01
What we collect
In short What you type into our forms, cookieless visit counts, and IP addresses used only to stop abuse and to evidence signatures.
Form data. What you type into the intake, the contact form, and the Complete interest list: your name, email, phone or WhatsApp if you give it, your business details, and your message. Nothing more, and no payment card details ever touch our servers.
Cookieless analytics, run by us on our own server. Aggregate counts only: which page was viewed, which website sent you here (the site name, not the full link you clicked), the language and rough screen size of the visit, and which buttons get clicked. No cookie, no localStorage, no fingerprint, no advertising identifier, and your IP address is never stored. No analytics company is involved and no third-party script runs on any page, so this adds nobody to the list of processors below.
IP addresses, disclosed explicitly. We collect the IP address of anyone submitting a form, for two stated purposes only: stopping abuse (rate limiting and spam defense, where the address is stored hashed) and, on the e-signature page, recording the IP address and browser used to sign as evidence that the agreement was signed. That signature evidence is the only place an IP address is kept in raw form.
Chat messages. If you use the chat on this site, your message is sent to the AI provider to produce an answer. Conversations are not stored beyond usage counters.
Business-name lookups on the intake. The business-name field offers address suggestions as you type. Once you have typed at least three characters in that one field, our server sends that text to Google to fetch the suggestions, and sends an identifier for the entry you pick if you pick one. Nothing else from the form goes with it, and your browser never contacts Google.
Payment data. Payments run through Stripe. Stripe handles your card details directly; we see the result of a payment, not the card.
02
How we use it
In short To reply, quote, build, and protect the site. Nothing else.
We use what you send us to reply to you, to prepare a quote and your free homepage preview, to build and run your site, to bill for what you bought, and to protect our systems from abuse.
We do not use it for advertising, we do not profile you, and we do not send marketing you did not ask for. The Complete interest list is used for exactly one thing: telling you when Complete opens.
03
Who processes it
In short Stripe (payments), Google (Gemini API for the chat, Maps Platform for intake address suggestions), Resend (email), Cloudflare and DigitalOcean (hosting, and Cloudflare also as our domain registrar).
Stripe processes payments and subscriptions, including your card details, which we never hold.
Google, through the Gemini API, processes chat messages to generate answers.
Google, through Maps Platform (the Places API), processes the business name you type into the intake, so that the field can suggest your address instead of making you type it. It is the text in that one field, plus an identifier for the entry you pick, and nothing else from the form.
That Google lookup is made by our server, not by your browser. There is no Google key and no Google script on any page of this site, so Google does not receive your IP address or a record of your visit from it. It fires only from the business-name field on the intake, and only once you have typed at least three characters.
Resend delivers our transactional email (acknowledgments, reminders, receipts framing, notifications).
Cloudflare and DigitalOcean host and serve the site and the backend.
Cloudflare is also our domain registrar. If we register a domain for you, the contact details that name you as its registrant (business name, contact name, postal address, email, phone) go to Cloudflare and from there to the domain registry, because ICANN requires a named registrant of record for every domain that exists. Cloudflare redacts those details from public WHOIS lookups by default, so registering a domain through us does not put your address on a public page. This is the only part of our service that sends a client’s postal address to anyone.
Those five companies are our sub-processors. We do not add others without updating this page.
04
AI specifics
In short The chat runs on a paid API tier whose content is not used to train the provider's models; chat knowledge files are stripped of personal data; visitor conversations aren't stored beyond usage counters.
The chat runs only on a paid API tier, chosen specifically because the provider's free tier uses submitted content to train its models. Paid-tier content is not used for training.
When we prepare a knowledge file for a client chat, personal data in the source materials (customer names, contact details, message threads) is stripped out. Real conversations teach the question patterns, never the people.
Visitor conversations are not stored beyond usage counters, and the chat never asks visitors for personal details.
05
Retention
In short Intake leads for 24 months; contact-form messages are not stored at all; signed agreements kept as records.
Intake leads, meaning what you send through the project intake, are kept for 24 months, then deleted.
Contact-form messages are relayed straight to our inbox as email and are not stored on our servers at all. Once we have replied, the only copy is the one in our mailbox.
Complete interest-list emails are kept until Complete opens and we have told you, or until you ask us to remove yours, whichever comes first.
Signed agreements, invoices, and payment records are kept as business records for as long as the law and our accounting require.
Hashed IP addresses used for rate limiting are kept only as long as the counter window requires. Raw IP addresses kept as signature evidence live with the signed agreement.
06
Your rights
In short Ask to see, correct, or delete your information anytime.
Write to hola@parchalab.com and ask to see what we hold about you, to correct it, or to delete it. We reply within one business day and do it without making you jump through hoops.
Deleting a lead record is immediate. Records we are required to keep (signed agreements, invoices) stay, and we tell you which ones and why.
07
No sale, no trackers
In short We never sell personal data, and there's no cookie banner because there are no tracking cookies.
We never sell or rent personal data, and we do not share it with advertisers or data brokers.
This site sets no advertising cookies, no cross-site trackers, and no third-party pixels. That is why there is no cookie banner: there is nothing to consent to.
08
Children
In short This is a service for businesses, not for children.
Our services are sold to businesses and are not directed at children under 13. We do not knowingly collect information from children. If you believe a child sent us information, write to us and we will delete it.
09
Changes to this policy
In short The date at the top always shows the current version.
We may update this policy as the service changes. The date at the top of this page always reflects the current version, and material changes are described in plain language rather than buried.
10
Contact
In short One inbox, one WhatsApp number, one business day.
Privacy questions or requests: hola@parchalab.com or WhatsApp 248-954-9091. Parcha Lab, registered in Michigan, operating from Puerto Rico.