coderband sites Privacy Policy

Status: Draft · Effective date: not yet in effect (draft)

This policy explains what personal information coderband sites collects, why, how long we keep it and what you can ask us to do with it.

In short:

• We research local businesses from public sources and email the owner about a private preview of a new website. Reply "no thanks" and we delete the preview and never write again.
• On preview pages we count views without storing IP addresses or browser details, and we set no cookies for visitors.
• Stripe handles payments. We never see your card number.
• On our clients' websites, we handle contact-form messages for the business, and keep them for 90 days.
• We don't sell personal information, and we don't share it for advertising.

1. Who we are and what this policy covers

1.1 Who we are. coderband sites is a service of coderband LLC, a Wyoming limited liability company (Wyoming state ID 2025-001816694), of 75 E 3rd St, Ste 7, Sheridan, WY 82801, USA ("we", "us"). Contact: hello@coder.band.

1.2 What it covers. This policy covers coderband sites only:

• coderbandsites.com;
• the private preview pages at https://coder.band/sites/<name>/;
• the checkout and onboarding pages at https://coder.band/sites/-/;
• the editing panel at https://panel.coderbandsites.com;
• the emails we send for coderband sites; and
• what we do as a service provider for the websites we host for our clients (Section 7).

1.3 What it doesn't cover. coderband LLC's other services, and the rest of coder.band, are covered by coderband's own privacy policy at https://coder.band/privacy. Each client's website has its own privacy policy, and the business that owns it is responsible for it (Section 7).

2. Businesses we research and contact

2.1 What we collect. We look for US local businesses whose websites could serve them better. For each business we consider, we may keep:

• the business name and website;
• public contact details: business email address, phone number, and the owner's name if it is published;
• our notes, for example about the business's services and its current website;
• the emails we send, and when we send them;
• whether and when the preview we built was viewed (Section 3); and
• if anyone asks us to stop, a record of that (Section 2.4).

2.2 Where it comes from. Only public sources: the business's own website, its Google Business Profile, state licensing boards, the Better Business Bureau and its public social media pages. We write only to business email addresses published for contact.

2.3 Why. To decide whether we can help the business, to build a preview of a new website for it, and to email the owner about it.

2.4 Saying no. Every email we send includes our postal address and a way to opt out: reply "no thanks". We act on it within 10 business days, usually much sooner. We delete the preview and add the email address (or, if you ask, the whole business domain) to a suppression list. We keep that list so we never email you again; it holds only the address or domain and when it was added.

2.5 The preview itself. A preview shows only public information about the business, is unlisted and tells search engines not to index it. We delete it 30 days after our first email to the owner about it, or at once on request. If we never email, it expires on its own. If the owner buys it, it stays up while we put the site live.

3. Visiting a preview page

3.1 What we record. When someone opens a preview page, we record:

• the time;
• which page was opened;
• the country, as reported by Cloudflare; and
• whether the visit looks automated (for example, an email security scanner checking the link).

3.2 What we don't record. We don't store IP addresses or user agents (browser and device details). Your IP address is used for a moment as the key for a rate limit that protects the page from abuse, and is then discarded. Cloudflare, which carries every request to our pages, processes IP addresses to deliver and protect them, under its own policies.

3.3 Why. So we know whether the owner has seen the preview we built, and can tell real visits from automated ones.

3.4 How long. Up to 1 year.

3.5 Cookies. Preview pages set no cookies for visitors. The only cookie is one we set in our own staff browsers, so our own visits aren't counted. If a preview shows a map or widget the business already uses on its current site, that provider may set its own cookies under its own policy.

4. Buying and onboarding

4.1 Payment. You pay on a checkout page run by Stripe. Stripe collects your name, email address, phone number, billing address and card details. We receive your name, email address, phone number, billing address and the payment status. We never receive or store your card number. Stripe's privacy policy is at https://stripe.com/privacy.

4.2 Onboarding. To put your site live, we ask for your domain, your registrar, who manages your DNS, the email address you'll use to sign in to the panel, where form messages should go, and your corrections to the site.

4.3 Why. To take payment, deliver and host your site, issue refunds, answer your questions, and keep business records.

4.4 How long. Payment records for 7 years, for US tax and accounting purposes. Onboarding answers and our correspondence while we work together, and then as business records for up to 7 years.

5. Using the panel

5.1 What we keep.

• the email addresses allowed to sign in;
• sign-in links, stored only as a one-way hash, which expire after 15 minutes;
• sign-in sessions, which last up to 30 days; and
• a history of every edit, including who made it.

5.2 Why. To let you sign in securely, keep your site's content, and let you see and restore earlier versions.

5.3 Cookies. The panel uses one cookie to keep you signed in. It is needed for the panel to work and isn't used for anything else. coderbandsites.com and the checkout and onboarding pages set no cookies and run no analytics.

