Privacy policy
Draft for counsel review, version of September 24, 2026. The draft states the intended terms and is not yet in force.
On this page
1. Scope
1.1 This Privacy Policy covers personal information that Ironstone collects through ironstonedesign.com, app.ironstonedesign.com, mysiteslive.com and the Storefronts.
1.2 Ironstone is accountable for that information under the privacy laws that apply to it. The privacy officer is Chris Chund, reachable at contact@ironstonedesign.com.
2. Information collected
2.1 Account information: the email address, the storefront name, the prices, and, for outreach, the legal name, the mailing address and the country the Seller supplies.
2.2 Billing information: Stripe’s identifiers for the Seller’s customer record and connected account. Stripe holds every card number and bank account, and Ironstone never receives either.
2.3 Client information: the business details a Client or a Seller enters for a Site, the Client’s email address, and the acceptance record with its date, its wording, and the IP address and browser details from which it was given.
2.4 Comments on a Preview: the comment, the part of the page it concerns and the name the commenter gives, if any. The commenter’s IP address is kept only as a salted hash, to limit repeated comments.
2.5 Intake information: the details, the description, the opening hours, the services, the logo and the photos a business sends through an intake form, its confirmation that it owns the photos and the logo or may use them, the time of that confirmation, and the IP address the form was sent from.
2.6 Business information in the lookup, described in the Prospect Data notice at ironstonedesign.com/legal/prospect-data/.
2.7 Mailbox information: the app password a Seller saves for outreach, sealed with AES-GCM when saved, and the replies received in that mailbox.
2.8 Technical information: the IP address and browser details in Cloudflare’s request logs, and one session cookie on app.ironstonedesign.com. The pages of ironstonedesign.com set no cookies.
2.9 Messages sent through the contact form on ironstonedesign.com, delivered to Ironstone by email.
2.10 Lead information: the name, email address, telephone number and message a visitor sends through the contact form on a Site, the visitor’s choice about marketing follow-up with the sentence shown beside it, and the page the message was sent from. The visitor’s IP address is kept only as a salted hash, to limit repeated messages. Taps on a Site’s call and text links are counted per day, with no visitor identifier.
3. Purposes
3.1 Ironstone uses personal information to open and run Accounts, build and host Sites and Previews, deliver each lead to the Client whose Site received it (and a copy to that Client’s Seller when the Seller asks for one), take payments and pay Sellers, send sign-in links and service notices, prevent abuse, and meet legal duties.
3.2 Ironstone does not sell personal information and does not use it for advertising.
4. Disclosure
4.1 The companies listed at ironstonedesign.com/legal/subprocessors/ process personal information for Ironstone under written terms.
4.2 A Seller sees the information of its own Clients and of the businesses its own lookups return. A Client and its Seller see the leads sent through that Client’s Site. Ironstone may disclose information where the law requires it.
5. Where information is stored
5.1 Ironstone’s service providers store and process information in the United States and other countries, where courts and authorities may obtain access to it under local law.
6. Retention
6.1 Sign-in links expire after fifteen (15) minutes, and sessions after thirty (30) days. A Preview and its files are deleted thirty (30) days after the build, or at once on takedown.
6.2 Account and Client information is kept while the Account is open and for thirty (30) days after it closes. Billing records are kept for six (6) years, as tax law requires.
6.3 A lead is kept for twenty-four (24) months, or until the Client or the Seller deletes it. Every lead of a Site is deleted ninety (90) days after the Site is taken down or canceled. Earlier versions of a Site are kept for ninety (90) days; the current version is kept while the Site exists.
6.4 The photos and the logo sent through an intake form are kept for at most seven (7) days before the automated check. Those that pass become part of the Site; the others are deleted. The intake record is kept with the Client information.
7. Access and correction
7.1 A person may ask to see, correct or delete the personal information Ironstone holds about that person, and may withdraw consent, by writing to contact@ironstonedesign.com. Ironstone shall answer within thirty (30) days.
7.2 A person may also complain to the privacy regulator that oversees Ironstone.
8. Security
8.1 The safeguards are described at ironstonedesign.com/security/.
9. Changes
9.1 Ironstone shall post any change to this Privacy Policy in the changelog, with its date, before the change takes effect.