Privacy Policy

// What we collect

• Form submissions. When you use our intake form (/start) or contact form (/contact), we collect: name, email, phone (optional), business name, website, revenue range, project timeline, budget tier, and the problem description you submit.
• Email correspondence. When you reply to our emails or initiate contact, we retain the conversation history to provide service continuity.
• Technical data. Server logs may capture IP address, user agent, and request timestamps for security and rate limiting (kept up to 30 days).
• Booking data. If you book a discovery call via our scheduling link, our scheduling provider collects your name, email, and any questions you submit at booking.
• Visit counts. Every page view adds one to a simple counter on our own server: the day, the page, the website that linked you here (if any), and whether you're on a phone or a computer. It uses no cookies, stores nothing on your device, and never records your IP address or anything else that could identify you, so it runs for every visitor.
• Analytics, only if you accept. Google Analytics, Microsoft Clarity, Plausible, and our own attribution cookie load only after you click Accept. Each is described under Cookies & tracking below.

// What we don't collect

• We don't sell or rent your information to third parties. Ever.
• We don't run advertising trackers, retargeting pixels, or behavioral profiling.
• We don't require cookies to use public pages. Analytics and attribution cookies are set only if you accept them, and are used only to measure site traffic and which channels bring inquiries. Admin login uses a session cookie strictly for authentication.

// How we use it

• To respond to your inquiry and evaluate fit for an engagement.
• To send transactional emails (confirmations, replies, project updates).
• To deliver contracted services if we engage.
• To improve our intake process — your submissions help us understand what businesses need.

// Service providers

We share information with service providers only as needed to operate our business. All providers are bound by data processing agreements and operate under their own privacy policies. We do not sell your information, and we do not use your submissions to train AI models.

// Your rights

You can at any time:

• Request a copy of the data we hold on you
• Request correction of inaccurate information
• Request deletion of your information (with limited exceptions for legal/financial records)
• Unsubscribe from any outreach by replying "stop" or emailing us directly

Send all requests to hello@blvstack.com. We respond within 30 days.

// Retention

Form submissions are retained for 24 months after last contact, then archived or deleted. Server logs are kept 30 days. Active client records are retained for the duration of the engagement plus 7 years for legal/tax purposes.

// Security

Data is encrypted in transit (TLS) and at rest. Admin access is gated behind bcrypt-hashed credentials and HMAC-signed sessions. We use row-level security on our database. No system is perfectly secure — if you discover a vulnerability, please disclose responsibly to hello@blvstack.com.

// Children

BLVSTACK is a B2B service. We don't knowingly collect information from anyone under 18. If you believe a minor has submitted information, contact us and we'll delete it.

// Changes

If we materially change this policy, we'll update the "Last updated" date and, for active clients, send an email notice.

// Contact

Privacy questions, data requests, or anything legal:
hello@blvstack.com