Privacy Policy

1. Who we are and what this covers

Bryan Builds builds and hosts websites for small businesses and gives each business an online dashboard. This policy covers this website (our plans, checkout and terms pages), the business dashboard where owners and their staff sign in, and the websites we host for our customers (on an address we provide or on their own domain). It explains what we collect, why, who we share it with, how long we keep it, and your choices.

2. Information we collect

When you buy online: your email address, your business name, your full name (typed to accept the agreement), the service and plan you chose, the exact agreement you accepted (its text, version and a digital fingerprint) and when, whether you authorized a monthly charge, and a one-way hash of your IP address that we use only to limit abuse. You enter your card details on Stripe's secure page; we never see or store your card number.

Your account (business owners and staff): your email address and name, your role and the business or businesses you belong to, contact addresses you have verified, a short label for each signed-in session (for example "Chrome on Windows" — never your full browser details) and when it was last used, and your light, dark or automatic theme choice. There are no passwords: you sign in with a one-time code sent to your email. A phone number is contact information only — it is never a way to sign in, and we do not send text messages.

Emailed sign-in codes: a 6-digit code. We store only a one-way hash of it; it works for 10 minutes, can be used once, allows at most 5 tries, and is replaced by any newer code.

Your business and your website: the information you or we enter about your business (for example services, prices, hours, contact details, descriptions and answers to our questions), photos and logos, website drafts, versions and approvals, and change requests. For a Website Upgrade we read the public pages and files of your current website and keep a backup copy; we never change your current website.

Leads and booking requests: when a visitor uses the contact form on a website we host, we store their name, email address and message, and that they ticked "I agree to be contacted about this request". Bookings and waitlist entries that a business records in its dashboard hold its customer's name, email address and phone number, the service, time and staff member, and a history of changes. On Website Only and hosting-only plans we email each visitor request to the business's verified Owners. The business decides how to use these records; we handle them on its behalf.

Payments and billing: from Stripe we receive and store your Stripe customer, subscription and invoice identifiers, amounts, currency, plan, payment status and dates (paid, failed, the end of the paid period, cancellation), and Stripe's event notices.

Domains: if we register a new domain for your business, we collect the registrant details the registrar requires — the business name, a contact name, email address, phone number and postal address — and send them to Cloudflare Registrar with the registration. The business is the domain's registrant. For a domain you already own, we store the DNS records needed to connect it and a copy of your previous DNS records so it can be switched back.

Support and notices: support requests (each with its request number, and any photos you attach to it) and the messages you exchange with us, and the notices shown in your dashboard (and whether their emails were delivered, as reported by our email provider: delivered, delayed, bounced or marked as spam).

Team schedules: if a business uses Schedule, the shifts it needs each week, each team member's schedule profile (name, email address, positions, weekly hour target and maximum, when they are available, days off and preferred days), the drafts and published schedules, and who was told about a schedule and when they confirmed it.

Agreements: when a business Owner accepts an agreement in the dashboard, we keep the typed name, role, account email, the agreement version and its fingerprint, the time, the IP address and the device label, as proof.

Activity and security records: a history of important account actions (who did what, and when), which is not deleted; and short-lived counters that stop abuse, keyed by a one-way hash of the IP address or by account or email address, which are deleted after their time window (minutes to an hour).

Bryan Builds team members: their work email, name and role. They sign in through Cloudflare Access.

3. How we use it

To provide the service (build, host and publish websites; run dashboards, bookings and leads; connect or register domains), to sign you in and keep accounts secure, to take payments and manage plans, to answer support requests, to send service emails (sign-in codes, invitations, account and website notices), to keep records of agreements and transactions, and to meet legal obligations.

We do not sell or rent personal information, use it for advertising, or build profiles.

4. Who we share it with

Only with the service providers that run the service:

• Stripe — payments, subscriptions, invoices, receipts and the billing portal.
• Resend — delivers our emails (the recipient's address and the email's content pass through Resend). Open and click tracking are turned off.
• Cloudflare — hosts the application and the websites, the database, file storage, DNS and SSL; Cloudflare Access (our team's sign-in); Email Routing (messages sent to our support address are forwarded to our private mailbox); and Cloudflare Registrar (domain registrations). All traffic passes through Cloudflare's network, which may process data in the United States and other countries.

We also share a website visitor's request with the business they contacted, and information when the law requires it or to protect the rights and safety of our customers, the public or us.

We don't use analytics, advertising or tracking services, an SMS provider, or an e-signature service (agreements are accepted in the dashboard). AI help with website wording (Cloudflare Workers AI) and importing Google reviews exist in the software but are turned off; we will update this policy before turning either on.

5. Cookies and storage in your browser

• One cookie, __Host-bws_session, when you sign in to your account: it keeps you signed in, can't be read by scripts, and lasts up to 30 days (it ends after 14 days of inactivity, or when you sign out).
• Your browser's local storage keeps your theme choice, the calendar view you last used in Bookings, your dashboard menu choice, and a Request Help message you haven't sent yet (removed once it is sent).
• While you sign in, the browser tab's session storage keeps the email address you asked a code for, for up to 10 minutes, so switching to your email app and back doesn't lose your place (never the code; removed once you're signed in or the tab is closed).
• Cloudflare Access sets its own sign-in cookie for Bryan Builds team members only, and Cloudflare may set cookies its security features need.

We use no analytics or advertising cookies, and the websites we host for businesses set no cookies.

6. How long we keep information

• Your account, business, website content and versions, team schedules, and support requests with their photos: while you are a customer. When a plan ends we do not automatically delete your website, domain or records — the website stays online for a grace period, then its hosting is marked inactive, and your website export stays available.
• Sign-in codes: only their hashes, and each code expires after 10 minutes.
• Sessions: up to 30 days (14 days if unused).
• Abuse counters: deleted after their time window.
• Website-visitor requests (leads): shown in the business's dashboard for one year and kept for up to two years, then deleted. The business or the visitor can ask us to delete them sooner, where permitted and technically applicable.
• Payments, purchases, signed agreements and account history: kept as records of transactions and agreements.
• Backups: we take a full backup of the database before updates, and Cloudflare keeps short-term restore points of our database.

7. Your choices and rights

• See and update your information in your dashboard, or email us to correct anything else.
• The Owner of a website bought online can download it at any time: its pages, photos and content, its current DNS records, and instructions for moving it.
• Ask us for a copy of your personal information, or to delete it, at the support email on our plans page. We respond within 30 days and delete eligible information, except records Bryan Builds reasonably needs to keep for payments and accounting, signed agreements, fraud prevention and security, disputes, legal obligations, or other legitimate required recordkeeping.
• Website visitors: contact the business you wrote to; if you contact us, we will pass your request to that business.
• Security and account notices can't be switched off; other notices follow each person's choices in Alerts.
• Depending on where you live, you may have more rights; contact us to use them.

8. Security

Every page uses HTTPS. Sign-in codes, session tokens and invitation links are stored only as one-way hashes. Every business's data is kept separate, and every request is checked against the person's membership of that exact business. Sensitive changes need a fresh code. Our team's workspace is behind Cloudflare Access, and card details stay with Stripe. No system is perfectly secure, but we work to protect your information.

9. Children

Bryan Builds is not intended for children under 13, and we do not knowingly collect their personal information.

10. Changes to this policy

We publish changes on this page with a new date. When a change is material, we also notify account holders by email.

11. Contact

Questions or requests: the support email on our plans page.