Elephant & Vale ("we", "us", "our") is a brand of Legacy Asset Stewardship LLC. We build brands, websites, marketing, and media for businesses, and we believe your information deserves the same care we put into our work. This policy explains, in plain language, what we collect through elephantandvale.com, why we collect it, and the choices you have. The short version: we collect only what we need to serve you, we never sell it, and we do not follow you around the internet.
What we collect, and why
When you place an order or start a tab. We collect the details you give us: your name, your email address, your business name if you share it, the services you selected, and any notes you write. We use these to respond to your request, prepare quotes, deliver the work, and keep a record of our relationship.
When you pay. Payments are handled by Stripe, a PCI-certified payment processor. Your card number goes directly to Stripe over an encrypted connection; it never touches or rests on our servers, and we cannot see it. We keep our own record of the payment itself: the amount, the date, what it was for, and the name and email connected to it. When a purchase includes recurring billing, such as a monthly service, Stripe securely saves your payment method so those charges can be billed as disclosed to you at checkout.
When we send you a payment link. A payment link stores a description of the work, the amounts agreed, and, if provided, your email address so we can send it to you.
When you simply visit. We use a cookieless, anonymous measurement of our own: which pages are viewed, which menu items are added to a tab, the visitor's device class (phone or desktop), and the referring website's domain. Each visit carries a short-lived random identifier that exists only for that browsing session and is never tied to your name or email. To protect the site from abuse, we also keep a one-way scrambled version of visitor network addresses that changes every day, cannot be reversed into a real address, and is used for nothing except rate limiting. These measurements cannot identify you and are routinely deleted after about 180 days.
Spam protection. Our order form uses Cloudflare Turnstile to tell people from bots. Turnstile may process technical signals from your browser for that single purpose.
What we do not do
- We do not sell, rent, or trade your personal information, to anyone, ever.
- We do not run advertising trackers, advertising cookies, or third-party analytics that profile you.
- We do not set any cookies on the public site. The only cookie we use anywhere is an essential sign-in cookie for our own staff area, which visitors never receive.
- We do not send marketing email lists. The emails we send are about your orders, your payments, and your projects.
The companies that help us serve you
We share information only with the service providers who make the site work, only for the purposes described here:
- Cloudflare hosts the site, protects it, and provides the spam check.
- Stripe processes payments and stores payment methods for recurring billing.
- Resend delivers our transactional email, such as order confirmations to us and payment links to you.
Each of these providers is bound by its own privacy and security obligations. We may also disclose information if the law genuinely requires it, or to protect against fraud or abuse of the site.
How long we keep things
Order and payment records are kept as ordinary business records, which tax and accounting rules require us to retain. Anonymous visit measurements are deleted on a rolling basis after about 180 days. If you ask us to delete your information, we will remove everything we are not legally required to keep.
Your choices and rights
You may ask us at any time to show you the information we hold about you, correct it, or delete it. Depending on where you live, these may also be legal rights, and we honor them regardless. Write to[email protected] and we will respond promptly. We do not sell or share personal information for cross-context behavioral advertising, so there is nothing to opt out of on that front.
Security
The site is served entirely over encrypted connections. Card details are handled only by Stripe. Access to our records is limited to the people who run this business, behind authenticated access, and we keep the amount of personal information we hold deliberately small.
Children
Our services are for businesses and adults. The site is not directed to children under 13, and we do not knowingly collect information from them. If you believe a child has provided us information, contact us and we will delete it.
Changes to this policy
If our practices change, this page will change with them, and the date at the top will tell you when. Meaningful changes will be reflected here before they take effect.
How to reach us
Questions, requests, or concerns about privacy:[email protected].