Privacy Policy

Carpenter WebWorks LLC (“we”) builds and maintains websites for small businesses. This policy describes what this site collects, why, and who else handles it. It covers carpenterwebworks.com and carpenterweb.works, including the client portal.

It does not cover the websites we build for clients. Those are operated by the businesses that own them, under their own policies.

What we collect

When you submit the intake form

The form asks for your business name, industry, service area, whether you already have a website and its address, your primary goal, and your email address. We use it to prepare a proposal and to contact you about it. Nothing in the form is required for you to browse the site.

When you use the domain search

The name you type is sent to our server, which queries public domain registry records (RDAP) to check whether it is registered. The search term is not stored and is not linked to you. Your IP address is held briefly in memory to limit how many searches a single visitor can run in a minute, and is not written to a database or shared.

If you click through to register a domain, you leave this site. What happens after that is governed by Name.com’s privacy policy, not this one. See Affiliate links below.

When you have a client portal account

We hold your email address and an encrypted password, plus the material the working relationship produces: proposals, photographs you upload, messages you send us, project status, and payment records. We keep this for as long as you are a client and afterwards as long as we need it for tax, accounting, and legal purposes.

When you pay us

Payments are processed by Stripe. Card numbers are entered on Stripe’s systems and never reach ours. We receive confirmation of the payment, the amount, and the last four digits of the card.

When you subscribe to the newsletter

The subscribe form asks for your email address and which notes you want: our own notes, a market report for one trade, or both. We also record which page you signed up from, and when you signed up, confirmed, and unsubscribed. We store this in our database at Supabase. Nothing is sent to you until you click the link in a confirmation email, and an address that never confirms is never sent an issue. The confirmation and the issues are sent from our own Google Workspace email account by a script we run, not by a third-party mailing service.

Every issue ends with an unsubscribe link that works in one click, with no sign-in. Unsubscribing stops the mail and marks your address as unsubscribed. We keep that record so we do not mail you again. To have the address removed entirely, write to us as described under Your choices. The form uses Cloudflare Turnstile to screen out bots, which sends Cloudflare a one-time check token and your IP address. We do not store your IP address.

When you opt in to text updates

Our text-updates page and the Account page of the client portal ask for a mobile number and an unchecked box agreeing to receive texts from Carpenter WebWorks about your website project. We store the number, the exact consent wording you agreed to and its version, the date and time, whether you opted in on the public page or in the portal, and the IP address and browser the request came from. That record is what shows you asked for the messages. The public form uses Cloudflare Turnstile to screen out bots.

Messages are sent through Twilio, our SMS provider, once text updates are active; until then nothing is sent. Reply STOP to any message to opt out, or withdraw consent on the Account page of the portal. The program itself is described in our Terms of Service.

We do not sell or share your SMS opt-in data or personal information with third parties for marketing purposes.

Analytics

We use Cloudflare Web Analytics to count page views and measure load performance. It sets no cookies, does not fingerprint your device, and does not track you across other websites. We see aggregate numbers, not individuals.

Affiliate links

The domain search on our home page links to Name.com. We participate in Name.com’s affiliate program, so if you register a domain after following one of those links we may receive a commission. It costs you nothing extra, and it does not change what the search tells you: results come from the public registry record, not from a partner.

To attribute those clicks, our home page loads a tracking tag from Impact, the platform that runs the program. It sets cookies that record that you arrived at Name.com from this site. That tag runs only on the home page. It is not present on the client portal, the administrative pages, or this one.

Cookies

The session cookie is essential, and the portal cannot work without it. You can block the affiliate cookie in your browser and the domain search will behave exactly the same.

Who else handles your information

We use these providers to run the business. Each receives only what it needs for its function.

• Supabase, our database, file storage, and account sign-in.
• Netlify, which hosts and serves this site.
• Cloudflare, for analytics, network delivery, and the bot check on the newsletter and text-updates forms.
• Stripe, for payments.
• Twilio, for text messages to clients who opt in to text updates.
• Impact, for affiliate attribution on the home page.
• Google Workspace, which carries our email, including newsletter mail.
• Anthropic, whose AI models assist with drafting and with generating captions for photographs clients upload. Client material may be sent to that service to produce a result. It is not used to train their models.

We do not sell your personal information, and we do not share it for advertising. We disclose it only to the providers above, or where the law requires it.

Security

The site is served over HTTPS. Portal data sits behind authentication and row-level database rules, so one client’s records are not reachable from another client’s account. We do not store card numbers or full payment credentials anywhere. No system is perfectly secure, and we do not claim otherwise.

Your choices

Write to privacy@carpenterwebworks.com and we will, within 30 days:

• tell you what we hold about you,
• correct anything wrong,
• delete it, except where we are required to keep records, and
• send you a copy.

You do not need an account to ask, and we will not charge you or treat you differently for asking. If you are in a place with statutory privacy rights, such as California or the EU or UK, we honor those requests as a matter of course rather than by jurisdiction.

Children

This is a service for businesses. It is not directed at children, and we do not knowingly collect information from anyone under 13. If you believe a child has given us information, write to us and we will remove it.

Changes

If we change this policy we will update the date at the top. Material changes affecting existing clients will also be sent by email.

Contact

Carpenter WebWorks LLC, Gastonia, North Carolina.
hello@carpenterwebworks.com
privacy@carpenterwebworks.com for privacy requests
(302) 524-9679