Privacy policy.

Information we collect

When you contact us. When you send the contact form, email us, or book a call, we receive the details you choose to give us — your name, email address, company, an optional budget range, and a description of your project. When you submit the contact form, we also record basic attribution about how you arrived: marketing campaign tags (UTM source, medium, and campaign) if present in the link you followed, the referring website address, and the page on our site you submitted from. We use these only to understand which of our efforts bring the right projects to us. We do not record your IP address on the contact form.

When you book a call. If you book an intro call, we collect only what the booking needs: your name, email address, timezone, the time you choose, and any optional notes. We use this to schedule, confirm, remind you about, and hold the call — not for marketing.

When we prepare a private proposal for you. From time to time we build a private, personalized proposal page for a specific prospect and send the intended recipient a one-time access code by email. These pages are excluded from search engines, are never cached, and reveal nothing until the code is verified. To run this we store the proposal content and a securely hashed (never plain-text) version of each access code, and we keep a minimal access log recording that an unlock happened, from a hashed — never raw — network address, so we can protect the page against guessing and know when it has been viewed. If you click "I'm in," we record that and notify our team.

When you pay a deposit. If you go ahead, we collect your deposit through Stripe, our payment processor, by card or bank transfer (ACH). Your card or bank-account numbers go directly to Stripe and are handled under Stripe's terms and security — we never see or store them. On our side we store only the amount, the currency, the status, the payment method type (card or bank), and Stripe's reference IDs for the payment.

When you sign an agreement with us. If you sign our services agreement electronically on a private, code-protected page, we record what is needed to make that signature reliable and to keep a copy for both of us: the exact agreement text you agreed to and its version number, a cryptographic fingerprint (hash) of that text so it can be shown not to have changed, the email address the signing link was sent to, the name you typed, the date and time, a hashed (never raw) network address, and your browser type.

When you browse the site. We collect privacy-respecting, cookieless analytics (pages visited, approximate region, device type, and page-load performance) through Vercel Web Analytics and Speed Insights. These measurements are aggregate and first-party — they set no analytics or advertising cookies, do not track you across other websites, and do not build a profile about you, so there is no cookie banner and no consent step.

How we use your information

We use what you share to reply to you, scope and deliver the work you engage us for, process your deposit, prepare and retain signed agreements, send you the transactional emails a project needs (confirmations, reminders, access codes, receipts), protect our pages from abuse, and keep the business and accounting records we are required to keep. We do not sell or share your personal information, and we do not send marketing you did not ask for.

Who helps us process your data (subprocessors)

We use a small set of trusted service providers. They process data only on our instructions and only to provide their service to us:

Vercel — hosts this website and provides cookieless analytics; it handles request data (including your IP at the network layer) and aggregate analytics.

Neon — our database host; it handles everything we store: leads, bookings, proposals, deposit metadata, signatures, and logs.

Resend — sends our transactional email; it handles recipient email addresses and message content, plus delivery and bounce events.

Stripe — processes deposit payments; it handles your card or bank details (directly) and the payment records.

Cookies and analytics

Our analytics are cookieless. We use Vercel Web Analytics and Speed Insights, which count visits and measure page performance without setting analytics or advertising cookies and without tracking you across other sites. We do not use Google Analytics, Hotjar, or any advertising or cross-site tracking.

The only cookie we set is a strictly functional, short-lived one that keeps a private proposal page unlocked after you enter its access code. It is set HttpOnly, Secure, and SameSite=Lax, and it expires within a day.

Data retention

We keep information only as long as we need it, then delete it:

Contact and lead details: 24 months from our last contact with you, then deleted. You can ask us to delete them sooner (see below).

Booking records: about 180 days after the call, then automatically deleted.

Private proposal pages and their access logs: about 180 days after the proposal expires or is closed, then automatically deleted. You can ask us to close or delete one sooner.

Signed agreements: retained as legal records for as long as they may be needed, because electronic-signature law and our own recordkeeping require a durable copy.

Email-delivery event logs and payment (Stripe) event logs: kept about 24 months for deliverability, accounting, and troubleshooting, then purged.

Do-not-email (suppression) list: kept indefinitely so we never email someone who asked us not to.

To ask us to delete your information sooner, email hello@runningfoxdigital.com and we will do so where we are not legally required to keep it.

How we protect your information

Data is stored with reputable providers that encrypt it at rest. Access codes are stored only as salted hashes, never in plain text; network addresses in our logs are stored only as keyed hashes, never raw; and signed agreements carry a tamper-evidence fingerprint. Signing pages and proposal pages are private and code-gated.

Your choices and rights

You can ask us what personal information we hold about you, ask us to correct it, or ask us to delete it, and we will respond within a reasonable time. To make a request, email hello@runningfoxdigital.com.

California residents. If you are a California resident, you may request to know what personal information we hold and to have it deleted, and you will not be treated differently for exercising those rights. We do not sell or share your personal information as those terms are used under California law.

Children's privacy

This site and our services are meant for businesses and are not directed to children. We do not knowingly collect personal information from children under 13.

Where our services are offered

Our services are intended for clients and visitors in the United States. We do not target the European Union and do not knowingly offer services to EU residents, so this policy is written for US data practices.

Changes to this policy

We may update this policy from time to time. When we do, changes take effect as soon as we post them, and we update the "Last updated" date above to reflect the current version. If a change is material, we will note it on this page.

Contact

Questions about this policy or your data? Email hello@runningfoxdigital.com and we will help.