I am one person, not a data business. I collect what I need to build your site, invoice you and keep the thing running. I do not sell it, and there is no advertising network anywhere near it.

1. Who this covers

This policy explains how Joe Stone Web Development, referred to here as I or me, handles personal information when you:

• Visit joestone.co
• Get in touch about work
• Work with me as a client
• Use the client portal

Sites I have built for other people have their own policies. If you landed here from one of those, this page covers my relationship with that business, not theirs with you.

2. What I collect

Things you tell me

• Contact details: name, email, phone, business address
• Business details: company name, what you do, what you need the site to do
• Project material: copy, images, logins to services the site has to talk to
• Billing details: billing name and address. Card numbers go to Stripe, never to me

Things collected automatically

• Server logs: IP address, browser and device type, pages requested, timestamps
• Operational data: uptime, response times, error traces
• Portal activity: when you signed in, what you uploaded, what you wrote

3. What I do not collect

No government identifiers, no financial account numbers, no health information, unless your project genuinely requires it and we have agreed that in writing first. There is no advertising or cross-site tracking on joestone.co, and I do not buy data about you from anyone.

4. What I use it for

• Talking to you about your project
• Designing, building and maintaining what you hired me for
• Issuing invoices and taking payment
• Support: answering tickets and fixing what is broken
• Keeping the infrastructure up, patched and backed up
• Spotting abuse, spam and attacks against the servers
• Meeting my own legal and tax obligations

That is the complete list. If I ever want to use your business as a portfolio example or quote you in a testimonial, I will ask first, and no is a perfectly fine answer.

5. The client portal

The portal holds your projects, the files we exchange, our message threads, support tickets and invoices. A few things worth knowing about how it works:

• Sign-in is passwordless. You enter your email and get a single-use link that expires in fifteen minutes. Nothing you type is stored as a password because there is no password.
• Sign-in links are stored hashed. Reading the database does not let anyone mint a working link.
• Uploaded files are stored outside the public web root and can only be fetched through an authenticated request that checks you own the project they belong to.
• You only ever see your own data. Asking for another client's project returns a not-found, not a permission error, so the portal will not even confirm that somebody else's project exists.
• I can see everything in the portal. It is my system and I administer it. Please do not upload anything you would not want me to have.

6. Payments

Card payments are processed by Stripe. Card details are entered on Stripe's own checkout page and never pass through my servers. What comes back to me is the amount, the currency, whether it succeeded, the last four digits and card brand, and a Stripe reference for reconciliation and refunds.

Stripe processes that information as its own controller under Stripe's privacy policy. I keep invoice records for as long as tax law requires.

7. Who else touches it

I keep the list of third parties deliberately short. These are all of them:

Service	What it handles
Stripe	Card payments and invoice reconciliation
Brevo	Sending portal and project emails. Sees your name, email address and the content of those messages
Cloudflare	DNS and the CDN in front of joestone.co. Sees request metadata including IP addresses
Google Fonts	Serves the two typefaces the site uses. Your browser requests them directly

Hosting is mine. Your site and its data sit on hardware I own and run, not on rented infrastructure, so there is no additional hosting company in this list.

Beyond those, I share information only where the law requires it: a valid court order, a legal obligation, or to defend against fraud or an attack on the systems.

8. How it is protected

• Encrypted in transit. Everything runs over TLS.
• Access is limited to me. There is no support team, no offshore contractors, nobody else with a login.
• The admin account is separately protected and can be put behind a time-based authenticator.
• Uploads are served back as opaque downloads so a stored file cannot execute in your browser.
• Backups run daily and are kept on separate storage.
• Patching is routine, not something I get around to.

No system is perfect. If I ever discover a breach affecting your information, I will tell you what happened, what was exposed and what I am doing about it, without waiting to be asked.

9. How long I keep it

Data	Kept for
Active project material	For as long as we are working together
Invoices and payment records	Seven years, for tax and accounting
Portal messages and files	While I host your site, then ninety days after we part
Server logs	Thirty days
Backups	Rolling, with ninety days retained after a project ends

10. Your rights

Whatever jurisdiction you are in, I will honour these:

• See it. Ask for a copy of what I hold about you.
• Correct it. Tell me what is wrong and I will fix it.
• Delete it. Ask me to erase it, subject to records I am legally required to keep, such as invoices.
• Take it. Get your site, files and data in a portable form so you can move to someone else.
• Object. Tell me to stop using it for a particular purpose.
• Stop the emails. Every notification email has a working unsubscribe link, and you can turn notifications off in the portal. Sign-in links keep working, since without those you cannot get in.

Email [email protected] and I will action it. There is no form, no ticketing maze and no charge, and I aim to respond within a working day.

11. Cookies and analytics

joestone.co sets no tracking cookies. There is no Google Analytics, no advertising pixel and no third-party tag manager.

The client portal sets exactly one cookie, jsp_sess. It holds a random session identifier, nothing about you, and it is required for the portal to know who is signed in. It is marked HttpOnly, Secure and SameSite=Strict, and it is deleted when you sign out.

Where I have built a site for you that uses analytics, that is configured for your business and covered by your own privacy policy, not this one.

12. Children

These services are for businesses. I do not knowingly collect information from anyone under 13. If you believe a child's information has ended up with me, email me and I will delete it.

13. Where it lives

Your data is stored on hardware in the United States. Brevo and Cloudflare operate internationally and may process message and request metadata outside the United States as part of delivering email and serving the site.

14. Changes

If I change this policy I will update the effective date at the top, and for anything significant I will email current clients rather than relying on you noticing.

Questions

Ask me anything about this. I would rather explain how something works than have you assume the worst.

Joe Stone Web Development
[email protected]
Usually a reply within one working day.