Privacy Policy

The short version

If you only read one part, read this.

• The contact form on this site asks for three things: your business name, your email, and your phone. The longer intake form at craftandsite.com/start asks for a lot more, and it has its own section below.
• There is no Google Analytics, no Meta pixel, and no advertising tracker anywhere on this site. I do use Cloudflare Web Analytics, which counts page views without cookies and cannot follow you anywhere else.
• I never sell your information and I never hand it to advertisers.
• I never save your IP address next to your message.
• One person reads what comes in through this site. That is me.
• Email hello@craftandsite.com and I delete what I hold about you, apart from paid invoices and tax records I am required to keep. No forms, usually the same week.

What the contact form collects

Three fields. Your business name and your email are required. Your phone is optional.

The form also records a few things you do not type. The date and time. Which page or tool you came in through. If you landed on a page built for a specific line of work, salon or restaurant or contractor, it records which one. And it records your browser's user agent string, which is the line every browser sends saying what browser and device it is. I keep that to spot bots and abuse.

If you came in from one of my free previews, the form also carries a short code that ties your message to the preview you were looking at, so I know which one you meant.

I use all of it to reply to you, answer your questions, and quote your project. It travels over an encrypted connection into my own system, called Atlas, which stores it in a hosted database run by a company called Supabase. When the form writes to its own error log it masks your email address rather than printing it in full. Your message itself does end up in full in that database and in my inbox, because that is how I answer you.

The form also has a hidden field a real person never sees. Bots fill it in. If it comes back filled, I throw the whole thing away.

Your IP address

An IP address is the number your internet connection uses. It can point roughly at your town, not at your door.

I never save it next to your message. The code has nowhere to put it.

It is sent to Cloudflare so their bot check can decide whether you are a person. Without that check the form would be buried in spam inside a day.

Your IP is also visible to Cloudflare because they host and protect the whole site, the same way it is visible to any web host, and it reaches Google whenever a page loads its lettering. Both of those are listed below.

The free preview tool and the before and after tool do count requests against your IP so one person cannot run them a hundred times. Those counters hold nothing but a count and they clear themselves within a day. The identifier that travels on to my own system is a scrambled code built from your IP plus a secret that changes every night, so yesterday's code can never be matched to today's.

The preview tools

The free preview tool asks for your business name, your city, and what kind of business you run. That does come to me, because that is what the preview is built from. It also carries the scrambled code described above and your user agent string.

If you then ask me to send you that preview, the request goes through the same contact form and adds your email and phone.

The finished preview card itself is kept by your own browser so you do not lose it if you click away and come back. That copy disappears when you close the tab and it never reaches me.

If you type your current website address into the before and after tool, that address is sent to Cloudflare's browser service, which loads the public page and sends back a picture of it. The picture is held at Cloudflare's edge for a day so the same address is not photographed twice. I never ask for a login to your site and I only ever load a page anyone else could load. This tool is not always switched on.

If you used the form at craftandsite.com/start

That is the long intake form, and since 25 August 2026 it lives on this website rather than on Google. It asks for your business name, your own name, your best phone and email, your address or service area, your hours, what your business does, your services or menu, what you are known for, the feel and colors you want, a website you like, the booking or ordering or payment tools you already use, your current website, your Google, Instagram and Facebook pages, whether you have a logo and photos, and anything else you want to tell me. Only the business name and an email are required.

I ask for that much so I can actually build your site and quote the work honestly, rather than guessing and coming back with questions. Your answers are sent to my own email inbox and recorded as a lead in my own system. They are not sold, not shared, and not used for advertising.

Before that date the same address sent you to a Google Form instead, and those older answers are still stored in Google under my account, subject to Google's privacy terms as well as this page. Ask me and I will delete them.

I still use that Google form for one thing: if you are already a client, I sometimes send you a pre-filled link to it to collect the content for your build. If that matters to you, say so and I will take your details a different way.

The booking demo

On my portfolio page and my salon pages there is a booking box you can try. It is a real, working booking system, not a picture of one. It runs from my own Cloudflare account and its appointments are stored in a database I control.

It is walled off from the rest of the page and it is not told which page you came from.

If you type a name, email, or phone number into it and book a slot, that is a real appointment record in my system. So please do not put anything in it you would not want me to have. If you booked one by accident, email me and I will delete it.

Who else sees anything about you

Here is every company that touches something, and exactly what each one gets.

• Cloudflare hosts this site, runs the bot check, counts the page views, serves the booking demo, and holds the short lived rate counters. Every visit passes through their network, so they see your IP address the way any web host does. If you use the before and after tool, their browser service also loads the address you typed so it can take the picture.
• Supabase runs the hosted database your message lands in. They hold it on my instructions and do nothing else with it.
• Google sees more than the fonts. Every page loads its lettering from fonts.googleapis.com and fonts.gstatic.com, so Google sees your IP whenever a page loads, even if you never type a thing. Google also holds the intake form at craftandsite.com/start, which is a Google Form, and the hello@craftandsite.com mailbox, which is Google Workspace. So if you fill in that form or email me, what you wrote sits in Google's systems as well as mine.
• Stripe handles payments and invoices. If you become a client, Stripe gets your name, your email, and your card details. Project invoices are one off: you pay them by card and nothing is saved or charged again. A Care plan is a subscription, so if you take one, Stripe does save your card and charge it until you cancel. Care is $59 a month or $590 a year and Care+ is $89 a month or $890 a year, in US dollars, and you can cancel any time by emailing hello@craftandsite.com. I never see or store a full card number. I see your name, the amount, whether it paid, and the last four digits. Refunds and cancellations are at craftandsite.com/refunds and the full terms are at craftandsite.com/terms.

