Data Compliance

Data Handling

Contact form submissions are stored in our database as lead records and are also sent to our business inbox by email when SMTP is configured.

If you create an account, account records (such as email address, password hash, role, verification state, and verification/reset token hashes) are stored in our database to provide authentication and account recovery features.

We also store operational records such as lead workflow notes/tags, audit events, and Stripe webhook event payloads when Stripe webhook processing is enabled.

Security Measures

We use standard safeguards appropriate for a small business site. Examples include password hashing, admin access controls, security headers, input validation, and basic rate limiting on public contact submissions.

This page does not claim SOC 2, HIPAA, PCI DSS, or other formal compliance certifications unless explicitly stated in a signed contract.

Data Retention

Lead, account, and operational records may be retained as long as needed for business, legal, security, and operational purposes. Verification tokens expire automatically after 24 hours; password reset tokens expire automatically after 1 hour. Stripe webhook events use bounded retention with TTL expiration.

Your Rights

You may request access, correction, or deletion of information you have provided to us. We will take reasonable steps to honor such requests, subject to legal, contractual, and security requirements.

Third Parties

We do not sell personal information. We may share limited information with service providers that help us operate the Site (for example, hosting, email delivery, and payment processing). We do not use third-party advertising trackers.

Contact

For data-related questions, email contact@hasher.sh or write to: