Privacy Policy
This policy explains what personal data we collect, why we collect it, who we share it with and what control you have over it.
1. Who is responsible for your data
Kelvane LLC is the controller of the personal data described in this policy.
30 N Gould St Ste RSheridan, WY 82801
United States
Privacy enquiries: privacy@kelvane.org
We answer privacy requests within one business day and complete them within the statutory deadlines set out in section 8.
2. What we collect
Information you give us
- Enquiry details — name, email address, company name, website, service required, budget range, timeline and whatever you write in the message field.
- Client records — billing name and address, project correspondence, contracts and proposals.
- Project materials — any content, images or credentials you supply so we can carry out the work.
Information collected automatically
- Technical data — IP address, browser type and version, device type, operating system, referring page and pages viewed. This is collected by our hosting provider in standard server logs.
Information we never collect
- Card numbers. Payment details are submitted directly to Stripe. We receive only the last four digits, the card brand and the expiry date, which appear in our Stripe dashboard for reconciliation. We cannot see or retrieve your full card number.
- We do not knowingly collect special category data such as health, biometric, religious or political information, and we ask that you do not send it to us.
3. Why we use it and our legal basis
| Purpose | Data used | Legal basis (UK/EU GDPR) |
|---|---|---|
| Replying to your enquiry | Enquiry details | Steps taken at your request prior to entering a contract |
| Delivering the services | Client records, project materials | Performance of a contract |
| Taking payment and issuing invoices | Billing details | Performance of a contract |
| Meeting tax and accounting duties | Invoices, payment records | Legal obligation |
| Keeping the website secure and available | Technical data | Legitimate interests — protecting our service |
| Defending or bringing legal claims | Correspondence, contracts | Legitimate interests — establishing and defending claims |
We do not sell your personal data, share it with data brokers, use it to build advertising profiles, or send marketing emails to people who have not asked for them.
4. Payment data and Stripe
All card payments are processed by Stripe, Inc., 354 Oyster Point Boulevard, South San Francisco, CA 94080, United States.
When you pay, your card details are transmitted directly from your browser to Stripe over an encrypted connection. They do not pass through and are not stored on our servers. Stripe is certified to PCI-DSS Level 1, the highest level of certification available in the payments industry.
Stripe processes your data as an independent controller for its own fraud prevention and regulatory compliance purposes. Stripe's handling of your data is governed by the Stripe Privacy Policy.
5. Who we share data with
We share personal data only with the service providers we need to run the business. Each is bound by contract to process data only on our instructions.
| Provider | Purpose | Location |
|---|---|---|
| Stripe, Inc. | Payment processing and invoicing | United States |
| Website hosting provider | Serving this website, server logs | United States / EU |
| Email provider | Business email correspondence | United States / EU |
| Accounting provider | Bookkeeping and tax filing | United States |
We may also disclose data where required by law, court order or a valid request from a public authority, or to establish, exercise or defend legal claims. If we are ever involved in a merger or acquisition, data may transfer to the successor entity, and we will notify you before that happens.
6. International data transfers
We are established in the United States, so personal data you send us is processed there. If you are located in the United Kingdom, the European Economic Area or Switzerland, this is a transfer outside your home jurisdiction.
Where such a transfer occurs, we rely on the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum where applicable), together with supplementary technical measures including encryption in transit and at rest. You may request a copy of the relevant safeguards by writing to privacy@kelvane.org.
7. How long we keep it
| Category | Retention period | Reason |
|---|---|---|
| Enquiries that do not become projects | 12 months | Follow-up and record of contact |
| Client project files and correspondence | 3 years after completion | Support, warranty and dispute resolution |
| Invoices and payment records | 7 years | US tax and accounting requirements |
| Server access logs | 90 days | Security monitoring |
| Marketing consent records | Until withdrawn, then 2 years | Proof of consent |
When a retention period ends, data is deleted or irreversibly anonymised.
8. Your rights
If you are in the UK, EU or Switzerland
Under the GDPR you have the right to: be informed about how your data is used; access a copy of it; have inaccurate data corrected; have data erased in certain circumstances; restrict processing; receive your data in a portable format; object to processing based on legitimate interests; and withdraw consent at any time where consent is the basis.
We respond to these requests within one month, free of charge. You also have the right to complain to your local supervisory authority, and in the UK to the Information Commissioner's Office at ico.org.uk.
If you are a California resident
Under the CCPA and CPRA you have the right to know what personal information is collected, used and disclosed; to request deletion; to request correction; to opt out of the sale or sharing of personal information; to limit the use of sensitive personal information; and not to be discriminated against for exercising these rights.
We do not sell or share personal information as those terms are defined by the CCPA, and we have not done so in the preceding twelve months. We respond to verifiable requests within 45 days.
Making a request
Email privacy@kelvane.org stating what you would like us to do. We may ask for information to verify your identity before acting, which we use only for that purpose. An authorised agent may act for you with written permission.
9. How we protect your data
- All traffic to this website is encrypted with TLS.
- Access to client data is restricted to people who need it to do their work.
- Accounts holding personal data are protected with strong unique passwords and multi-factor authentication.
- Client credentials you share with us are stored in an encrypted password manager and removed when a project ends.
- We keep the number of third-party services we use deliberately small.
No system is perfectly secure. If a breach occurs that is likely to result in a risk to your rights, we will notify the relevant supervisory authority within 72 hours and inform you directly without undue delay.
10. Children
Our services are provided to businesses and to adults. We do not direct this website at children and do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, write to privacy@kelvane.org and we will delete it.
11. Cookies
This website sets no cookies of its own. It stores a single strictly necessary item in your browser's local storage to remember your light or dark theme preference. Full detail is in our Cookie Policy.
12. Changes to this policy
We update this policy when our practices change or the law requires it. The effective date at the top of this page always reflects the current version. Where a change materially affects how we handle your data, we will notify existing clients by email before it takes effect.
13. Contact
Kelvane LLC — Privacy30 N Gould St Ste R
Sheridan, WY 82801
United States
privacy@kelvane.org
Telephone: +1 (307) 622-4751