This is a draft for a Colorado lawyer to review before it goes on the site. It is not legal advice and it was not written by a lawyer.
Last changed: 15 September 2026
1. What this page is
This page says what happens to information you give this website, and to information we hold about you once you are a client. It is short because there is not much of it.
We are Carverpoint, Nathan Vogt, of 220 S Wilcox St, Castle Rock, CO 80104, Colorado. You can reach a person at (720) 916-1357 or hello@carverpoint.com.
2. The short version
- This site sets no cookies. Not one.
- It runs no analytics and no trackers.
- It loads nothing from anybody else's server. No fonts from Google, no scripts from a content network, no pixels.
- Card details are typed on a page hosted by Stripe, on stripe.com. They never touch this site.
- We do not sell your details. We do not swap them, rent them, or hand them to anybody who wants to sell you something.
You do not have to take our word for any of that. The page is served with a content security policy of default-src 'self', which is a rule the browser enforces, and the footer prints the file count and the byte weight of what it loaded. Open the developer tools and count the requests.
3. The form on this site
The form asks four things: your name, your phone number, your trade, and a note if you want to leave one. There is a fifth field you cannot see, labeled "Leave this empty". It exists to catch automated spam. If a person fills it in, which a person cannot, the message is discarded.
There is nothing else. No hidden field, no fingerprinting, no record of how long you spent on the page.
<!-- THE FORK IS RESOLVED. This section shipped in two versions, one for a form that opens your mail app and one for a form that posts to our own server, with a box at the top of the file saying only one could be published and that which one depended on the form's destination. On 28 August 2026 the form was pointed at the portal's own lead ingest (agency/tools/reach-target.mjs --ingest), so the mail branch became false and was deleted rather than left here to be picked by mistake.
The number below is not a guess. portal/migrations/0002_tenancy.sql says of that column "NULLed by the nightly cron at 90 days" and portal/src/retention.ts sets piiDays: 90. If either changes, this sentence changes in the same commit. -->
Where it goes. When you press the button the form is sent to our own server and stored, so that nothing gets lost between your browser and our inbox. What is stored is the four answers above, the internet address your device connected from, and the name of your browser. The internet address and the browser name are kept for 90 days and then erased. The rest is kept for as long as we are talking, and you can ask us to delete it at any time. Nothing about it is shared with anybody outside the list in subprocessors.md.
4. The draft the form keeps
While you are typing, the form saves a copy of your four answers in your own browser, so a mis-tap or a phone call does not lose them. It is stored under the name agency.slip.v1.
That copy sits on your device. It never comes to us. It is deleted a few seconds after your message is sent. If you want it gone sooner, clear your browsing data for this site. The page says this in one line under the button, which is where it matters more than here.
5. Cookies
There are none, so there is no cookie banner.
We are aware that saying so is unusual enough to sound like a trick. It is not. A cookie is a small file a website asks your browser to keep and hand back on your next visit. This site never asks. The one thing it does store is the draft described in section 4, it stays on your machine, it is deleted when you send the message, and it exists so that you do not lose what you were typing.
If we ever add anything that sets a cookie, this page changes before the cookie does, and the date at the top is how you tell.
6. Paying
Every card is typed on a page hosted by Stripe, at stripe.com. We never see a card number, an expiry or a security code, and there is nowhere in our system that could hold one.
Stripe is its own company handling its own data for its own reasons as well as ours. Their privacy policy is at https://stripe.com/privacy and it governs what they do with what you type on their page.
When you press a buy button on this site, you leave this site and arrive at Stripe. That is a page you chose to visit, not a request this page made behind your back.
7. Links to other sites
The demonstration sites linked from /work are ours, on a different domain. The client sign in and the operator sign in go to app.carverpoint.com, which is also ours. Clicking any of them is you deciding to go somewhere, and this page loads nothing from them until you do.
8. What we hold once you are a client
Once you are a client and using the dashboard at app.carverpoint.com, we hold:
- Your name and your email address, so you can sign in and so we can reach you.
- Records of you signing in, including the internet address and browser used, so that we can tell you when somebody else signs in as you.
- The inquiries your own website sends you, if your site is set up to route them through us, including whatever the person who filled the form typed.
- What your website says: your hours, your prices, your services, your photos.
- Change requests you send us, and anything you attach to them.
- A record of what was done to your account and by whom, including any time we signed in as you to fix something. That record cannot be edited or deleted by anybody, including us.
We do not hold your card details. See section 6.
About the inquiry text specifically. Nobody controls what a stranger types into a contact form. A message about a wheelchair ramp is health adjacent. A quote request can carry somebody's family circumstances. So we treat every inquiry body as sensitive rather than sorting them, and we do not read them except when you ask us to look at something.
9. How long we keep it
We are going to be exact about this, because a retention promise that nothing enforces is a written admission rather than a policy.
- Sign in codes are useless within a day and are discarded.
- The internet address and browser name recorded with an inquiry are erased after 90 days.
- An inquiry itself is kept for two years, or for whatever period the client whose form it came through has set.
- Suspected spam is kept for 30 days and then destroyed.
- The schedule is running. It was armed on August 28, 2026, and it performs the periods above every night. The full table, every row of it, is on our security page, and each number there is the number the job actually uses rather than an intention.
- You do not have to wait for any of it. Ask us to delete something and we do it then, inside 10 business days, and usually the same day. That is a promise we make on top of the law rather than instead of it: Colorado gives us 45 days to answer a request like this, and if something ever went wrong at our end that is the outside limit you can hold us to.
If you want everything we hold about you, right now, in one file, the dashboard has a button that produces it. It is at /app/export.json. You do not have to ask us and we do not get told that you pressed it.
10. Who else touches it
The list is short and it is published, with what each one does, in subprocessors.md. Today it is our hosting provider, Stripe, our mail sender and the domain registrar. When it changes, that page changes and it is dated.
We do not use any advertising network, any analytics company, any customer tracking product, or any artificial intelligence service that would be handed your data.
11. Asking us anything about this
Email hello@carverpoint.com or call (720) 916-1357.
You can ask what we hold, ask for a copy, ask us to correct something, or ask us to delete it. You do not need a reason and asking will not affect anything else.
We will answer inside 10 business days and tell you what we did. Colorado allows 45 days for that answer; ten is what we intend and the shorter number is the one we would rather be judged by, but if you are ever waiting longer than ten the law still gives you the forty five.
If a law gives you a right we have not listed, you still have it. We are not going to make you argue about which statute applies before we answer a plain question about your own information.
12. Children
Nothing here is aimed at children and we do not knowingly collect anything from them. We sell to businesses.
13. If this changes
If we add anything that collects more than is described above, this page changes first and the date at the top moves. We will not quietly widen it.
14. Complaints
Tell us first, at hello@carverpoint.com, because we can usually fix it the same day.
If you would rather go elsewhere, the Colorado Attorney General's office handles consumer complaints in this state, at https://coag.gov/file-complaint/.