Privacy
What we collect, why, and how to ask us to stop. Plain English.
The short version
We collect the minimum we need to reply to you, build your site and keep this one running. We do not sell or trade your data, and we do not use advertising or cross-site tracking cookies. Email hello@deftpath.com at any time to see, export, correct or delete what we hold about you.
What we collect, and why
- Enquiries — your name, email, business name and message when you use the contact form or email us. Used to reply and prepare your preview.
- Project details — the content, images and brand assets you share so we can build your website.
- Payments — processed by Stripe. We see the receipt; Stripe handles the card.
- Analytics — anonymised, aggregate page views via Vercel Web Analytics. No advertising cookies, no profiling.
- Server logs — IP address, user agent and requested URL, kept briefly to prevent abuse and diagnose outages.
Google user data
The DeftPath app (app.deftpath.com) lets a signed-in user connect a Google account with “Connect with Google”, so replies to their email conversations go out from their own address and meetings land in their own calendar. We ask only for the access that needs:
- Your Google email address (
openid,email) — to show which account is connected. - Send email as you (
gmail.send) — to send the replies you write or approve in the app. This permission cannot read, search or delete anything in your mailbox, and we don’t. - View and edit calendar events (
calendar.events) — to show your events in the app’s calendar and to create, move or cancel meetings you book from it, including sending invites to the attendees you choose.
How we store it. We keep the OAuth refresh token Google issues, encrypted with AES-256-GCM, and the connected email address. Calendar events are fetched from Google when you open the calendar and are not stored; for meetings booked through the app we keep the event’s ID and time next to the conversation it belongs to.
How we share it. We don’t sell Google user data, use it for advertising, or share it with anyone, except as needed to run the features above (our hosting and database providers store it on our behalf), to comply with the law, or to protect against abuse. We don’t use it to train AI or machine-learning models, and no person at DeftPath reads it unless you ask us to for support, it is needed for security, or the law requires it.
Removing access. Disconnecting the account in the app deletes the stored token and revokes our access with Google. You can also remove DeftPath at myaccount.google.com/permissions, or email hello@deftpath.com to have everything we hold deleted.
DeftPath’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Cookies and local storage
We set no advertising cookies. Your browser stores your light/dark theme preference locally; it never leaves your device.
Who processes your data
- Vercel — hosting and analytics.
- Resend — sending form emails and confirmations.
- Stripe — payments.
- Calendly — if you book a call.
- Google — sending email and calendar events for accounts you connect.
Some processors are based in the United States and use standard contractual safeguards.
How long we keep it
Enquiries for up to 24 months, client records for the length of the engagement, and invoices for as long as tax law requires. Google tokens are kept until you disconnect the account or ask us to delete them.
Your rights
You can ask to access, export, correct or delete your data, or object to how we use it. Email hello@deftpath.comwith “privacy” in the subject and we will reply within 30 days.