The one thing I do measure

I use Cloudflare Web Analytics. It tells me how many people looked at a page and roughly where in the world they came from. It sets no cookie, it does not fingerprint your browser, it does not build a profile of you, and it cannot follow you to another website.

It is switched on in my Cloudflare account rather than written into the code of this site, so a small script loads from static.cloudflareinsights.com on every page. That is the only measurement of any kind here.

What I do not do

Checked against my own code and the live site on August 23, 2026.

• No Google Analytics, no Meta pixel, no retargeting, no advertising tracker. The one measurement tool is Cloudflare Web Analytics, described above.
• I never sell your information, I never rent or trade it, and I never hand it to advertisers or data brokers. If the studio were ever sold or handed to someone else, your files would go with it, whoever takes over would be held to this same page, and I would tell you before it happened.
• No software scores you, sorts you, or decides anything about you on this website. A person reads every message that comes in. That person is me. If I ever bring in help to answer messages, they see only what they need to answer you and they are held to this page.

Cookies, and what sits in your browser

I set no cookies of my own, and on a normal visit this site puts nothing in your browser at all.

Two of my tools remember one thing in your browser's own storage so you do not lose your place. That is erased when you close the tab and it never reaches me.

The bot check and the booking demo run inside their own frames from Cloudflare, and they may set their own storage. Cloudflare may also set a security cookie to tell real visitors apart from bots. I do not control those and I do not read them.

You can see the full list in your browser's settings at any time.

If I contacted you first

Sometimes I reach out to a local business that has no website, or an old one. When I do, what I hold is the contact information a business publishes about itself: the business name, the trade, the town, the public phone, the public email, and the public website. I collect it from public listings. I do not buy lists, and I hold nothing about you personally beyond what your business publishes.

If you would rather not hear from me, reply to the email or write to hello@craftandsite.com and say stop. I take you off the list within ten business days, usually the same day, and I will not contact you again.

How long things are kept

Nothing sits around forever.

• Messages and preview requests: kept while we are talking, and cleared out periodically after that. Ask me to delete yours at any point and I do it that week.
• The short lived rate counters: they clear themselves within a day.
• The scrambled codes stop being useful after a day, because the secret they are built from changes every night.
• Client project files, signed quotes, and paid invoices: kept seven years, because tax and business records have to hold up.
• Stripe and Google keep their own records under their own policies, and I cannot delete those for you.

How to see it, fix it, or have it deleted

Email hello@craftandsite.com. That is the way to make any request, and it comes straight to me.

Tell me what you want. A copy of what I hold. A correction. Deletion. Or just tell me to stop contacting you.

I confirm I have your request within a few days and finish it within forty five days. If you are simply telling me to stop contacting you, I do that within ten business days and usually the same day.

I may ask you one question first, to be sure you are the person who sent the message.

Children

This is a site for business owners. It is not aimed at children and I do not knowingly collect anything from anyone under 13. If you believe a child sent me something, email me and I will delete it.

If you live in Virginia

You get these rights here no matter what the law says. Ask me what I hold about you, get a copy, correct it, delete it, or tell me to stop contacting you. Email hello@craftandsite.com.

Virginia has a privacy law called the Consumer Data Protection Act. It is written for companies handling data at a scale I am nowhere near, and most of what I hold is business contact information you gave me in a business context, which the law treats differently. I am not going to argue about whether it reaches me. You get the rights either way.

I do not sell data, I do not use it for ads, and I do not profile anyone, so there is nothing here for you to opt out of.

If I ever turn a request down, reply and ask me to look again and I will. Tell me what I got wrong and I will fix it. You can also contact the Virginia Attorney General.

If you are outside Virginia

If you are covered by the California or European privacy laws and you want your information removed, email me and it is gone. No argument, no forms.

California's law is aimed at businesses over twenty five million dollars in revenue, or handling a hundred thousand people's data, or making half their money selling it. None of those is me. The European rules are aimed at businesses that offer goods or services to people in Europe or track them there, and I build websites for businesses in Virginia. So neither one is written for a studio this size. That does not change what you can ask for.

Security

Everything between your browser and this site is encrypted. That is the padlock in your address bar. Your message is encrypted on the way to me too, and when the form writes to its own error log it masks your email address.

If the bot check cannot confirm you are a real person, nothing goes through at all. It is built to block rather than let things slide.

If I ever have a security problem that involves your information, I will tell you, as Virginia law requires.

Nobody can promise perfect security, and I am not going to pretend otherwise.

Changes to this page

If what I do changes, I change this page and change the date at the top. I will not quietly start collecting something new and leave this page saying otherwise.

Some of what this page describes is switched on and off in a dashboard rather than written into the code of the site, so I check this page against the live site every three months, and after any change I make to the site.

This page explains what I do with information. It is not a contract and it does not change the written quote or agreement for any project. Virginia law governs it.

Questions about any of this, email hello@craftandsite.com or call (757) 739-0945.

Craft & Site, a trading name of Deliberate Services LLC. 1564 Laskin Road, Virginia Beach, VA 23451.

This page took effect August 23, 2026.