Draft · not yet in effect

Privacy Policy

DRAFT — REQUIRES OWNER AND QUALIFIED LEGAL REVIEW.

This draft was prepared with AI assistance and is not legal advice. Before it goes live:

• Fill in every [PLACEHOLDER].
• Confirm that each statement matches how Steadline actually operates on the day it is published.
• Have it reviewed by a qualified attorney.

Notes for the owner are in italic brackets. Remove them before publishing.

Effective date: [EFFECTIVE DATE]
Last updated: [LAST UPDATED DATE]

This policy explains what information Steadline collects, why we collect it, and the choices you have.

"Steadline", "we" and "us" mean [LEGAL ENTITY NAME], doing business as Steadline, [POSTAL ADDRESS]. You can reach us at [CONTACT EMAIL].

1. What this policy covers

This policy covers:

• our website at steadlinestudio.com (the "Site");
• the private concept previews and website reviews we prepare for businesses;
• the emails we send;
• the services we provide to clients.

It does not cover the websites we build for our clients. Each client's own privacy policy governs its website. Where we handle data for a client, we follow that client's instructions (see section 9).

Steadline serves businesses. The Site is not intended for children under 13, and we do not knowingly collect information from them.

2. Information we collect

2.1 Information you give us

• Preview and contact forms: business name, current website, your name, email address, phone number (optional), trade, and the city you work in.
• Emails and calls: anything you write or tell us, including replies to our emails.
• If you become a client:
  • billing contact details;
  • your logo and photos;
  • your services and service area;
  • your licence and insurance details if you want them shown;
  • access details you choose to share, such as your domain registrar or Google Business Profile;
  • other content for your website.
• Payments: card and bank payments are processed by Stripe. We do not receive or store full card numbers. We receive limited details from Stripe, such as the last four digits of the card, the card brand, and payment status.

2.2 Information collected automatically

• Form context: when you submit a form, the page you submitted it from is sent with it. So are any campaign tags in the page address (utm_source, utm_medium, utm_campaign, utm_content).
• Server and security logs: our hosting provider, [HOSTING PROVIDER, e.g. Cloudflare], processes technical data to deliver and protect the Site. This includes IP address, browser type, the pages requested and timestamps.
• Fonts: the Site and previews load fonts from Google Fonts. Your browser therefore connects to Google's servers, which receive your IP address and browser information.
• Cookies: see section 6. We do not currently use analytics, advertising or social-media tracking tools. [Owner: if analytics are ever added, update this section and section 6 first.]

2.3 Public business information we research

When deciding whether to contact a business, and when preparing a concept preview, we may collect information that the business has made public:

• business name, business phone, business email address and website;
• city and service area;
• services offered;
• publicly displayed ratings, review counts and years in business.

We record where each item came from. Sources include the business's own website or social page, and public business directories used in line with their terms.

We also load the business's homepage once to check things like mobile layout, security, contact options and speed. We do not submit forms, log in anywhere, or guess email addresses. We do not collect personal home addresses unless the business publishes one as its business address.

3. How we use information

We use it to:

• prepare free concept previews and website reviews;
• contact businesses by email about our services (see section 5);
• reply to inquiries and follow up about previews you requested;
• provide, bill for and support the services clients buy;
• keep the Site and previews secure and prevent abuse;
• keep records we are legally required to keep, honor opt-outs, and enforce our agreements.

We do not sell personal information. We do not share it for cross-context behavioral advertising.

4. Private concept previews

Concept previews are:

• private, at unguessable links;
• marked not to be indexed by search engines;
• labelled as concepts that are not affiliated with or endorsed by the business shown.

They use stock photos, never the business's own photos or logo. They are shown only to that business.

If you would like your preview or your business's information removed, tell us at [CONTACT EMAIL] or reply to our email. We will take the preview down and delete the information within 10 business days. We will usually do it sooner. We keep only what we need to avoid contacting you again (see section 7).

5. Our emails

We send a small number of business emails to companies we think we can help. Every marketing email:

• identifies Steadline and gives our postal address;
• says where we found the address;
• explains how to opt out.

To opt out, reply "no thanks" or anything like it. We stop marketing emails to that address within 10 business days and usually much sooner. We never ask for payment or extra information to opt out. We do not sell, rent or transfer the email addresses of people who have opted out.

Clients may still receive service emails, such as receipts, project updates and security notices, while they have an active agreement with us.

6. Cookies and similar technologies

Do Not Track: we do not track visitors across other websites. The Site does not respond differently to Do Not Track signals, because there is no cross-site tracking to turn off. Apart from the font requests to Google described in section 2.2, we do not allow third parties to collect information about your online activity across sites through our Site.
[Owner: confirm this with counsel. It is a CalOPPA disclosure item.]

7. How long we keep information

[Owner: these periods match the proposed schedule in COMPLIANCE-REVIEW.md §6. Confirm them before publishing.]

8. Who we share information with

We share information only with:

• Service providers that help us run Steadline, under terms that limit their use of the data:
  • hosting and security: [HOSTING PROVIDER];
  • email: [EMAIL PROVIDER];
  • payments: Stripe;
  • e-signature: [SIGNATURE TOOL];
  • text messaging, for client services that include it: [SMS PROVIDER];
  • fonts: Google Fonts.
• Our own systems: our customer records are kept in Steadline's own internal system.
• Legal and safety: when required by law, or to protect rights, safety and security.
• Business transfer: if Steadline is sold or merged, under this policy's protections.
• With your consent.

9. Data we handle for clients

When we build or run a client's website, the client may collect information from its own customers through estimate forms, call or text alerts, review requests or a CRM. We process that information on the client's behalf, follow its instructions, and do not use it for our own marketing. Questions about it should go to the client first. We will help them respond.

10. Your choices and requests

You can ask us to:

• tell you what information we hold about you or your business;
• correct it;
• delete it;
• stop contacting you.

Email [CONTACT EMAIL] or write to [POSTAL ADDRESS]. We may need to confirm your identity before acting. We will respond within [30] days.

Depending on where you live, you may have additional rights under state law.
[Owner: counsel to confirm whether any state privacy law applies at Steadline's size, and add a state-specific section if it does.]

We will not treat you differently for making a request.

11. Security

We use reasonable safeguards, including:

• encrypted connections (HTTPS);
• private, access-controlled preview links;
• limited access to records;
• keeping secrets out of our website code.

No system is perfectly secure. If a breach affects your information, we will notify you as required by law.

12. Changes

If we change this policy, we will update the "Last updated" date. If a change is significant, we will tell clients by email before it takes effect.

13. Contact

[LEGAL ENTITY NAME], doing business as Steadline
[POSTAL ADDRESS]
[CONTACT EMAIL]