Privacy policy

1. Who we are

This policy describes how Apace Active LLC, a California limited liability company doing business as Strandline ("Strandline," "we," "us"), handles information collected through our website at strandline.io. Strandline designs, builds, hosts, and maintains websites for small businesses. This policy covers the website only; the services we provide to clients are governed by your Website Project Agreement and Care Plan Terms.

2. What we collect

Information you give us. When you fill out a form on the site:

• Contact form: your name, email, the kind of work you are asking about, and your message.
• Booking form: your name, email, the time you select, and an optional note about the project.
• Digital business card lead form: your name, email, and an optional message.

Information collected automatically.

• Standard request data such as IP address, browser type, referring page, and the pages you view, logged by our hosting and security providers to operate and protect the site.
• If you reach the digital business card, we record how the visit arrived (an NFC tap, a QR scan, or a direct link), whether it is a repeat visit, your browser type, and the referring page. This tells us which channel gets used; it is not tied to your identity.
• A small flag stored in your browser's local storage on the card page, used only to recognize a repeat visit. We do not use advertising cookies or track you across other sites.

What we do not collect. We do not take payment card details on the site, we do not use advertising identifiers, we do not collect your location or any health data, and we do not sell your information.

3. How we use it

• To answer your message and follow up about working together.
• To schedule, confirm, and if needed cancel a booked call.
• To operate, secure, and improve the website.
• To understand which channel brought a business-card visit.

We do not use your information for advertising, and we do not sell it.

4. Where it goes (our service providers)

We use a small set of providers, each handling only what is needed to run the site:

• Vercel hosts the website and runs its server functions and logs.
• Supabase stores booking requests and business-card leads.
• Google Workspace sends and receives our email, and Google Calendar schedules booked calls. When you book, your name and email appear on a Google Calendar invite and you receive a confirmation email and a Google Meet link.
• Cloudflare sits in front of the site for delivery and security.

5. How long we keep it

We keep contact correspondence and booking and lead records for as long as needed to do the work and for our ordinary business records, then [retention period to confirm]. You can ask us to delete your information sooner; see Section 6.

6. Your choices

You can ask us what information we hold about you, ask us to correct it, or ask us to delete it. Email [email protected] and we will take care of it.

Draft note for attorney: confirm California (CCPA/CPRA) disclosures and whether a formal "Do Not Sell or Share" statement is required given we do not sell or share data.

7. Security

The site runs over HTTPS with security headers, and the forms are protected with rate limiting and spam traps. No method of storage or transmission is perfectly secure, but we work to protect what you send us and to keep the keys to our systems off the public internet.

8. Children

The site is meant for businesses and is not directed at children under 13.

9. Changes

If we change this policy we will update the effective date above, and significant changes will be noted on this page.

10. Contact

Questions about privacy: [email protected].