Your data, plainly explained

StephensCode LLC (“StephensCode,” “we,” “us,” or “our”) is a veteran-owned, Texas-based web development, managed IT, and business automation company. This Privacy Policy explains how we collect, use, disclose, and protect Personal Information when you:

• visit our website at stephenscode.dev;
• create or use an account in our customer portal at customer.stephenscode.dev;
• submit a contact form, quote request, or demo appointment request;
• purchase a website package, add-on, managed IT plan, or other service from us; or
• otherwise interact with us online

(collectively, the “Services”).

By using the Services, you agree to the collection and use of information in accordance with this Policy. If you do not agree with this Policy, please do not use the Services.

This Policy does not apply to third-party websites, applications, or services that we do not own or control, even if linked from the Services, or to the fictional sample data displayed inside our interactive industry demo pages (see Section 7). “Personal Information” in this Policy means information that identifies, relates to, describes, or could reasonably be linked, directly or indirectly, with you or your household.

We use the Personal Information described above to:

• provide, operate, and maintain the Services, including your customer portal account and order history;
• process payments, subscriptions, invoices, and refunds;
• respond to your inquiries, quote requests, and support, update, and module requests;
• schedule and confirm demo appointments and consultations;
• send transactional communications, such as order confirmations, receipts, appointment confirmations, and account notices;
• maintain, secure, and improve the Services, including through website analytics;
• communicate with you about our services, consistent with your preferences and applicable law;
• detect, investigate, and prevent fraud, abuse, and security incidents;
• comply with our legal, tax, and accounting obligations; and
• enforce our agreements and protect our legal rights.

We do not use your Personal Information for any purpose materially different from what is described in this Policy without notifying you.

We do not sell your Personal Information for money, and we do not disclose it to third parties for their own direct marketing purposes. We share Personal Information only as follows:

Service providers

We use the third-party service providers below to operate the Services. Each processes Personal Information only on our behalf and for the purposes described here.

Legal requirements and safety

We may disclose Personal Information if required to do so by law, subpoena, or other legal process, or where we believe in good faith that disclosure is necessary to protect the rights, property, or safety of StephensCode, our users, or the public.

Business transfers

If StephensCode is involved in a merger, acquisition, financing, reorganization, or sale of some or all of its assets, Personal Information may be transferred as part of that transaction. We will notify you of any such change in ownership or use of your Personal Information through this Policy or a notice on our website.

With your consent

We may share Personal Information for any other purpose disclosed to you at the time of collection, or with your consent.

stephenscode.dev uses the following analytics tools, each loaded on every page unless noted otherwise:

• Google Analytics (GA4). Sets cookies (such as _ga and _ga_*) that can persist for up to two years, and reports page views, approximate location, and device/browser information back to Google. GA4 is not loaded for visitors whose browser sends a Global Privacy Control signal — see Section 18.
• Ahrefs Web Analytics. Per Ahrefs' own documentation, this tool is cookieless and does not collect personal data or personally identifiable information by default.

We do not currently use advertising or remarketing pixels of our own. Our content security policy allow-lists a small number of additional Google analytics-related domains as a defensive/technical measure; we do not knowingly use them for advertising, but because Google Analytics' own configuration (such as Google Signals) can, in some configurations, be interpreted as “sharing” Personal Information for cross-context behavioral advertising under the CCPA/CPRA, we treat that as a possibility and honor opt-out signals as described in Section 18 out of caution.

Local and session storage

We also use limited browser storage that never leaves your device and is not Personal Information: a session-storage flag that remembers you've entered the password on a password-gated proposal page, and local-storage data that powers the fictional shopping-cart and order simulations on our interactive demo pages (see Section 7), which is cleared automatically.

Managing cookies

Most browsers let you block or delete cookies through their settings. You can also install the Google Analytics Opt-out Browser Add-on to prevent your data from being used by Google Analytics on any website. Blocking cookies may affect the functionality of some features of the Services.

We retain Personal Information for as long as necessary to provide the Services and fulfill the purposes described in this Policy, unless a longer period is required or permitted by law:

• Customer portal account data: for as long as your account remains active, and for a reasonable period afterward in case you wish to reactivate it or as needed for our legal and accounting obligations.
• Transaction and billing records: for as long as required by applicable tax, accounting, and financial recordkeeping laws (typically at least seven years).
• Contact form and quote request submissions that do not lead to an engagement: generally up to 24 months.
• Website analytics data: according to the retention settings configured within Google Analytics; we do not independently extend that retention period.

