What we collect, and why.

1. Who we are

1.1“Graft Labs”, “we”, “us” and “our” mean Graft Labs LLC, a Washington limited liability company that designs and looks after websites for small, local businesses. This policy covers our website, our sample and sales emails, and our client work.

1.2You can reach us at [email protected] or (971) 225-0136. Our Terms of Service also apply when you use our services.

2. What we collect

2.1When you visit this website. Our hosting and network providers keep standard technical logs, such as your IP address, browser type, device type, the pages requested and timestamps. We use these for security, reliability and performance. We set no cookies on this website and we run no advertising trackers or analytics tools beyond the basic statistics our hosting provider produces. Fonts and images are served from the website itself. The only third-party script on this website is the spam check on the sample request page, described in the next section, and it loads only on that page. If that changes, we will update this page first.

2.2When you contact us or ask for a sample. We collect what you send us: for example your name, business name, email address, phone number, website or social page links, and anything you write or attach. (The sample request form is described in the next section.) If you become a client we also collect billing details, project content (text, photos, logos), account access you choose to share, and your support messages.

2.3When you pay. Payments are handled by our payment provider (currently Stripe). We receive limited information, such as your name, email address, the last digits of your card, the amount and the payment status. We never see or store your full card number.

2.4From our outreach. We sometimes email local businesses about our services. For that we use business contact details that the business itself has published, such as the email address on its own website or public listing. We keep a record of where we found it. We send these emails as business-to-business messages under the CAN-SPAM Act, and every message includes an opt-out.

2.5From websites we build for clients. If a site we built for you has a contact form, the messages visitors send pass through to you. You are the owner of that information and decide how it is used. We handle it only on your behalf, to run the site. Your own privacy policy should explain this to your visitors.

3. The sample request form

3.1When you use the sample request form (at /sample/), we collect the details you type: your name, email address, business name, what you do and where, your website (or a Facebook, Google Maps or Yelp page if you have no website), your phone number if you give one, and any note you add. We also see whether you ticked the box confirming that you are authorised to ask for the business. We use these details to check the request, to reply to you, and to prepare the sample you asked for. We will never sell these details, ever.

3.2Spam check (Cloudflare Turnstile). The form page loads a spam-check tool from Cloudflare, called Turnstile, so that we can tell people from automated programs. It runs only on that page. Cloudflare receives technical information from your browser and network, such as your IP address and browser details, to decide whether you are a person. By default Turnstile does not set cookies or use local storage, and we have not turned on any option that would. Cloudflare handles that information under its own privacy policy. We receive only a pass or fail result. The spam check needs JavaScript. If you would rather not use it, you can email us instead.

3.3Email delivery (Resend). When you send the form, our server passes it to Resend, an email-delivery provider, which emails it to our sales inbox. We do not keep the submission in a database on the website. It exists as an email in our business mailbox and in the delivery provider’s logs, which the provider keeps for a limited time under its own policy. We do not send you an automatic reply.

3.4Abuse limits. To stop floods of requests, our server keeps a scrambled (hashed) version of your IP address in a short-lived cache for about an hour to count recent attempts. We do not keep it for any other purpose. A hidden field in the form catches automated programs, and we reject requests that look like spam or that contain links in the free-text boxes.

4. Checking who is asking for a sample

4.1To keep samples from being misused, we may check that a request comes from a real business before we build anything. We do this with public information, such as a business’s own website, a public business or professional-licence lookup, or a public listing. We usually reply only to an email address that matches the business’s domain or a contact it has published.

4.2We use what we find only for this check and for the sample or quote you asked for. If we cannot confirm that a request is genuine, we may decline it and delete what we collected.

5. Cookies and similar technologies

5.1This website does not set cookies, use local storage for tracking, or load advertising or social-media widgets. The spam check on the sample request page is run by Cloudflare Turnstile, which by default sets no cookies and uses no local storage. Samples we build for you follow the same approach. If a client site needs a cookie or a third-party tool, for example for a booking or review widget, we will say so in the proposal and the client’s own privacy policy should explain it.

6. How and why we use it

6.1We use personal information to:

• reply to you and answer questions
• prepare samples you ask for and build, host and support your site
• send quotes, invoices and receipts, and take payment
• keep our website and systems secure and working, and prevent abuse or fraud
• run business-to-business outreach and honour opt-outs
• meet legal, tax and accounting obligations, and protect our rights
• understand what works and improve our service

6.2In plain terms, we do this because it is needed to do what you asked, because the law requires it, or because we have a legitimate business reason that does not override your privacy. Where the law requires your consent for something, we will ask for it.