5.4 How long. Sign-in links until a day after they expire; sessions until they expire. The edit history for as long as we host your site. We also keep a security log of sign-ins and changes (who, what and when) for 2 years.

6. Email we send

• Outreach and replies come from our own mailbox, which is hosted by Apple (iCloud).
• Service emails (panel sign-in links, form notifications, blog drafts and alerts) are sent from coderbandsites.com through Cloudflare, as plain text.

We don't use tracking pixels or tracked links in any of our emails.

7. Visitors to our clients' websites

7.1 Our role. We host websites for our clients, which are local businesses. When you send a message through the contact form on one of those sites, we process it on behalf of that business, as its service provider. The business decides what it collects and why, and its own privacy policy applies. For questions about your details, contact the business first; we'll help it respond.

7.2 What happens to a form message. We email it to the business, with Reply-To set to your address so they can reply to you, and we store it for 90 days so the business can see it in its panel. Then we delete it from our systems. The copy in the business's inbox is under the business's control.

7.3 Chat assistant (if the business turns it on). Some client sites have an automated chat assistant. It says it is automated, and shows a notice before you write. Your messages are processed by us and by our AI provider, Anthropic, to generate answers from information the business approved; if you ask, the assistant passes your name, contact details and request to the business, like a form message. Conversations are kept 90 days. The chat page sets one cookie, only while you chat, so the conversation continues from message to message.

7.4 Cookies and analytics. Apart from that chat cookie, client sites we host set no cookies and include no analytics, unless the business asks us to add them. If it does, its privacy policy should say so.

7.5 What we don't do. We don't use form messages or visitor information for our own purposes, and we don't sell it or share it for advertising.

7A. Blog posts our clients send us

If a client uses our blog service, they email us notes, photos or voice memos about their work. We store the photos, transcribe voice memos (with Cloudflare's AI service), and draft a post with Anthropic's Claude from that material only. The client checks and publishes it. We keep what they sent for 90 days so they can check the draft against it; photos are kept while a post or their site uses them, then deleted within 30 days.

8. Cookies, tracking and Do Not Track

We don't use advertising trackers or cross-site tracking on any of the pages this policy covers, and we don't let third parties collect information about your activity across other websites through them. The cookies we do use are described in Sections 3.5, 5.3 and 7.3.

Do Not Track. Some browsers send a "Do Not Track" signal. Because we don't track you across websites, our pages behave the same whether or not your browser sends it.

9. Who we share personal information with

We share personal information only with:

• Service providers that act for us:
  • Cloudflare: hosting, storage, our database, sending service emails, and transcribing voice memos for the blog service;
  • Anthropic: its Claude models help us research businesses from public information and draft site content and emails, and, for clients who turn them on, answer chat messages and draft blog posts;
  • GitHub: private code repositories for the websites we build, which contain the sites' content;
  • Stripe: payments, refunds and fraud prevention. For some purposes, such as fraud prevention and its legal duties, Stripe acts under its own privacy policy; and
  • Apple: our email (iCloud).
• Professional advisers, such as accountants and lawyers, who must keep it confidential.
• Authorities, where the law requires it.
• A buyer or successor, if our business is sold or reorganized. They would have to protect it as this policy describes.

We don't sell personal information, and we don't share it for cross-context behavioral advertising.

10. How long we keep it

When we stop hosting a client's site, we take it offline at once and delete its files, photos, edit history, form messages, chats and posts 30 days later (time enough to send them their files if they ask), keeping only the business records listed above.

11. Your choices and rights

You can ask us to:

• tell you what personal information we have about you, and give you a copy;
• correct it;
• delete it; or
• stop contacting you.

Email hello@coder.band. We'll answer within 30 days. We may need to confirm who you are first. If you ask us to delete your information, we'll still keep a suppression entry if you've asked us not to contact you, and records we must keep by law, such as payment records.

If your request is about a message you sent through one of our clients' websites, we'll pass it to that business and help it respond (Section 7).

12. Security

We keep data with established providers, limit who can access it, protect our staff tools with sign-in checks, and store panel sign-in links only as one-way hashes. No system is perfectly secure, but we take reasonable care, and we'll tell you if a breach affects your information where the law requires it.

13. Children

coderband sites is a service for businesses. It is not directed at children under 13, and we don't knowingly collect personal information from them. If you believe a child has given us personal information, email us and we'll delete it.

14. Where we process data

We are based in the United States, and we process and store personal information in the United States, or wherever our service providers operate their systems. Our service is for US businesses.

15. Changes to this policy

If we change this policy, we'll post the new version here with a new effective date. If a change is material, we'll also email our clients before it takes effect.

16. Contact

coderband LLC (coderband sites) 75 E 3rd St, Ste 7, Sheridan, WY 82801, USA hello@coder.band