You may request earlier deletion of your Personal Information as described in Section 17, subject to our legal and legitimate business retention needs.

We implement administrative, technical, and physical safeguards designed to protect Personal Information from unauthorized access, use, disclosure, alteration, or destruction, including encrypted transmission (TLS) for data sent to and from the Services, and reliance on payment and infrastructure providers — including Stripe, Google Cloud/Firebase, and Vercel — that maintain their own security programs. Access controls governing who and what can read or write Personal Information within our own systems are an active, ongoing part of this program, and we continue to strengthen them as our infrastructure evolves.

No method of transmission over the internet or method of electronic storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your customer portal password confidential and for using a strong, unique password. If you believe your account has been compromised, contact us immediately using the information in Section 23.

For more detail on our broader security program and the standards it is aligned to, see our Security & Trust page.

If you create an account at customer.stephenscode.dev, the following practices apply in addition to the rest of this Policy:

• Order linking. When you register using an email address that matches a previous guest purchase, we automatically associate that order history with your new account so it is visible in one place. If you would prefer your prior order history not be linked, contact us using the information in Section 23 and we will unlink it.
• Update and module requests. Descriptions and files you submit through the portal are shared internally with our team to scope and fulfill your request, and may be retained as part of your project history.
• Feedback. Feedback submitted for ratings below five stars is treated as private feedback to our team, as described in Section 2.1.
• Plan upgrades. Selecting an upgrade or add-on inside the portal initiates a checkout session directly with Stripe as described in Section 10; the portal itself does not process your card details.
• Authorized personnel. Our authorized personnel may access customer portal data as needed to provide support, process billing, and maintain the Services.

StephensCode LLC may not independently meet every threshold that triggers mandatory compliance with the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the “CCPA”). Regardless, we voluntarily extend the following rights to California residents as a matter of policy.

Categories of Personal Information we collect

In the preceding 12 months, we have collected the following CCPA categories of Personal Information, as described in Section 2: identifiers (such as name, email, phone number); commercial information (such as your order and transaction history); internet or other electronic network activity information (such as pages viewed and referring URLs); geolocation data (approximate, derived from your IP address); professional or employment-related information (such as a company name you provide to us); and account login credentials.

Account login credentials are the only category of Sensitive Personal Information, as defined by the CPRA, that we collect. We use it solely to authenticate you and secure your account — a permitted business purpose that does not trigger a right to limit its use under the CPRA.

Your rights

• Right to know what Personal Information we have collected, used, disclosed, and shared about you;
• Right to delete Personal Information we have collected from you, subject to certain exceptions;
• Right to correct inaccurate Personal Information;
• Right to opt out of the sale or sharing of Personal Information — see Section 18;
• Right to limit use and disclosure of Sensitive Personal Information (not applicable here beyond what is described above); and
• Right to non-discrimination for exercising any of these rights.

You may designate an authorized agent to submit a request on your behalf, subject to verification. We do not disclose your Personal Information to third parties for their own direct marketing purposes.

If you are a resident of Virginia, Colorado, Connecticut, Utah, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, or another state with a comprehensive consumer privacy law, you may have rights similar to those described in Sections 13 and 14, including rights to access, correct, delete, and port your Personal Information, and to opt out of targeted advertising, sale, or certain profiling. We will honor validated requests to the extent required by applicable law. Contact us using the information in Section 23 to exercise these rights, regardless of which state you live in.

To exercise any of the rights described in this Policy, email us at info@stephenscode.dev with “Privacy Request” in the subject line, or write to the mailing address in Section 23. Please include enough information for us to verify your identity — typically the email address associated with your inquiry, order, or account — and to understand your request.

We will respond within the time frame required by applicable law (for example, 45 days under the CCPA and TDPSA, extendable once by an additional 45 days with notice to you). There is no fee to submit a request, though we may decline unreasonably repetitive or manifestly excessive requests as permitted by law.

StephensCode is based in the United States, and our service providers — including Stripe, Google Cloud/Firebase, and Vercel — process and store data primarily in the United States, though they may maintain infrastructure in other countries. If you access the Services from outside the United States, your information may be transferred to, stored, and processed in the United States and other countries that may not have data protection laws equivalent to those in your jurisdiction. Where required, we rely on our service providers' own transfer safeguards (such as Standard Contractual Clauses) for these transfers.

We may update this Policy from time to time to reflect changes in our practices or for other operational, legal, or regulatory reasons. We will update the “Last updated” date at the top of this page when we do, and, for material changes, we will provide additional notice (such as an email to customer portal account holders or a notice on our website) before the change takes effect.