Privacy Policy

This Privacy Policy explains how Complexity Networks Design Co. ("we", "us") collects, uses, protects and shares personal information when you visit this website, create an account, request a quote or buy our Services. It also explains the cookies we use and the choices you have.

Contents

1. Information we collect
2. How we use it
3. Payments & saved cards
4. Cookies & local storage
5. Who we share it with
6. How we protect it
7. How long we keep it
8. Your rights & choices
9. Children
10. International visitors
11. Changes & contact

1. Information we collect

Information you give us

• Account details: your name, email address and password. We store only a salted, one-way scrypt hash of your password — never the password itself.
• Billing details: billing name, company (optional), postal address and phone number (optional). You can choose whether to save these to your account.
• Order details: the services you buy, amounts, dates, and the project brief and reference links you provide.
• Messages and quote requests: your name, email, the service you're interested in, budget range and message.
• Files you send us (for example, logos or reference images) to complete your project.

Information collected automatically

• Security data: your IP address is used briefly in memory to limit repeated sign-in attempts and spam. Our security log records actions such as sign-ins and account changes with a shortened, one-way hash of the IP address — not the address itself.
• Session data: when you sign in we record the time and your browser's user-agent string (e.g., "Chrome on Windows") with your session so you can manage signed-in devices.
• Server logs: our hosting provider may keep standard web-server logs (IP address, pages requested, time) for security and troubleshooting.

We do not use analytics, advertising pixels, fingerprinting or cross-site tracking.

2. How we use your information

Purpose	Information used	Legal basis (EEA/UK visitors)
Create and run your account	Account details, session data	Contract
Make, deliver and support your project	Order details, brief, files, messages	Contract
Process payments and prevent fraud	Billing details, payment data (via Stripe)	Contract; legitimate interests
Reply to quote requests and questions	Contact details, message	Steps before a contract; legitimate interests
Keep the site and accounts secure	Security data, session data	Legitimate interests
Keep business and tax records	Order amounts, dates, items	Legal obligation
Send order updates	Email address	Contract

We don't send marketing emails unless you separately opt in, and every marketing email will include an unsubscribe link. We don't make automated decisions that have legal or similarly significant effects on you.

3. Payments & saved cards

Payments are handled by Stripe, Inc., a PCI DSS Level 1 certified payment processor. When you enter card details, they are sent directly from your browser to Stripe through Stripe's secure form; they never pass through or get stored on our servers.

• If you choose to save a card, Stripe stores it on a Stripe customer profile linked to your account. We can see only the card brand, last four digits and expiry date, so you can recognize it.
• You can remove saved cards at any time from Account → Payment methods.
• Stripe uses your information under its own privacy policy, available at stripe.com/privacy, including for fraud prevention.

4. Cookies & local storage (Cookie Policy)

Cookies are small text files a website stores in your browser. We use only strictly necessary cookies and browser storage that the site needs to work. Because we don't use advertising, analytics or other optional cookies, there is nothing to opt into — but you can always see exactly what's used below.

Name	Set by	Purpose	Duration
__Host-cnd_sid (or cnd_sid in testing)	Us	Keeps you signed in. Holds a random token only; marked HttpOnly, Secure and SameSite so scripts and other sites can't read or misuse it. Set only when you sign in.	14 days of inactivity, or until you sign out
__stripe_mid	Stripe	Fraud prevention on pages that show the secure card form (checkout and payment methods).	1 year
__stripe_sid	Stripe	Fraud prevention during a payment session.	30 minutes
cnd_cart (local storage)	Us	Remembers which services are in your cart (product numbers and quantities only — no personal data).	Until you check out or clear it
cnd_cookie_notice (local storage)	Us	Remembers that you've seen the cookie notice.	Until you clear browser data

Fonts: our pages load typefaces from Google Fonts. To deliver them, Google receives your IP address and browser information; Google states it does not use this to build profiles. See Google Fonts privacy FAQ.

