Privacy Policy

Scope

This Privacy Policy applies to the Inbox Welcome marketing and content website at inboxwelcome.com, including its articles, contact form, newsletter signup, resource-request forms, quizzes, service-request forms such as nonprofit Power Up Hour requests, Advisory Hour scheduling links, and service checkout links (the “Website”). It also applies to information you submit through forms, scheduling, intake, client-management, or checkout pages we offer through third-party providers, and to related email communications.

Information we collect

Information you submit. The contact form collects your first and last name, email address, inquiry type, message, and any optional organization or website information you provide. Newsletter and resource-request forms collect your email address, an optional name where offered, and your consent choice. Tally-hosted quizzes and service-request forms, including nonprofit Power Up Hour requests, collect the answers you provide and, where requested, contact, organization, or website information. TidyCal-hosted Advisory Hour scheduling pages collect the contact and booking details you provide, the date and time you select, and any responses or notes you submit. We also keep the content of messages you send us and our replies.

Payment and transaction information. When you purchase or book a paid service, Stripe receives and processes your payment-method details directly. We and the providers involved in the booking or checkout receive limited transaction information, such as your name, contact information, service or booking, amount, payment status, date, and transaction reference, rather than your full payment-card number.

Analytics information. We use UserMaven to understand Website traffic and use. It may process page views, referring pages, browser and device information, operating system, approximate location, and interactions such as link or button clicks. UserMaven is served through the white-labeled host here.inboxwelcome.com but is operated by UserMaven. We use its strict, cookieless mode, which uses an IP address and user-agent information to generate a pseudonymous visitor identifier. We have disabled UserMaven’s automatic form-field tracking, so analytics is not configured to collect the values you type into Website forms.

Technical and security information. The Website and our infrastructure providers may receive standard network and request information, such as IP address, date and time, requested URL, referrer, user agent, and diagnostic or security events. Our current web server is not configured to retain a routine per-request access log, but hosting, network, operating-system, and security services may retain limited operational data. To prevent form abuse, the Website temporarily stores a one-way hash derived from an IP address or session identifier.

Cookies and local storage

UserMaven’s strict mode does not set analytics cookies. The Website uses short-lived, necessary cookies and server-side sessions to protect forms against cross-site request forgery, enforce minimum completion times, and remember a successful submission when you return from a confirmation page. A Kirby session normally expires after about 30 minutes of inactivity, and a submission-success cookie expires after 10 minutes. The abuse-prevention hash normally expires after 15 minutes.

How we use information

We use information to respond to inquiries; provide requested resources and quiz results; evaluate and respond to service requests, including nonprofit Power Up Hour requests; schedule and provide Advisory Hours; manage leads and client relationships; process payments and maintain transaction records; send the newsletter when you have expressly subscribed; maintain consent, delivery, request, booking, and business records; understand and improve the Website; prevent spam, abuse, and security incidents; operate and troubleshoot our systems; comply with law; and establish, exercise, or defend legal claims.

Email and newsletter choices

Submitting a contact form, completing a quiz, requesting a resource or service such as a nonprofit Power Up Hour, or scheduling an Advisory Hour does not automatically subscribe you to marketing email. We add you to the newsletter only when you select an express newsletter-consent option or submit the dedicated newsletter form. Resource delivery, quiz results, booking messages, and replies to your inquiry or request may still be sent as requested transactional communications.

You may unsubscribe from marketing email at any time using the unsubscribe link in an email or by contacting us. We may retain limited suppression information so that we can honor your request.

How we disclose information

We do not sell or rent personal information, and we do not use it for third-party targeted advertising or cross-context behavioral advertising.

We disclose information only as reasonably necessary to providers that help us operate the Website and communicate with you. These providers currently include UserMaven for analytics; Tally for quizzes and service-request forms, including nonprofit Power Up Hour requests; TidyCal for Advisory Hour scheduling; Moxie for customer relationship management and related client administration; Queue for hosted service checkout and related client flows where used; Stripe for payment processing; Brevo for transactional contact email; Google Workspace for receiving and managing business email and form notifications; Encharge for resource delivery, newsletter subscriptions, and consent records; Oracle Cloud Infrastructure for hosting; Cloudflare for network, DNS, and security services where enabled; and Google Cloud Storage for encrypted backups. These providers process information under their own terms and privacy commitments and may process it in countries other than your own.

We may also disclose information when required by law; when reasonably necessary to protect rights, safety, and security; to professional advisers; or in connection with a merger, financing, acquisition, reorganization, or sale of all or part of the business, subject to appropriate protections.

Third-party websites

Some Inbox Welcome forms, scheduling pages, intake pages, client-management pages, and checkout pages are hosted by Tally, TidyCal, Moxie, or Queue, with payments processed by Stripe where applicable. When you use them, the information you submit is transmitted directly to the relevant provider so it can provide the requested service on our behalf. The provider may also collect technical or usage information to operate and secure its service, subject to its own privacy policy. The Website also links to other third-party sites that we do not control, and this policy does not govern those independent sites.

Retention

We do not apply one fixed deletion schedule to every type of information. Retention varies by the record, its purpose, and the provider that stores it. We may archive contact inquiries, quiz responses, service requests, booking details, CRM and client-administration records, payment and transaction records, email communications, consent records, and related provider records while reasonably needed for correspondence history, an ongoing or potential business relationship, providing a requested service, tax, accounting, legal or compliance obligations, security, or resolving disputes. Newsletter information is retained while you are subscribed and as needed afterward to maintain an unsubscribe or suppression record. Analytics information is retained according to our UserMaven account configuration and plan.

Contact records are included in encrypted backups that currently retain seven daily, four weekly, and six monthly snapshots. Information deleted from the active Website may remain in those backups until the relevant snapshot expires. Short-lived form and rate-limit data expire on the schedules described above.

Your choices and privacy requests

You may ask us to provide access to, correct, or delete personal information associated with you. You may also object to or ask us to restrict certain processing where applicable law provides that right. We may need to verify your identity before completing a request, and legal exceptions may apply. We will respond as required by applicable law.

The Website does not currently respond differently to browser “Do Not Track” or Global Privacy Control signals because we do not sell or share personal information for targeted advertising. We do not allow advertising networks to track your activity across unrelated websites through the Website. You may use browser controls, content blockers, or script blockers to limit analytics requests, although some security or form features may not work as intended.

Children’s privacy

The Website is intended for business and professional audiences, not children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has submitted personal information to us, contact us so we can investigate and delete it where appropriate.

Security

We use reasonable administrative and technical safeguards designed to protect information, including HTTPS, restricted access to private contact records, abuse controls, and encrypted off-server backups. No internet transmission or storage system is completely secure. Please do not submit passwords, payment-card data, health information, or other highly sensitive information through the contact form or ordinary email.

Changes to this policy

We may update this policy as the Website or our legal obligations change. We will post the revised policy here and update its effective date. If a change materially affects how we use information already collected, we will provide additional notice when appropriate.