1. Two different sets of records
This policy covers what we hold: information about people who buy from us or contact us through this site.
It does not cover the sites we build for operators. When someone fills in a booking form on an operator’s website, that enquiry belongs to that operator, who decides what happens to it. Section 4 explains our limited role there.
2. What we hold about buyers
When you buy
Your name, email address, phone number, business name, service area, and the details you send us for the build. Your payment is processed by Stripe — we never see or store your card number. We receive a confirmation, the last four digits, the amount, and a payment reference.
While you are a customer
Correspondence with us, and any edits you ask us to make on your behalf.
What you enter in your admin panel
Your business details, hours, service area, prices, review text, and the photographs and logo you upload. We store this so your site can display it, in a record tied to your site alone. You can change it yourself at any time. The Reset in your admin returns the site to its demo content and clears what you had entered, and the images you uploaded are deleted with it.
Files we generate for you
The marketing images and flyers your admin produces are stored with your site’s files so you can download them again. They contain only the business details you entered.
3. What we hold about visitors to this site
If you send us an enquiry or join a waiting list, we hold what you typed: usually an email address, a city, and which niche you are interested in.
Our hosting provider keeps standard server logs, including IP addresses, for security and troubleshooting. We do not run advertising trackers, and we do not sell or share anything with data brokers.
4. Data in operators’ sites
Sites we build deliver form submissions directly to the operator by email. We are not a party to that correspondence and do not store those enquiries.
Where a form is routed through an address we control before reaching the operator, the message passes through and is not retained beyond what is needed to deliver it. Operators are responsible for their own compliance with privacy law in the places they trade.
5. Who else touches it
- Stripe — payments and subscription billing.
- Brevo — transactional email (receipts, onboarding, replies).
- Vercel — hosting, server logs, and Vercel Analytics, which counts page views. It sets no cookies, does not follow you to other sites, and does not build a profile of you.
- Supabase — database and file storage for operator site content, uploaded images, waiting lists and customer records.
- Google Fonts — serves typefaces; your browser requests them directly, which discloses your IP address to Google.
Each acts as a processor on our instructions, under its own terms. We do not sell personal information to anyone, for any purpose.
6. What we use it for
To build and deliver what you bought, to take payment, to answer you, to keep records we are legally required to keep, and to tell you about material changes to a service you are paying for. We do not send marketing email to people who have not asked for it.
7. Cookies and browser storage
This site sets no advertising or analytics cookies. We do count page views, using Vercel Analytics, but it does that without cookies and without following you to other sites. The site may use local browser storage to remember interface preferences, such as a language choice. Stripe sets its own cookies during checkout, which are necessary for the payment to work.
8. How long we keep it
Purchase and tax records for seven years, as US record-keeping rules require. Waiting-list entries until you ask us to remove them or the list is retired. Correspondence for as long as it is useful, then deleted.
9. Your rights
Email us to ask what we hold about you, to correct it, to get a copy, or to have it deleted. We will respond within 30 days. Deletion requests are honoured except where we must keep a record for tax or legal reasons, and we will tell you if that applies.
Depending where you live, you may have additional rights under laws such as the CCPA or the GDPR. We apply the rights above to everyone regardless of location, which is simpler than working out who qualifies.
10. Security
Traffic is encrypted in transit. Access to customer records is limited to people who need it. No system is perfectly secure, and we will tell you promptly if a breach affects your information.
11. Children
Nothing we sell is directed at children under 13, and we do not knowingly collect their information. If you believe we have, email us and we will delete it.
12. Where the data lives
Our providers store data on servers in the United States and may replicate it elsewhere. If you are outside the US, your information will be processed in the US.
13. Changes
We may update this policy; the “last updated” date changes when we do. If a change materially affects how we handle your information, we will email active customers.
14. Contact
Kingdom Creatives LLC, Nampa, Idaho — info@kingdom-creatives.com