Privacy Policy

Last updated

This Privacy Policy explains how GridandMark LLC, doing business as Grid+Mark ("Grid+Mark," "we," "us"), collects, uses and shares personal information. It covers four groups of people:

  • Visitors to gridandmark.com;
  • Clients: businesses that subscribe to Grid+Mark, and the people who use their accounts;
  • Site visitors: people who visit a website we build and host for a client;
  • Prospects: businesses we contact about our services.

We don't sell personal information, and we don't use it for cross-site advertising.

1. Information we collect

Information you give us

  • Contact, preview and newsletter forms on gridandmark.com: name, email, phone, company, website, city, the kind of projects you build, budget, how you heard about us, and your message.
  • Checkout and billing: name, email and billing address. Card details go directly to our payment processor, Stripe. We never see or store full card numbers.
  • Account and onboarding: your name, business name, email, phone, city and state, your website and social profiles, brand colors, logo, a business bio, and your answers to our discovery questions.
  • Your site content: photos, project details, text, files, and the change requests you send through your dashboard or by email to requests@gridandmark.com.
  • Feedback on preview sites: the message you send and the site it's about.

Information collected automatically

  • Basic site analytics. On gridandmark.com and on client sites we record the page viewed, the referring page, your browser's user-agent string, and a random session ID that's cleared when you close the tab. We don't store your IP address in our analytics, and we filter out known bots.
  • Server and security logs. Our hosting provider, Cloudflare, processes IP addresses and request details to deliver pages, block abuse and keep logs for troubleshooting. We use IP addresses briefly to rate-limit public forms.
  • Cookies. These are mostly for sign-in and preview links. See our Cookie Policy.

Information from other sources (prospects)

To find businesses that might benefit from our services, we collect business contact information from public sources, such as company websites, Houzz and other directories. This can include your business name, owner or contact name, business email and phone, city, website, and publicly posted photos and text. We may take screenshots of your public website and use your public materials to make a preview website showing what we could build for you. Preview sites aren't indexed by search engines, and only people with the link can see them.

2. How we use information

  • to provide the Service: build, host and update sites, run your dashboard, and send you leads;
  • to process payments, manage subscriptions, and send receipts, renewal reminders and account notices;
  • to respond to inquiries and requests, and to provide support;
  • to send our newsletter, if you've signed up (you can unsubscribe anytime);
  • to contact prospects about our services, with a working way to opt out;
  • to understand how sites are used (page views and referrers) and to improve the Service;
  • to protect the Service: prevent fraud, spam and abuse;
  • to comply with legal obligations and enforce our Terms.

AI tools. We use AI services, currently from Anthropic, to help sort incoming requests, draft site copy, evaluate public websites, and build sites. They process the relevant information on our behalf, under terms that don't allow them to train their models on it.

3. How we share information

We share personal information only as described here:

Service providers that process it on our behalf, under contracts that limit their use of it:

  • Stripe: payments and billing;
  • Clerk: account sign-in, including "Sign in with Google";
  • Cloudflare: hosting, content delivery, storage and security;
  • Railway: database hosting;
  • Resend: transactional email, such as lead notifications and receipts;
  • Google Workspace: our email and calendar, including review-call bookings;
  • Anthropic: the AI processing described above;
  • Firecrawl: collecting content from public websites for prospect previews;
  • Behold: displaying Instagram feeds that clients connect.

Google Fonts. Some sites we build load typefaces from Google Fonts. When you visit those pages, your browser requests the font files from Google, which receives your IP address and browser details. Google's privacy policy describes how it handles that information.

Clients. When you submit a contact or lead form on a client's website, we send your information to that client. The client decides how to use it, under its own privacy practices.

Legal and safety. We disclose information if the law requires it, or to protect the rights, property or safety of Grid+Mark, our clients or others.

Business transfers. If Grid+Mark is involved in a merger, acquisition or sale of assets, information may transfer as part of that deal. It will remain subject to this policy's protections.

4. Client sites and the leads they collect

When we host a website for a client, we act as the client's service provider. If you contacted a builder through its website, the builder controls your information. Please contact the builder directly about it. We'll help our clients respond to requests about information we hold for them.

5. How long we keep information

  • Client accounts and sites: kept while the subscription is active, and for 90 days after it ends so the client can reactivate or request an export. After that we delete the site, its content and uploaded files, the leads it received, and its analytics.
  • Billing records: kept as long as tax and accounting laws require, typically seven years.
  • Backups: we keep encrypted-at-rest backup copies of our databases for up to 90 days, so deleted information disappears from backups within 90 days of being deleted from our systems.
  • Analytics events: individual page-view records are deleted after 13 months. We keep only aggregated counts after that.
  • Contact, preview and newsletter submissions: kept for up to 24 months after our last interaction, or until you ask us to delete them. Newsletter addresses are kept until you unsubscribe.
  • Prospect information: deleted 12 months after our last contact if you don't become a client. If we built a preview site for your business, we keep the preview (it's made from your public website) along with your business name, business email and website address, and delete the rest, including our correspondence. If you opt out, we keep only your email address and business name on a suppression list, so we never contact you again. You can ask us to delete a preview at any time.

6. Your choices and rights

  • Email. Unsubscribe from our newsletter or outreach using the link in any email, or by replying "unsubscribe." We honor opt-outs promptly, within 10 business days at most. Clients will still get essential account and billing emails.
  • Access, correction and deletion. You can ask us for a copy of the personal information we hold about you, or ask us to correct or delete it. Email kathryn@gridandmark.com and we'll respond within 45 days. We may need to verify your identity, and we may keep information the law requires us to keep.
  • California residents. We don't sell or share personal information for cross-context behavioral advertising, and we don't disclose it to third parties for their own direct-marketing purposes.
  • Do Not Track. Browsers' "Do Not Track" signals aren't consistently defined, so we don't respond to them. We also don't track you across other websites or allow third parties to do so on our sites.

7. Security

We use industry-standard measures to protect information: encryption in transit (HTTPS), access controls, and established infrastructure providers. No system is perfectly secure. If a breach affects your information, we'll notify you as the law requires.

8. Children

The Service is for businesses and isn't directed to children under 16. We don't knowingly collect their personal information. If you believe a child has given us information, contact us and we'll delete it.

9. Where information is processed

We're based in the United States, and we and our service providers process information in the United States.

10. Changes to this policy

We'll post any changes on this page and update the date at the top. If a change is material, we'll also email clients before it takes effect.

11. Contact

GridandMark LLC (Grid+Mark) · 1300 Kobbe Avenue, Unit B, San Francisco, CA 94129 · kathryn@gridandmark.com