Elephant & Vale ("we", "us", "our") is a brand of Legacy Asset Stewardship LLC. We build connected business platforms, brands, websites, marketing, and media for businesses, and we believe your information deserves the same care we put into our work. This policy explains, in plain language, what we collect through elephantandvale.com, why we collect it, and the choices you have. The short version: we collect only what we need to serve you, we never sell it, and we do not follow you around the internet.
What we collect, and why
When you place an order or start a tab. We collect the details you give us: your name, your email address, your business name if you share it, the services on your tab, any video crew levels you choose, and any notes you write. When your tab includes a priced item and you continue to checkout, we save these details and your whole tab before we hand you to Stripe, so we can follow up even if you do not finish paying. We use all of this to respond to your request, prepare quotes, deliver the work, and keep a record of our relationship.
When you send us a message. The form on our Talk to Theresa page collects your name, your email address, your business name if you share it, the parts of your business you tick as ones you would like connected, and your message. We use them to answer you and to follow up about your project.
When you pay. Payments are handled by Stripe, a PCI-certified payment processor. Your card number goes directly to Stripe over an encrypted connection; it never touches or rests on our servers, and we cannot see it. We keep our own record of the payment itself: the amount, the date, what it was for, and the name and email connected to it. When a purchase includes recurring billing, such as a monthly service, Stripe securely saves your payment method so those charges can be billed as disclosed to you at checkout.
When we send you a payment link. A payment link stores a description of the work, the amounts agreed, and, if provided, your email address, which we use to send you the link from our own mailbox and which is passed to Stripe to prefill the checkout page.
When you simply visit. We use a cookieless, anonymous measurement of our own: which pages are viewed, which menu items are added to a tab, when the order form is opened, the device class (phone or desktop), and the name of the website that sent you here (its domain only). Each visit carries a random identifier kept in your browser's session storage, which the browser clears when you close the tab or window. It is never tied to your name or email. These measurements are deleted after about 180 days.
Your tab, in your browser. The items you add to your tab, and whether you have minimized the tab bar, are kept in your browser's session storage so your tab follows you from page to page. Apart from the anonymous measurement above, your tab stays in your browser until you send an order or continue to checkout, and the browser clears it when you close the tab or window.
Your network address. To limit abuse of the order and contact forms, checkout, our visit measurement, and our staff sign-in, the site turns your network (IP) address into a scrambled one-way code, made with a random key that changes every day. We never store the address itself, and longer (IPv6) addresses are shortened to their network before they are coded. These codes are used only to limit abuse and are deleted or cleared within about a day. Each daily key is deleted after about two days; after that, a code can no longer be turned back into an address.
Spam protection. Our order form and our contact form, and our staff sign-in after repeated failed attempts, use Cloudflare Turnstile to tell people from bots. Turnstile may process technical signals from your browser for that single purpose.
What we do not do
- We do not sell, rent, or trade your personal information, to anyone, ever.
- We do not run advertising trackers, advertising cookies, or third-party analytics that profile you.
- We do not set any cookies on the public site. The only cookies we use anywhere belong to our own staff area (a sign-in cookie and one that recognizes a staff member's device), which visitors never receive.
- We do not send marketing email lists. The emails we send are about your orders, your messages, your payments, and your projects.
The companies that help us serve you
We share information only with the service providers who make the site work, only for the purposes described here:
- Cloudflare hosts the site and its database, protects it, and provides the spam check. If we switch it on, Cloudflare Web Analytics also gives us a cookieless count of page views.
- Stripe processes payments and stores payment methods for recurring billing.
- Resend delivers the notices we receive when you send an order, a message, or a payment.
Each of these providers is bound by its own privacy and security obligations. We may also disclose information if the law genuinely requires it, or to protect against fraud or abuse of the site.
How long we keep things
Orders, quote requests, and messages from our contact form are kept as business records until we delete them or you ask us to. Payment records are kept as tax and accounting rules require. Anonymous visit measurements are deleted after about 180 days, and scrambled network codes within about a day, as described above. Copies held by Stripe (your payment details and receipts) and Resend (a delivery record of our emails) are kept under those companies' own policies.
Your choices and rights
You may ask us at any time to show you the information we hold about you, correct it, or delete it. When you ask us to delete it, we remove your contact record, your orders, quote requests, and messages with their history, and your email address from any payment link. On payment records we remove your name and email and keep only the amount, the date, and what it was for, which tax and accounting rules require us to keep. Depending on where you live, these may also be legal rights, and we honor them regardless. Write to Theresa@legacyassetstewardship.com and we will respond promptly. We do not sell or share personal information for cross-context behavioral advertising, so there is nothing to opt out of on that front.
Security
The site is served entirely over encrypted connections. Card details are handled only by Stripe. Access to our records is limited to the people who run this business, behind authenticated access, and we keep the amount of personal information we hold deliberately small.
Children
Our services are for businesses and adults. The site is not directed to children under 13, and we do not knowingly collect information from them. If you believe a child has provided us information, contact us and we will delete it.
Changes to this policy
If our practices change, this page will change with them, and the date at the top will tell you when. Meaningful changes will be reflected here before they take effect.
How to reach us
Questions, requests, or concerns about privacy: Theresa@legacyassetstewardship.com.