Privacy policy

1. What we collect

What you type into the application

Your name, email address, city and state, what you are known for, how long you have been doing it, how full your book is, which booking platform you use, whether you have a website, and any package interest or notes you add. Phone number and Instagram handle are optional.

We ask for nothing sensitive. Please do not send us client records, health information, or anything about the people who sit in your chair.

What your browser sends

Standard server information such as IP address, browser type and the pages requested. This is normal web hosting activity and cannot be switched off, since it is how a page reaches you.

What we never collect

Card and bank details never touch this website. Payment happens through Stripe after a consult, and Stripe holds that data, not us. We also never ask for a booking platform login.

2. Cookies and analytics

Nothing analytical runs until you press Accept on the banner. Decline and the tools below are never loaded. Your choice is stored in your browser so you are not asked repeatedly, and you can change it by clearing site data.

• Google Analytics 4 — how many people visit, which pages they read, how far they scroll, and which buttons they press.
• Meta Pixel — lets us measure whether our Instagram and Facebook advertising works, and show ads to people who visited.
• Microsoft Clarity — heatmaps and session replay, meaning an anonymised recording of mouse movement, scrolling and clicks on the page. It is used to find where people get stuck. Keystrokes in form fields are masked.

We use one non-analytical item regardless of your choice: a small record of whether you accepted or declined. Without it we could not honour a decline.

3. Why we hold it

• To read your application and reply to it, which we do either way.
• To carry out work you have hired us for.
• To improve the website, using the analytics above.
• To send occasional updates, but only if you ticked the box.
• To meet tax and record-keeping obligations where money changes hands.

4. Who else sees it

We do not sell your details, rent them, or share them with advertisers. The only parties involved are the services that make the site run:

• Netlify — hosts the website and receives application form submissions.
• Google — analytics, and Google Business Profile where that is part of your build.
• Meta — advertising measurement, only after you accept cookies.
• Microsoft — Clarity, only after you accept cookies.
• Stripe — payments, only if you become a client.
• Email and calendar providers — to reply to you and arrange consults.

We may also disclose information where the law requires it.

5. Marketing email

The application form has an unticked box asking whether you want occasional emails. Leave it unticked and the only email you receive is the reply to your application.

If you tick it, expect no more than one a month. Every one carries a one-click unsubscribe link and our postal address, and unsubscribing is immediate and permanent. Replying to a client project is not marketing and continues regardless.

6. How long we keep it

• Applications we declined — 12 months, then deleted.
• Applications that became clients — for the length of the relationship and 7 years after, for tax records.
• Marketing subscribers — until you unsubscribe.
• Analytics — as long as the retention settings in each tool allow, currently 14 months in Google Analytics.

Ask us to delete sooner and we will, except where tax law requires us to keep a record.

7. Your rights

Wherever you live, and regardless of which laws apply to a business our size, we will honour these:

• Ask what we hold about you and get a copy.
• Have anything inaccurate corrected.
• Have your details deleted.
• Opt out of marketing at any time.
• Object to how we are using something.

Email contact@strandidhq.com and we will act within 30 days. There is no charge and we will not make you justify the request. We will not treat you differently for making one.

We do not sell or share personal information as those terms are defined under California law, and we do not use it for cross-context behavioural advertising beyond the Meta Pixel described above, which only runs with consent.

8. Security

The site runs over HTTPS. It has no database, no login system and no admin panel, which removes most of the ways a small business website is normally broken into. Form submissions are held in Netlify behind two-factor authentication, and access is limited to the person operating Strandid.

No system is perfect. If a breach ever affected your details, we would tell you promptly and directly.

9. Children

This site is for business owners and is not directed at anyone under 16. We do not knowingly collect information from children. If you believe a child has sent us something, email us and it will be deleted.

10. Changes

We may update this policy. The date at the top shows the current version, and material changes will be noted on this page. Continuing to use the site after a change means the updated policy applies.

Questions, or to have your details deleted: contact@strandidhq.com