7. Who we share it with

7.1We will never sell your personal information, ever. We do not rent it either, and we do not share it for cross-context behavioural advertising. We do not use it to profile you or to make automated decisions that have legal or similarly significant effects on you.

7.2We share information with service providers who help us run the business and who may only use it for that purpose. These include providers of website hosting and content delivery, domain and DNS services, business email, payment processing, file storage and backup, email delivery for the sample request form (currently Resend), and spam protection for that form (currently Cloudflare Turnstile).

7.3We may also share information with professional advisers (such as accountants and lawyers), when the law requires it or to respond to valid legal requests, to protect our rights, property or safety, and with a buyer or successor if our business is sold or reorganised (they must honour this policy).

8. Where your information is kept

8.1Our business email, files and records are kept in accounts that we control with reputable providers, protected by strong passwords and, where offered, two-step sign-in. Sites we host sit on a major global hosting network. Only the people who need access to do the work (currently the owner and any contractor we engage under a confidentiality commitment) can open them.

8.2If you send us something sensitive by mistake, such as a full card number or a password, please tell us. We will delete it and we may ask you to change it. Please do not email us government ID numbers or similar items. We do not need them.

8.3If you give us information about other people, such as staff names or customer testimonials, please make sure you have their permission to share it with us and to publish it, if they are going to appear on your site.

9. How long we keep it

• Samples and the files for them are deleted 10 days after delivery unless you proceed with a build.
• Sample request forms arrive as emails and follow the enquiry rule below. The hashed abuse-limit counter expires after about an hour.
• Enquiry emails and related notes are kept for up to 24 months unless you become a client.
• Client records, contracts and invoices are kept as long as tax and accounting rules require, generally 7 years.
• Backups roll off on a regular schedule.
• Do-not-contact entries are kept permanently. We keep only the email address or domain, and use it for nothing except making sure we never contact you again.

9.1We may keep information longer where the law requires or where we need it to resolve a dispute.

10. Outreach and opt-out

10.1To stop emails from us, reply “no thanks” or email [email protected]. We handle these requests as soon as we see them. The law allows up to 10 business days, and we aim for one day. We will not email you again, and we do not use the opt-out record for any other purpose. We will never sell your data, ever.

10.2If we made a sample website for your business and you want it taken down, email [email protected] and we take it down as soon as we see it, and we aim for one day.

11. Security

11.1We use reasonable administrative and technical measures to protect personal information, including encryption in transit (HTTPS), access controls on our accounts, and backups. No system is perfectly secure, so we cannot guarantee absolute security.

11.2If a breach affects your personal information, we will notify you and any regulator as required by law, including Washington’s data breach notification law (RCW 19.255).

12. Your choices and rights

12.1You can ask us to tell you what personal information we hold about you, to correct it, to delete it, or to stop using it for certain purposes. Email [email protected]. We will respond within 45 days. We may need to confirm who you are before we act, and we may decline a request where the law allows or requires it, in which case we will tell you why.

• Access: a copy of the personal information we hold about you.
• Correction: fixing anything that is wrong or out of date.
• Deletion: removing your information, except where we must keep it for legal, tax or security reasons.
• Opt-out: stopping marketing email at any time, with no reason needed.
• Appeal: if we decline a request, tell us and we will take a second look and explain our decision.

12.2Residents of Washington, California and some other states have specific privacy rights under state law. Our business is currently below the size at which most of those laws apply to us, but we are glad to honour reasonable requests anyway, and we will not treat you differently for making one.

12.3If you are a visitor to a client’s website, please contact that client about the information you gave through their site. We will help them respond.

13. Children

13.1Our website and services are for businesses and are not directed to anyone under 16. We do not knowingly collect personal information from children. If you think we have, contact us and we will delete it.

14. Where information is processed

14.1We operate in the United States and our providers may process information in the United States and other countries. We choose providers that apply reasonable safeguards, and we remain responsible for how we use the information you give us.

15. Other websites

15.1Our website and the sites we build may link to other websites. We do not control them and this policy does not apply to them.

16. Do-not-track signals

16.1Because we do not track you across websites and set no cookies, there is nothing for a do-not-track or similar signal to switch off.

17. Changes to this policy

17.1We may update this policy. The date at the top shows when it last changed. If a change is material, we will say so on this page before it takes effect.

18. Contact

18.1Questions or requests: [email protected] or (971) 225-0136. To opt out of emails: [email protected].