Privacy Policy

Data Collected

• Email, name, time zone for booking and communication.
• Technical environment details for service delivery (OS, Hermes version).
• Payment metadata via Stripe (no credit card details stored).
• Intake answers you choose to submit before a session (goals, blockers, comfort level).
• Application details for Custom Builds and international business requests.
• Agreement versions, acceptance time, booking status, and written session notes or deliverables.
• Post-session feedback, ratings, and optional client-authorized testimonial submissions with identity preferences.
• Basic usage and device data when Google Analytics is enabled.

Client Feedback & Testimonials

Following completed engagements, clients may submit honest feedback. Private ratings (1–5) and private improvement suggestions are stored strictly for internal quality control and are never published or shared. If you explicitly choose to grant publication consent for a client testimonial, only the quote and attribution preference (Full Name, First Name Only, or Anonymous) you select will be published on Client Stories and/or featured marketing surfaces. You may withdraw publication consent at any time by contacting us, upon which public testimonials are immediately removed.

Service Providers

Vercel hosts the site; Neon stores application records; Stripe processes checkout, billing-country verification, receipts, and refunds; Resend sends transactional email; the configured authentication provider manages sign-in; and Google Analytics may process basic site-usage data. Sessions use Google Meet. Attended hands-on access, when you authorize it, uses Chrome Remote Desktop. Those Google services process meeting and connection metadata under their own terms. Sessions are not recorded.

Retention

Intake answers, applications, written session notes, and ordinary service records are retained for up to 24 months after the last engagement, then deleted or anonymized unless a shorter deletion request applies or longer retention is required for disputes, tax, payment, fraud-prevention, or legal obligations. Payment records and agreement evidence may be retained for the applicable financial and legal recordkeeping period. Remote-support codes are not stored.

Data Boundaries

Do not submit credentials or confidential datasets through forms or email. During attended sessions, you enter passwords, MFA codes, API keys, and other secrets yourself. No unattended remote access is installed.

Your Rights

Request access, export, correction, or deletion through the Contact page or by emailing tony@aiowa.dev.