Privacy policy

Creative Crayon LLC ("Creative Crayon," "we," "us," or "our") provides website design, development, SEO, advertising, and related creative services. This policy covers our agency website, contact form, client portal, billing administration, and communications with prospective and current clients.

We decide how information is used to operate our own website and business relationship with you. When we handle information on behalf of a client for a project, the client determines the purposes of that work, subject to our agreement. A client website or campaign may have its own privacy notice. This policy does not replace that notice.

We receive information when you contact us, accept a portal invitation, manage your account, or provide materials for a project. This can include:

• Contact information: your name, email address, optional phone number, and the message you send.
• Client and account information: business name, billing contact, account membership, password credentials stored in hashed form, and authentication settings.
• Project information: briefs, business goals, approved content, correspondence, milestones, and reporting information needed for our work.
• Billing information: invoice descriptions, service periods, amounts, due dates, payment status, and records of refunds or disputes.

Our systems and hosting services process technical information when you visit or sign in. This can include your IP address, browser or device information, requested pages, request times, session identifiers, and security events. We use these records to deliver pages, maintain sessions, diagnose problems, and detect misuse.

Some application records use a one-way representation of an IP address for abuse prevention. This does not mean every system record is anonymous: session records and hosting logs may contain an IP address and browser information. We also keep records of relevant account, billing, and administrative actions.

We use information to operate our business and provide the services you request. We do not use a contact inquiry as permission for an unrelated marketing campaign. If we send promotional communications, you can ask us to stop. Necessary account, project, security, and billing communications may still be sent.

• Respond to inquiries, prepare proposals, and communicate about your project.
• Set up client access, authenticate users, and display the correct account's invoices and published project updates.
• Deliver agreed services, coordinate approvals, and prepare reports using the sources and reporting periods available to us.
• Create and reconcile invoices, record payment activity, and address billing questions.
• Maintain reliable services, investigate errors, prevent fraud, and protect accounts.
• Maintain business and accounting records, resolve disputes, and comply with applicable obligations.

Our website uses cookies for functions such as maintaining your session, protecting forms, and remembering a sign-in when you choose that option. Blocking these cookies may prevent login or other features from working.

We do not currently deploy advertising pixels or third-party audience analytics on this agency website, and we do not sell personal information or share it for cross-context behavioral advertising. Our clients' websites and campaigns are separate and may use tools covered by their own notices.

Stripe's hosted payment pages use their own technologies under Stripe's policies. If we introduce optional tracking on our website, we will update this notice and provide any choices or consent controls required before that tracking is used.

When you pay an invoice online, you enter payment information directly on a page hosted by Stripe. Our application does not receive or store your full card number or card security code. We share the client and invoice information necessary to create and manage the invoice.

Stripe sends us payment-related records so we can show invoice status and reconcile payments, refunds, and disputes. Stripe also processes information for its own payment, fraud prevention, and legal purposes as described in its privacy policy. Its role is not limited to acting on our instructions.

We disclose information when needed for the following purposes:

• Service delivery: hosting, email delivery, payment processing, and other providers needed to operate the services you use.
• Authorized work: people and contractors involved in your project, with access appropriate to their responsibilities.
• Account collaboration: authorized users of your client account can view the invoices and published progress available to that account.
• Professional and legal needs: advisers, authorities, or other parties where necessary to meet legal obligations, respond to lawful requests, or protect rights and safety.
• Business changes: a potential or completed reorganization or transfer, subject to appropriate confidentiality and applicable privacy requirements.
• Your instructions: other disclosures you request or authorize.

Retention depends on the purpose and type of record. We consider whether an inquiry is active, whether a project or account is ongoing, the need to resolve billing questions or disputes, and applicable accounting and legal requirements. We do not promise that all records disappear when an account is closed.

When information is no longer needed for those purposes, we delete it or make it non-identifying. Copies in backups may remain until the relevant backup is replaced or expires. Records subject to a legal preservation obligation may be retained longer. You can contact us about a particular record or retention request.

We use access restrictions, password hashing, staff multifactor authentication, and other safeguards designed to protect the information we handle. Access to client portal content depends on account membership. No website, provider, or method of transmission can guarantee complete security.

Use a unique password, protect your invitation and invoice links, and let us know promptly if you suspect unauthorized access. Invoice payment links may allow their holder to view billing details. Please do not forward them to people who should not have that access.

You may contact us to ask what personal information we hold about you, request a correction or deletion, or ask for a copy. Depending on the law that applies, you may also have rights to portability, restriction, objection, withdrawal of consent, or an appeal of our response. These rights can have exceptions, including for records we must retain.

Email contact@ccrayon.com with the subject Privacy request and describe what you need. We may ask for information reasonably necessary to verify your identity or an authorized agent's authority. Please do not include passwords, full payment details, or identity documents in your first message.

We respond within the time required by applicable law and explain any limitations on a request. Where applicable, you may complain to your privacy regulator or appeal a decision by replying to our response. We do not retaliate against you for exercising a privacy right.

Creative Crayon operates in the United States. Our providers may process information in the United States or other countries, where privacy laws can differ from those where you live. Where applicable law requires a transfer mechanism or other safeguard, that requirement applies to the transfer.

Where a legal basis for processing is required, we rely on the basis appropriate to the activity: providing an agreed service or responding to a request before a contract, meeting a legal obligation, legitimate business interests such as security, or consent where required. Consent can be withdrawn for future processing that relies on it.

Our agency website and client portal are intended for business use by adults. They are not directed to children under 13, and we do not knowingly collect personal information from children under 13. Contact us if you believe a child has provided information so we can investigate and take appropriate steps.

The contact form and client portal are not patient intake systems. Do not submit patient records, medical details, government identification numbers, passwords, or payment credentials through them. Medical and dental marketing work requires separately agreed arrangements before any regulated information can be handled.

Links to payment providers, social networks, and other websites take you to services with their own privacy practices. Review their notices before providing information.

If your request concerns information collected by one of our clients, contact that business first. When we process that information on its behalf, we assist with requests according to the client's instructions, our agreement, and applicable law.

We may revise this policy as our services or practices change. The date at the top identifies the latest version. For material changes, we will provide additional notice where required, and obtain consent when the law requires it. A policy update does not by itself authorize a new use that requires your consent.