Managing cookies: you can block or delete cookies in your browser settings. If you block the session cookie you won't be able to sign in, and blocking Stripe's cookies may prevent payments from completing.

Do Not Track & Global Privacy Control: we don't track you across websites or sell or share personal information for targeted advertising, so there is nothing for these signals to switch off; we honor them by default.

If we ever add optional cookies (such as analytics), we will update this policy and ask for your consent first where the law requires it.

5. Who we share it with

We do not sell your personal information, and we do not "share" it for cross-context behavioral advertising. We disclose it only to:

• Stripe — to process payments and save cards you choose to save.
• Our hosting and email providers — to run the website and send you emails. They may process data only on our instructions.
• Google Fonts — receives your IP address when fonts load (see Section 4).
• Professional advisers (such as accountants or lawyers) under confidentiality obligations, when needed.
• Authorities — when required by law, court order, or to protect the rights, safety and security of our customers, us or others.
• A buyer or successor — if our business is sold or merged, subject to this policy.

6. How we protect it

• Encryption in transit: the site is served over HTTPS (TLS) with strict transport security.
• Encryption at rest: your email, name, billing address, phone number, project briefs, order notes and messages are encrypted in our database with AES-256-GCM, each value bound to its own record. Encryption keys are kept separate from the database.
• Private email lookup: to find your account at sign-in without storing your email in plain text, we use a keyed one-way hash (HMAC-SHA-256).
• Passwords: hashed with scrypt and a unique salt; sign-in attempts are rate-limited.
• Sessions: only a hash of your session token is stored, so even a database copy can't be used to sign in as you. Changing your password signs out all other devices.
• Access control & logging: only authorized administrators can view decrypted order and customer details, and access is recorded in a security log.
• Web protections: Content-Security-Policy, cross-site request forgery protection, clickjacking protection and input validation.

No method of transmission or storage is 100% secure, but we work hard to protect your information. If a breach affects your personal information, we'll notify you and any authorities as required by law.

7. How long we keep it

Data	Kept for
Account details	Until you delete your account
Saved billing address	Until you remove it or delete your account
Saved cards (at Stripe)	Until you remove them or delete your account
Order records (amounts, dates, items)	Up to 7 years for tax and accounting. When you delete your account, your name, email, billing address and brief are removed from these records.
Unfinished checkouts	Personal details removed after 30 days
Quote requests and messages	Up to 24 months
Security log	12 months
Sessions	Deleted when they expire or you sign out
Project files	Up to 90 days after delivery

8. Your rights & choices

Depending on where you live, you may have the right to:

• Access / portability — get a copy of your data. Use Account → Privacy & data → Download my data.
• Correction — update your profile and billing details in your account, or ask us to fix anything else.
• Deletion — delete your account from Account → Privacy & data, or ask us to delete specific information (we may keep what the law requires).
• Objection / restriction — object to or ask us to limit certain processing.
• Opt out of sale or sharing — we don't sell or share personal information, so no action is needed.
• Withdraw consent — where we rely on consent, you can withdraw it at any time.
• Complain — to your local data-protection authority (EEA/UK).

To make a request, email us from the address on your account. We may need to verify your identity, and we'll respond within the time the law requires (generally 30–45 days). You may use an authorized agent where the law allows. We won't treat you differently for exercising your rights.

9. Children

The site is not directed to children under 13, and we don't knowingly collect personal information from them. Users aged 13–17 may browse, but purchases must be made by a parent or guardian (see our Terms of Service). If you believe a child under 13 has given us information, contact us and we'll delete it.

10. International visitors

We are based in the United States, and our servers and service providers may be in the U.S. or other countries. If you access the site from outside the U.S., your information will be transferred to and processed in the U.S., where data-protection laws may differ from those in your country. Where required, we rely on appropriate safeguards such as standard contractual clauses used by our providers.

11. Changes & contact

We may update this policy as our services or the law change. We'll update the effective date above and, for material changes, notify account holders by email or on the site.

Questions or requests:
Complexity Networks Design Co.
Michigan, USA
Email: support@example.com