Privacy Policy

This Privacy Policy explains how Elmhurst Codecraft handles personal information in connection with its web development services, business communications and website at elmhurstcodecraft.com. It applies to website visitors, prospective clients, client representatives and people who contact us about a project. The business correspondence address and contact details appear at the end of this policy.

Our services concern business websites, landing pages, website redesigns, content management systems, website integrations and maintenance. This policy describes our own handling of information. A client remains responsible for the privacy notices and lawful processing carried out through a website that we develop for that client.

The project brief is a local browser tool. It checks required fields and displays a confirmation on your device. The custom form does not email its contents, submit them to an enquiry database or create a client account. Pressing its confirmation button does not deliver an enquiry to Elmhurst Codecraft. To contact us, send a separate email to projects@elmhurstcodecraft.com.

The form asks for a name, email address, company name, service selection and project description. These values are used only to validate the brief in the current page. The form is cleared after a valid confirmation. Its reference is a temporary on-screen label, not a ticket in our systems or proof that we have received a message. The tool does not deliberately retain form entries in cookies, local storage or session storage.

If you contact us by email, phone or an agreed communication channel, we may receive your contact information, business name, role, project requirements, messages and attachments. If a project proceeds, relevant records can include the agreed scope, approvals, supplied materials, invoices, payment status and delivery correspondence.

Please limit the information you provide to what is necessary for the discussion. Do not put passwords, private account credentials, payment card numbers, government identification numbers, health information or other sensitive personal information in a general enquiry. If development requires access to a system, we agree on an appropriate access method separately.

The hosting platform and supporting infrastructure may process technical information needed to deliver and secure the website, such as an IP address, browser type, device information, requested pages, request times and diagnostic events. Our storefront is built on Shopify, whose platform services may process information in accordance with its own role and configuration.

The custom sections do not introduce an advertising pixel, a session recording tool or an external analytics script. Platform features, consent settings and separately installed applications may have their own technical behavior. The Cookie Policy explains the difference between the custom page code and platform-level technologies.

We use relevant business communications to understand a proposed project, prepare and discuss a scope, answer questions, carry out agreed services, manage revisions and provide a handover. Contact details help us communicate with the right people and arrange decisions about the work.

Where a business relationship exists, we may also need records for invoicing, accounting, resolving disagreements, preventing misuse and meeting applicable legal obligations. Technical information can support page delivery, fault diagnosis and protection against abusive traffic. We do not use the local brief confirmation as permission to add a visitor to a marketing list.

Where applicable privacy law requires a legal ground, the relevant ground depends on the activity. Processing necessary to respond to a project request or provide contracted services may be based on steps before a contract or performance of that contract. Accounting and other legally required records may be processed to meet legal obligations.

Business administration, security and proportionate record keeping may rely on legitimate interests where that basis is available and appropriate. Consent is used where required for optional communications or non-essential tracking. Where consent is the basis, it may be withdrawn for future processing without affecting processing lawfully carried out before withdrawal.

A client may supply content, account access or data needed to implement an agreed website. We ask clients to provide only the material necessary for the specific task and to ensure that they have authority to share it. Live customer data should not be supplied when sample or anonymized information will meet the development need.

If we handle personal information on a client’s instructions as a service provider or processor, the project agreement and any required data processing terms govern that work. Those terms should identify the instructions, permitted uses, relevant providers and return or deletion arrangements. This general policy does not replace a project-specific data processing agreement.

Relevant information may be handled by the providers needed to operate the website, communicate with clients, administer invoices or support an agreed development task. The categories can include website hosting, business email, file storage, accounting and a specific integration provider selected for a project. Information should be limited to what that provider needs for its role.

Information may also be disclosed when required by applicable law, a valid legal request, or a need to establish or defend a legal claim. We do not intentionally publish client contact details or project materials as website content without the relevant permission.

The custom website experience does not sell the information typed into the local project brief or transmit it to an advertising network. It does not create a marketing profile from that brief. Any optional marketing activity must be separately explained and operated under the applicable consent and privacy rules.

We do not treat a business enquiry as open-ended permission to distribute personal information to unrelated businesses. If a material change introduces a new use or provider, this policy and any required notice or choice must be updated to reflect the actual activity.

Information is retained for the time reasonably needed for its purpose, the business relationship and applicable legal obligations. The local brief entries are not retained by the custom tool after it is cleared. Email communications and project records may need to be kept longer than an informal enquiry to administer a project or address a later question about the work.

Relevant retention considerations include whether a project is active, whether an invoice or dispute remains unresolved, the nature of the record, and any mandatory accounting or legal period. When retention is no longer necessary, information should be deleted, returned or anonymized using an appropriate method. Backups may follow the provider’s normal deletion cycle rather than being removed instantly.

We use reasonable administrative and technical measures appropriate to the information and the work, including limiting access to relevant systems and avoiding unnecessary collection of sensitive information. Clients are responsible for secure account credentials, their own devices and the permissions they grant to a project.

No website, email service or storage method can be guaranteed completely secure. If you believe that information or an account involved in a project has been compromised, contact us promptly and explain the system affected. Do not send additional sensitive information in an initial incident message.

Elmhurst Codecraft is based in the United States. Communications and service providers may involve processing in the United States or in other locations used by those providers. Privacy laws can differ between locations.

Where a transfer is subject to a specific legal restriction, the required transfer arrangements must be addressed before the relevant processing takes place. This policy does not claim that Elmhurst Codecraft is certified under a particular international framework or that every provider processes information only in one country.

Depending on the law that applies to your circumstances, you may have rights to request access, correction, deletion, restriction, portability, or an objection to certain processing. Where applicable, you may also withdraw consent or use a right to appeal a decision on a privacy request. Not every right applies to every record or every business.

Send a request to projects@elmhurstcodecraft.com, identify the relationship involved and explain what you would like us to do. We may ask for proportionate information to verify identity and authority before disclosing or changing a record. We respond within the time required by applicable law and explain any lawful limitation, such as a record that must be kept for accounting or a legal claim.

Our services and this website are directed to businesses and adult representatives. The project brief is not intended to collect information from children, and we do not knowingly solicit personal information from children under 13 through it.

If you believe a child has provided information to us through a separate communication, please contact us so that the matter can be reviewed and appropriate steps taken. A client who operates a child-directed website must disclose that requirement before any development work involving personal information begins.

We may revise this policy when website functions, service arrangements or legal requirements change. The last updated date identifies the version posted here. Material changes requiring a separate notice or consent will be handled as required by applicable law.

The policy should be read together with the Cookie Policy and the terms agreed for an actual project. If you have a question about a particular communication or record, provide enough context for us to locate the relevant business interaction.