is the core of what you give us and it may include whatever details you choose to add.
• Account information if you create an account — your name, email, and a password (stored only as a secure hash; we never see it in plain text). Authentication is handled through Supabase.
• Payment information. Payments are processed by Stripe. Your full card number never touches our servers. We receive limited, non-sensitive details from Stripe such as the amount, a payment or customer identifier, the email on the receipt, and whether a payment succeeded.
• Consent records. When you accept our Terms at checkout, we record the terms version and a timestamp with your order so we can show what you agreed to.
• Usage & device data. Pages visited, approximate location from IP, referral source, timestamps, and similar analytics, collected to understand and improve the Site.
• Cookies & similar technologies — see Section 6.

Our Services are for businesses; please do not send us sensitive categories of personal data (such as health, biometric, or government-ID information) unless we specifically request it for a deliverable.

2. How we use your information

• To provide, deliver, and support the Services you request.
• To process payments, prevent fraud, and send receipts.
• To generate and refine deliverables (which may involve AI processing — see Section 3).
• To communicate with you about your account, orders, and support requests.
• To operate, secure, analyze, and improve the Site and Services.
• To send marketing communications where permitted — you can opt out at any time (Section 7).
• To comply with law and enforce our Terms.

3. Sub-processors and third-party services

We share information with the service providers below strictly to run the Services. Each processes data under its own terms and privacy policy.

We may also disclose information to comply with law, respond to lawful requests, protect our rights, or in connection with a business transfer (such as a merger or sale). We do not sell your personal information and do not share it for cross-context behavioral advertising in exchange for payment.

4. Data storage and security

Data is stored with Supabase and Vercel. Connections are encrypted in transit (TLS), passwords are stored only as secure hashes, and card processing is handled entirely by Stripe, a PCI-DSS compliant processor. No method of storage or transmission is 100% secure, so we cannot guarantee absolute security.

5. Data retention

We keep personal information for as long as your account is active or as needed to provide the Services, and afterwards as needed to meet legal, tax, accounting, fraud-prevention, and record-keeping obligations (for example, transaction and consent records). Aggregated or de-identified data that no longer identifies you may be kept indefinitely. When you ask us to delete your account, we remove or de-identify your personal data within a reasonable period (typically within 30 days), except records we must retain by law.

6. Cookies and Do-Not-Track

We use cookies and similar technologies for: essential purposes (authentication and session security); analytics (Vercel Analytics, which is designed to be privacy-friendly and does not use cross-site advertising cookies); and advertising measurement(the Meta Pixel, which helps us measure and improve our own ad campaigns). You can control cookies through your browser settings; blocking essential cookies may break parts of the Site. Because there is no common industry standard, we do not currently respond to browser “Do-Not-Track” signals, but we honor recognized opt-out preference signals where required by law.

7. Marketing email and your choices

We send transactional emails (receipts, account and project updates) that are part of the Services. We may also send marketing emails. In line with the CAN-SPAM Act, every marketing email identifies us, includes our physical mailing address, and has a clear unsubscribe link — you can opt out at any time and we will stop sending marketing email promptly. You can also opt out by emailing owner@elevarestudio.co. Opting out of marketing does not stop transactional messages you need to use the Services.

8. Your privacy rights

Depending on where you live, you may have some or all of the following rights. To exercise any of them, email owner@elevarestudio.co. We will verify your request and respond within the time the law allows, and we will not discriminate against you for exercising a right.

California (CCPA/CPRA)

• Know what personal information we collect, use, and disclose.
• Access a copy of your personal information and request deletion.
• Correct inaccurate personal information.
• Opt out of “sale” or “sharing” of personal information — we do not sell or share your personal information as those terms are defined, so there is nothing to opt out of, but you may still contact us.
• Limit use of sensitive personal information (we do not use it for such purposes).

EEA / UK (GDPR)

Our Services are directed to U.S. businesses, but if you are in the EEA or UK you may have rights to access, correct, delete, restrict, or object to processing, and to data portability. Where we rely on consent, you may withdraw it at any time. Our legal bases are typically performance of a contract, our legitimate interests in operating and improving the Services, consent (for certain marketing/cookies), and compliance with legal obligations.

9. Children

The Site and Services are intended for businesses and adults. They are not directed to children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has provided us information, contact us and we will delete it.

10. Data from your own website’s customers

If we build or host a site for you, your customers’ personal data (from contact forms, bookings, or orders) belongs to you and you are the controller of it. You are responsible for giving your customers a privacy notice and honoring their rights. We process that data only to run your site on your behalf.

11. Changes to this policy

We may update this policy from time to time. When we do, we will change the “Last updated” date and version above, and material changes will be posted here.

12. Contact

For privacy questions or to exercise a right, contact Elevare Studio LLC at owner@elevarestudio.co, 143 Dewey Avenue, Groton, CT 06340.