We collect almost nothing, and we keep what you tell us to ourselves.

What we collect

One thing: the contact form. When you submit it, we receive the fields you filled in.

• Your name and email address
• Company name, if you enter one
• Budget range, project type, and timeline, if you select them
• Your message
• The estimate summary, if you used the calculator and clicked through to the form

We do not ask for a phone number, an address, or anything financial. If you send us more than that in your message, we hold it under the same terms as everything else.

What we do with it

We read it and reply to you. That is the entire purpose. Specifically, we will:

• Answer your inquiry, usually within one business day
• Prepare a quote if you asked for one
• Keep the thread so we have context if you come back later

We will not:

• Sell, rent, or trade your information to anyone, for any amount, ever
• Add you to a newsletter or marketing sequence you did not ask for
• Use your details to retarget you with advertising
• Share your inquiry with other clients, partners, or contractors

Where it is stored

Form submissions are processed and stored by Netlify, the hosting platform this site runs on. Netlify holds them on servers in the United States and acts as our data processor. We access them through the Netlify dashboard and by email.

Netlify records standard server access logs, including IP addresses, as part of delivering and protecting the site. That is normal infrastructure logging, not analytics, and we do not use it to build a profile of you.

Cookies and tracking

This website sets no cookies. There is no cookie banner because there is nothing to consent to. We run no analytics, no advertising pixels, no heatmaps, no session recording, and no social media trackers.

There is one small exception worth stating plainly. If you switch language using the globe button, your chosen language code is saved in your browser's local storage so the site remembers it next time. It holds nothing but a two-letter code, never leaves your device, and is not used to identify you. Translation happens entirely in your browser using files served from this domain, so no third-party translation service ever sees your visit.

One thing worth disclosing honestly: the site loads its typefaces from Google Fonts. That request goes to Google's servers and, like any web request, includes your IP address. We receive nothing from it and it sets no cookie on this site, but we would rather tell you than let you find out. We are working toward self-hosting the fonts to remove even that.

See our Do Not Track statement for how we handle browser privacy signals.

How long we keep it

• Inquiries that do not become projects: deleted after 12 months.
• Inquiries that become projects: kept for the life of the working relationship, then 7 years for accounting and tax records, then deleted.
• Anything you ask us to delete: deleted on request, except where we are legally required to keep an invoice record.

Your rights

Whatever jurisdiction you are in, we will honor these without argument or a verification runaround:

• Access. Ask what we hold about you and we will send it.
• Correction. Tell us something is wrong and we will fix it.
• Deletion. Ask us to erase your information and we will.
• Portability. Ask for a copy in a usable format and we will send it.
• Objection. Tell us to stop processing and we will stop.

Email hello@cindershift.com. We aim to respond within 5 business days and will not charge you for it.

Confidentiality

Separate from data protection law, this is our commitment about your business.

What we treat as confidential

Everything you tell us in the course of an inquiry or a project: your revenue, your margins, your pricing, your customer lists, your plans, your internal problems, your traffic numbers, your analytics, your passwords and account access, and any document you send us. We treat all of it as confidential by default, whether or not you label it so, and whether or not we end up working together.

What that means in practice

• We do not discuss your project with other clients, including in general terms that would identify you.
• We do not use your business as a competitive example when pitching someone in your industry.
• We do not publish, screenshot, or reference your work publicly without your written permission. This includes our own portfolio and social media.
• Access credentials you give us are used only for the agreed work, never stored in plain text, and are handed back or revoked at the end of the engagement.
• If we bring in a specialist for part of a project, we tell you first and they are bound by the same terms.

NDAs

We will sign your NDA. Send it with your inquiry and we will review and return it, usually the same day. We do not require you to sign anything before an initial conversation.

The limits

We would rather state these than pretend they do not exist. We may disclose information where we are legally compelled to by a court or regulator, where you have given us permission, or where information was already public before you told us. We will tell you if that ever happens, unless we are legally barred from doing so.

Access we ask for during a project

This is separate from anything the website collects, and it is worth stating plainly because it is where people are rightly cautious.

Building or maintaining a site sometimes means we need access to accounts you already own. Typically that is one of these:

The rules we hold ourselves to

• Purely functional. Any access you grant is used for the specific task it was granted for, and nothing else. We do not browse around, export data, or use what we see for any purpose outside your project.
• Minimum permission. We ask for the narrowest role that gets the job done. Where a platform offers a delegated, collaborator, or read-only role, we ask for that instead of full admin.
• Never your password. We do not want it and will not accept it. Every platform mentioned above supports adding someone by email address. Any studio that asks you to email a password is doing it wrong.
• Nothing stored in plain text. Credentials live in a password manager, never in email, chat, spreadsheets, or a project document.
• Revoked at the end. When the work is done we tell you which accesses to remove, or remove ourselves where we can. On care plans we keep only what the plan actually needs.
• You can revoke at any time. No notice, no explanation needed. It may pause work until we sort out an alternative, but the access is yours to withdraw whenever you want.

Security

The site is served over HTTPS with security headers set. Form submissions are encrypted in transit. Access to the Netlify account is protected and limited to people who need it. We use a password manager rather than reused passwords, and we do not email credentials in plain text.

No system is perfect. If something did go wrong and your information were exposed, we would tell you directly and promptly rather than waiting for you to read about it.

Children

This is a business service and is not directed at anyone under 16. We do not knowingly collect information from children.

Changes to this policy

If we change anything material here, we will update the date at the top and, if you are an active client, tell you directly. We will not quietly broaden what we do with your information.

Contact

Questions, requests, or complaints: hello@cindershift.com. A person reads that inbox and will reply.