Privacy Policy

When you contact us or start a project through the form on this site: your name, business name, email address, phone number, and your message. Your IP address is used at submission time to rate-limit the form against abuse; a one-way keyed hash of it, never the address itself, is kept with your inquiry so the daily limit holds.

If you become a client with a portal account: your name, date of birth, and phone number (collected when your account is created), your login email and password (we never store your password; it is held only as a secure hash by our authentication provider, Supabase, and we never log or keep the password you type), your role, your notification preferences (text-message updates are a separate opt-in), and the content you create in the portal: project details, phase progress, and the messages you send us.

Project credentials, if you use the vault: the portal includes a credential vault where you or we can store credentials your project needs (for example logins, API keys, or account details for services your system uses). Vault items are encrypted (AES-256-GCM) before they are stored and are visible only to you and the staff working on your project.

Billing records: invoices, payment and payment-consent records, subscription details, and amounts. Card payments are handled by Stripe, either on Stripe's own checkout page or in Stripe's secure card field shown inside your dashboard. Either way, your full card number goes straight to Stripe and never touches our servers. If you choose to save a card for future payments, Stripe keeps it; we keep no card details ourselves, only Stripe's reference IDs (customer, subscription, payment), the amounts, and a record that you agreed to save the card. Stripe also emails you its own receipt, and may offer to save your details with Stripe Link, which is Stripe's service, not ours.

Operational records: a ledger of the notification emails and texts we send you (so we never double-send or miss one), an audit log of significant account and billing actions (so there is always an answer to "what happened and when"), and server logs, which record each request and, for each email we send, the recipient's address.

What we deliberately do not collect: no advertising trackers, no data brokers, no buying or scraping of personal information, and no collecting more from a form than the form shows.

Only for these purposes:

• to respond when you contact us,
• to set up and secure your client account, and to verify your identity when you contact us for support (for example, confirming who you are over the phone),
• to deliver, support, and bill the work you hired us for,
• to send transactional messages: confirmations, payment requests and receipts, project updates, renewal reminders,
• to keep the service secure: rate limiting, abuse prevention, audit logging, and
• to meet legal obligations, such as tax and payment records.

We do not sell your data. We do not share it for advertising. We never will. Text-message updates are sent only if you explicitly opt in, and you can opt out at any time.

We believe you should know who we rely on to run the service. Our service runs on:

Each provider processes data only to provide its service to us, under its own security and privacy commitments. We do not use advertising networks.

Where your information is stored. Our database (Supabase) is hosted in Canada. Our website and its server code run on Vercel in the United States. Our other providers process information in the United States and wherever their own services operate. The protections in Section 7 apply wherever it is stored.

One detail on Cloudflare worth stating plainly: the bot check happens between your browser and Cloudflare when the page loads. As of 2026-08-03, our own server does not forward your IP address to Cloudflare when it verifies the challenge result — Cloudflare receives connection data only directly from your browser.

We use only the cookies required to keep you signed in and the site working (authentication session cookies). No advertising cookies, no cross-site trackers. Our analytics (Vercel Analytics) does not use cookies to identify you, which is why the site has no cookie-consent pop-up: there is nothing to consent to.

We keep personal information only for the purpose it was collected for, and we delete it when you ask, apart from what the law or the security of the service requires us to keep. In practice:

• Contact/lead messages: kept while we are talking to you and for our follow-up; deleted on request.
• Client account and project data: kept while your account or project relationship is active, and after it ends until you ask us to delete it.
• Billing and payment records: kept as long as tax and financial law requires, even after an account closes.
• Security and audit logs: kept for the life of the service, because they are the record of who did what and when; they are not deleted on request.
• Sign-in records: kept by our sign-in provider (Supabase) with your account.
• Server logs: kept by our hosting provider (Vercel) for its own retention period.

You can request deletion at any time (Section 6). When you do, we delete everything except what the law requires us to keep (for example tax records) and the security and audit logs above, and we tell you what was kept and why.

You can, at any time:

• Access: ask what information we hold about you and get a copy.
• Correct: have inaccurate information fixed.
• Delete: have your information deleted, subject only to what the law requires us to keep.
• Port: get your data in a usable, portable format. Your Stripe account and your domain are in your name from day one; your data and revenue belong to you, not us.
• Opt out: we do not sell personal data, do not use it for targeted advertising, and do not profile you, so there is nothing of that kind to opt out of. You can also stop any non-essential communication at any time, and SMS is opt-in to begin with.

To exercise any of these, email info@lolipopp.com or call 972-922-6538. We will verify the request is really from you, act on it, and confirm when it is done, within forty-five (45) days of receiving it; if we need longer, we tell you why within that time and finish within forty-five (45) more. We do not charge for this and we do not penalize you for asking. If we ever decline a request, we tell you why, and you can appeal by replying to that decision; we answer appeals within thirty (30) days. If you believe we have not resolved a privacy concern, you may also contact the Texas Attorney General's office, which enforces the Texas Data Privacy and Security Act.

Security is engineering, not a paragraph, but the paragraph is accurate: data is encrypted in transit (HTTPS) and at rest by our infrastructure providers, database access is controlled with row-level security so each account can only reach its own records, administrative actions are audit-logged, card data for payments to us is handled exclusively by Stripe, credentials stored in the project vault are encrypted with AES-256-GCM before storage, and access to production systems is limited to those who need it. No system is perfectly secure; if a breach ever affects your personal information, we will notify you and the authorities as applicable law requires, promptly and plainly.

When Lolipopp builds or operates a system for a client business, the personal data inside that system (the client's customers, bookings, orders, messages) belongs to the client. For that data:

• we act on the client's instructions under our signed Service Agreement and its Data Processing Addendum,
• we use it only to build, run, and support the client's system, never for ourselves,
• we keep it confidential, return or delete it when the engagement ends, and require the same of any provider we use, and
• the client's own privacy policy, not this one, governs how their business uses their customers' data.

If you are a customer of a business whose system we built, your relationship is with that business: their privacy policy applies, and requests about your data should go to them. If you contact us instead, we will point you to them and help them respond.

Our website and services are for businesses and are not directed to children under 13. We do not knowingly collect personal information from children. If you believe a child has given us personal information, email info@lolipopp.com or call 972-922-6538 and we will delete it.

If we change this policy, we update the "Last updated" date above, and for material changes we notify active clients by email or through the dashboard before the change takes effect. We will never quietly reduce your rights.

Privacy questions or requests: info@lolipopp.com or 972-922-6538. We answer these ourselves, not with a form letter.