Privacy Policy

Who we are

Weblux LLC, based in Louisiana, operates weblux.co ("Weblux", "we", "us"). For anything in this policy, write to us through the inquiry form at https://weblux.co/contact and a person will answer.

What we collect

Apart from server logs, payment confirmations from Stripe and the one link tag described below, everything we hold about you is something you typed. No data is bought from anyone.

• —The inquiry form: your name, email, business name, role, industry, team size, the software you run, what keeps getting stuck, and your timeline. Those are the questions you can see on the contact page. If you arrived on a link we posted on LinkedIn, Facebook, Instagram or our Google Business Profile, the form also sends which one, read from the link itself (the utm_source part of its address), so we know which profile brought the inquiry. Nothing else about your visit goes with it
• —Email: whatever you choose to write to us, and our replies
• —The client portal, if you are a client: your email address and name, what you write in reply to a request from us, and the files you upload against one
• —A survey, if you take one: your name, email, profession, your workplace if you give it, and your answers. Each survey says on its first screen what it is for and how long we keep the answers
• —Technical basics: our hosting provider (Vercel) and Cloudflare, which sits in front of it, keep standard server logs (IP address, browser type, pages requested) for security and reliability, under their own policies
• —During a form submission your IP address is used once, as a rate-limiting key to stop abuse. It is not stored with your inquiry and is never attached to it

What we do not collect

Browsing the public site sets no cookies of its own. The two exceptions are signing in to the client portal and taking one of our surveys, both described below. The site runs no advertising trackers and nothing that follows you to other sites. Visits are counted, without cookies and without profiles, and the next section says exactly how. If any of that changes, this policy changes first and the date at the top moves.

We never hold your password, because there is not one. Signing in to the client portal is a link sent to your email address, and the link expires in fifteen minutes.

The client portal, and its two cookies

Clients get an account on this site: an email address, a name, and which client business you belong to. There is no password. You ask for a sign-in link, we email it, and opening it signs you in.

Being signed in sets two cookies. The first holds a random session token and nothing else. It lasts thirty days and is renewed while you keep using the portal.

The second is a short-lived copy of your session, so a portal page can be answered without a trip to the database. It holds your name, email address and role, the session token, and the IP address and browser the session was opened from, which the sign-in system records with each session. It is signed, so it cannot be altered, but it is not encrypted. It lasts five minutes and is renewed as you use the portal.

Both are marked HttpOnly and Secure, so no script on the page can read them and they are never sent over plain HTTP. Signing out deletes both immediately. Neither is used for analytics, and neither follows you anywhere else on the internet.

What you upload against a request, such as a document, a screenshot or a logo, is stored as a private file. Private means the storage will not serve it to anyone without a signed-in session that belongs to your business; the address of the file is not enough. Everything you can see in the portal is scoped to your business, and we check that on every read instead of trusting the page you came from.

Surveys, and their one cookie

Starting one of our surveys sets one cookie, sent back only to that survey's pages. It holds a random respondent number and nothing else: no name, no email, no answers. It is what lets you stop partway and finish later on the same phone, and it lasts thirty days.

It is marked HttpOnly, so no script on the page can read it, and Secure, so it is never sent over plain HTTP. "Not you? Start fresh" on the survey deletes it. It is not used for analytics and it does not follow you anywhere else on the internet.

Analytics, without cookies

We use Vercel Web Analytics to count visits, because a site whose job is producing inquiries should know which pages earn them. It stores nothing on your device: no cookies, and no identifier that outlives the day. Repeat views are de-duplicated with a short-lived hash of the incoming request that expires within a day and is never written to your browser.

What we see is aggregate: which pages were visited, how many times, from which countries and browsers. What we never see is a profile of a person, and nothing about your visit is shared with advertisers or joined to data from anywhere else.

How we use what you send

To reply to you, to prepare for and run a free consultation, to deliver an engagement if one follows, and to keep the ordinary records a business is required to keep. That is the list.

We do not sell your information, rent it, or trade it. We do not use it to train AI models, and we do not paste it into consumer AI tools.

Where it lives

Named, because “trusted third-party providers” tells you nothing. Each of these processes data only to provide its service to us:

• —Vercel: hosts this site, stores submitted inquiries and client portal uploads as private files, and runs the cookieless visit counting
• —Cloudflare: answers DNS for weblux.co and sits at the edge in front of the site, so every request to the site passes through it
• —Neon: runs the database behind the client portal and the surveys, which holds accounts, updates, requests, invoice records and survey answers
• —Stripe: takes payment when a client pays an invoice or starts a care plan
• —Resend: sends the email the contact form produces to our inbox, and sign-in links to clients
• —Forward Email: receives mail sent to a weblux.co address and forwards it to the inbox we read
• —Google (Gmail): holds the inbox that forwarded mail and contact-form notifications land in
• —MyCo: the business software we run Weblux on, where an inquiry becomes a customer record and a lead we follow up from

Paying us

Card details go to Stripe and never to us. The card form in the portal is Stripe's, running inside our page; the numbers you type go straight to Stripe and our servers never see them. What we hold is what Stripe tells us afterwards: that an invoice was paid, when, and the last four digits it was paid with.

We do not store card numbers, and there is nothing we could leak if we tried.

Client data during an engagement

If we build against the systems you already run, your business data stays in them. If any part of a build would send your data to a third-party AI service, you are told which service and asked in writing first, and you can say no and still have the build. We will never ask you to email us a password, an API key, or a recovery code.

How long we keep it

Enquiries and correspondence are kept while we might work together, and afterwards for as long as ordinary business records require. Ask us to delete yours and we will, unless a legal obligation requires keeping it. In that case we tell you which one.

Portal records and the files you upload are kept for the engagement plus twelve months, so a question about what was agreed can still be answered a year later. Ask for them sooner and we delete them sooner. We keep invoice and payment records for as long as tax law requires. Stripe keeps its own records of each payment under its own policy.

Your choices

One message through the form at https://weblux.co/contact covers all of it: ask what we hold about you, ask us to correct it, or ask us to delete it. There is no verification maze. We hold little enough that answering is easy.

Children

This site is written for people who run businesses and is not directed at children under 13. We do not knowingly collect information from them.

Changes

The effective date at the top moves when the substance does. A material change gets a plain note on this page, not a silent edit.