Privacy notice

DRAFT — this notice states what the system does today. It is published as a draft until the shop and the operator have approved it, and no real customer record is taken before then. Not legal advice.

What is collected

On the estimate form: your name, a phone number or email, what the piece is and what it needs, whether you will drop it off or want it collected (and an address if so), and the photos you choose to add. Photos can contain location data and background details; only what is needed for the estimate is kept, and photos are never published without your separate permission.

Also collected: the network address your request arrives from, kept with the request only as a keyed pseudonym (a code derived from the address with a secret we hold, used to limit how many requests one connection can send in a day).

Our web server keeps an access log of the public pages, for requests addressed to this site's own name — the address your browser connects from, the method and page requested (the page itself only for the public pages; any other request, the estimate form and its photos included, is recorded as "(redacted)"), the protocol, the time, how long the reply took, and the status and size of the reply, and the site name (and port, if any) your browser asked for, kept as it spelled it; your browser's other headers, the size of what you sent and the details of the encrypted connection are not written — for up to 90 days (the log is rotated daily and rotations older than 90 days are removed). A form link opened over plain HTTP is not written to that log at all.

Where it is kept

On rented servers operated by Petoskey Stone Code in a single data center in Ashburn, Virginia, USA. Your text and your photos are encrypted before they are stored. The shop's owner can read them to prepare your estimate; the operator of the system maintains the servers and can technically reach the data, and does so only to run or fix the system.

How long

Photos and what you wrote are deleted 90 days after the shop closes the job for your request, 90 days after the shop declines your request, or 90 days after you sent it if by then the shop has neither taken it on as a job nor declined it. A job whose status has not changed for a year is closed automatically, and the same 90 days then apply. The address pseudonym is replaced by a constant on the same 90-day schedule, and the daily-limit record that uses it is removed after three days. Job and estimate records are kept for two years.

While this installation holds only synthetic records it keeps no backup copies of them; a real deployment will state its backup schedule here before any real record is taken.

Your estimate is sent to you as a private web link. Anyone who has that link can see this job, the estimate and your photos without a password, for up to 90 days, so keep it to yourself; the shop can stop a link at any time from its own screen, and sending you a new one does not stop the old one.

Ask the shop to delete your request at any time; the shop can do so from its own screen. The shop can also download a copy of its own records, your request included, to its own computer; a copy the shop has downloaded is the shop's to keep or to delete, and deleting your request here does not reach it.

Who else

Nobody. No advertising, no analytics, no third-party processing of your photos. If a card-payment service is ever added, its own notice will be linked here before it is used.