Privacy Policy

What we collect, why, and how to get it back or get rid of it — in plain words.

The short version. We collect the least we can. On this site that means the contact form and an anonymous count of page views. The only ad tracker is Facebook’s, and it runs only on the preview websites we build to show a business what its new site could look like — never on a client’s live site. Nothing is sold to anybody. On the websites we run for clients we hold the details their customers give them, on their behalf. Card numbers go straight to Stripe; we never see them. Want a copy of your information, or want it deleted? Email us and it happens.

Who we are

Founders Studio is the trading name of Pillar Supply LLC. We are a small studio that designs, builds and hosts websites for local businesses, and handles the marketing side for some of them. We are the ones responsible for the information described on this page — the data controller, if you want the formal term.

This policy covers two different groups of people, and the rules aren’t the same for both:

1. Visitors to founders-studio.com — this site, our own shop window.
2. People using a website we run for a client — a donut shop, a yoga studio, a barbershop. There, the business is in charge of the information and we hold it for them.

Part one — founders-studio.com

The contact form

There is one place on this site where you can hand us anything, and it’s the contact form. It asks for:

• your first name (required) and last name (optional)
• your email address (required)
• your phone number (optional)
• whether you ticked the box saying we may text you, and when (optional, and unticked unless you tick it)
• whatever you write in the message box

We use it to write back to you and to keep track of the conversation that follows. That is the entire purpose. It does not go onto a marketing list, and we don’t send campaigns nobody asked for.

When you press send, two things happen: the message is saved in our database, and a copy is emailed to us so a real person actually sees it.

Counting page views

We count which pages get looked at, so our clients can see whether their website is doing its job. We built it ourselves and it is deliberately dull:

• No third-party analytics. No Google Analytics, no social-media trackers, no session recording. (The one advertising pixel, on preview websites only, is explained under Cookies below.)
• No tracking cookies from the counter. It doesn’t use cookies at all.
• We never store your IP address. We store a one-way scrambled version of it (a salted hash), which lets us tell two visits apart without knowing whose they are. It can’t be turned back into an address.
• Referrer hostname only. If you arrived from a search engine we record “google.com”, never the full link you clicked.
• A random session ID is kept in your browser’s local storage and expires after 30 minutes of inactivity. It groups your visits into one session. It is ours alone, it isn’t a cookie, and it follows you nowhere else.
• Rough device type (phone, tablet, desktop) and, when the network happens to tell us, the country.

The counter runs across the platform, but only views that belong to a client’s website are kept. Everything else — including your view of this page — is discarded the moment it arrives and never written down.

Cookies

One cookie exists for people who sign in to a dashboard we run: it keeps you signed in.

Advertising on preview websites. Before a business is our client, we sometimes build it a preview website to show what its new site could look like. Those preview websites load the Meta (Facebook) pixel. It sets an advertising cookie so we can show our own ads on Facebook and Instagram to people who looked at one. It never runs on a client’s live website, or on the rest of this site. You can turn these ads off in your Facebook or Instagram ad settings.

Part two — websites we run for our clients

If you booked an appointment, sent a message or bought something through a website we built for a local business, the business decides what gets collected and what it’s for. We hold it for them and act on their instructions. Depending on the business, that can include:

• your name, email address and phone number
• appointment and booking details — the service, the date and time, and any notes you leave
• order and delivery details
• messages you send through their contact form

Payments. Payments run through Stripe. Card details go from your browser straight to Stripe. Founders Studio never sees, handles or stores a card number — not on our servers, not in our database, not anywhere.

Tools the business already owns. Some clients run their bookings or memberships in software they’ve had for years. When a button on their site sends you there, you are on that company’s system under that company’s privacy policy. We never take a copy of what’s in it.

Getting something corrected or deleted. The fastest route is the business itself, because it’s their record. Ask us instead and we’ll tell you which business holds it, pass the request on, and take care of our side.

Who else touches the data

We keep this list short on purpose, and each company only gets what it needs to do its job. We do not sell or rent personal information — not to anyone, not for advertising, not ever.

• Render — runs the servers the websites live on.
• TiDB Cloud — the database where the records above are stored.
• Cloudflare — stores and delivers images and video.
• Resend — sends the transactional email: your booking confirmation, your receipt, the copy of the message you sent.
• Stripe — takes payments and bills our clients.
• Twilio — delivers text messages, only to people who agreed to receive them.
• Meta — receives page visits from preview websites only, through its pixel, so we can advertise to people who saw one.

Email we send

Everything these systems send is transactional — it exists because you did something. You booked, you ordered, you paid, you wrote to us. We do not run marketing campaigns from them. If a business you deal with sends a newsletter, that comes from separate marketing software with its own unsubscribe link.

Text messages

We text people only when they’ve asked us to — by ticking the unchecked-by-default box on our contact form, or by texting us first. What we send is about the work: replies to your inquiry, project updates, things we need from you, appointment reminders and billing notices. Message frequency varies. Message and data rates may apply.

• Stopping is one word. Reply STOP to any message and we stop texting that number. Reply HELP for help, or email bernardo@founders-studio.com.
• Consent is never a condition of buying from us. Leave the box unticked and we’ll email or call instead.
• Your number stays with us. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All the categories of sharing described in this policy exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties. The one company that handles the number is Twilio, and only to deliver the messages.

Websites we run for our clients can send text messages too — a booking confirmation, a reminder before an appointment — but only to customers who ticked that business’s own opt-in box, and the same rules apply: STOP ends it, and the number is never shared for anyone’s marketing.

How long we keep things

Contact-form messages and client records stay until they are no longer useful, or until somebody asks us to delete them. Nothing expires automatically today, and we’d rather say so than invent a schedule we don’t run. Records we have to keep for tax and accounting — invoices and payment records — we keep for seven years.

Getting a copy, or getting deleted

Email bernardo@founders-studio.com and tell us what you want:

• a copy of what we hold about you
• a correction to something that’s wrong
• deletion

We reply within 30 days, usually much sooner. We may ask a question or two to confirm you’re the person the record belongs to — we are not handing someone’s details to a stranger who asked nicely. If the record belongs to one of our clients, we’ll handle it together with them.

Children

This site isn’t aimed at children and we don’t knowingly collect anything from a child under 13. Where a client runs classes or events for kids, it’s a parent or guardian entering the booking details. If you think a child’s information reached us anyway, email us and we’ll delete it.

Keeping it safe

Every site we run is served over HTTPS. Each client’s data is kept separate from every other client’s. Dashboard access needs a sign-in, and only the people who need it have one. No system is perfect and we’re not going to pretend otherwise — which is exactly why we’d rather hold less information than defend more of it.

Changes to this policy

When this changes, the date at the top changes with it. If a change actually matters — a new kind of information, a new company touching it — we say so here, and our clients get an email about it.

Questions

Ask a person. That’s the whole point of a small studio.