Privacy Policy

Scope and current behavior

This policy covers public pages, request forms, direct inquiry handling, the confirmation page, and any private engagement agreed for a specific project. The Founding Website is the only product sold through the site's online checkout, and only while the founding offer is open. The public site does not collect payment on any request form, and a request does not create a reservation or paid engagement. Payment is collected only on the Founding Website checkout, where Stripe processes the transaction.

Public request forms send your request to Steelo for human review; a form submission is not sent through an external AI model. The confirmation page can use short-lived browser session storage to show the submitted name, company, route, and email delivery status. That browser record expires after 30 minutes and is not a server-side source of truth.

Information we collect

Depending on the path you use, we may receive the following categories:

• Identity and contact details: name, email address, company or business name, and website URL.
• Request context: message, selected intent, pillar focus, project type, timeline, and other information you choose to provide.
• Attribution context: landing route, referrer, campaign parameters, and UTM fields.
• Security and delivery context: user agent, an IP-derived hash used for abuse controls, rate-limit state, confirmation state, and email-delivery status.
• Project or payment information: if a private engagement is approved and activated, the information required for its written terms, delivery, hosting, billing, or payment path.
• Billing information: for a Founding Website purchase or hosting subscription, Stripe processes the payment and shares transaction and subscription status with Steelo. Card numbers are entered on Stripe-hosted surfaces and are not stored by Steelo.
• Domain registration details: when Steelo registers a domain for your website, the business contact details required by the registrar. The domain is held by Steelo and transferred to you on request.

Do not submit passwords, access tokens, financial account numbers, health information, legal case details, or other sensitive information through a public request form. Credentials belong in an approved private handoff, not in a marketing or inquiry field.

How we use information

• To receive, classify, and respond to a request.
• To review fit, scope, timing, and the right service route.
• To send transactional confirmation and follow-up about the request or an approved engagement.
• To prevent abuse, enforce rate limits, secure the service, and troubleshoot delivery.
• To deliver an approved project, maintain records, and meet legal, accounting, or contractual duties.
• To bill and manage a hosting subscription through Stripe, and to register and manage a domain for a hosted website.

We do not sell request data or use it to create third-party advertising profiles. Transactional follow-up is not marketing consent. No marketing list or marketing checkbox is part of any request form.

Processors and service providers

The current inventory below distinguishes services used in the active request path from conditional or inactive paths. Providers process information only for the relevant service, subject to their own terms, security controls, and retention policies.

Steelo keeps an internal record of each processor, the data categories it handles, and the approved retention periods. That record does not include secrets or customer records.

Automated review support

Human review controls fit, scope, pricing, acceptance, and engagement decisions. No automated system approves a buyer, reserves capacity, sets a price, or creates a contract.

A human makes fit, scope, and pricing decisions.

The optional Snapshot Console is separate from the contact form. It remains conditional, user-initiated only, and disabled for production expansion until the exact account controls are verified. If Steelo enables it after that review, the maximum permitted fields are the business or company name, public website URL, context the user intentionally enters, and non-sensitive diagnostic observations needed for the requested review. It can fall back to a scripted local flow. It is not a substitute for human review and is not used to make fit, scope, pricing, contractual, or external-action decisions.

OpenAI API inputs and outputs are not used to train OpenAI models by default unless the customer explicitly opts in. Under default controls, abuse-monitoring logs may contain submitted content and may be retained by OpenAI for up to 30 days. Eligible approved customers may configure Zero Data Retention (ZDR) or Modified Abuse Monitoring (MAM). Steelo does not claim either enhanced control for the active account or project unless it is verified. See the current OpenAI API data controls. Before enabling it in production, Steelo must verify the exact organization and project, data sharing and retention controls, applicable standard/ZDR/MAM status, endpoint, application-state behavior, and whether store: false is supported and appropriate. Do not submit payment details, government identifiers, health information, passwords, authentication credentials, private client files, or other sensitive personal categories to this workflow.

No current request path sends data to Anthropic. A provider's status can change only after a reviewed change and an updated processor record.

Retention and security

The following Steelo-controlled schedule applies prospectively to records under Steelo's control. It does not change a signed agreement or a legal hold retroactively. Records may be retained longer when a legal obligation, dispute, fraud investigation, or documented legal hold requires it; otherwise Steelo deletes or anonymizes records when the applicable period ends.

• Browser request-confirmation state: 30 minutes in sessionStorage. It is a display aid, not a server-side source of truth.
• Public inquiries and diagnostic requests: up to 24 months after the last meaningful interaction for inquiries, Snapshot requests, Credibility Audit requests, Blueprint requests, Studio Layer requests, and other request records that do not become a paid engagement.
• Active project operational records: for the engagement and 3 years after project closure, including ordinary communications, approvals, project notes, deliverable records, and operational support history.
• Contracts and financial records: 7 years after the relevant transaction or project closure for signed terms, invoices, payment records, accounting records, and tax-related records.
• Abuse, rate-limit, security, and IP-hash records: up to 30 days unless connected to an active security incident, fraud review, dispute, or legal obligation.
• Transactional email: according to the underlying record: inquiry-only email up to 24 months, project email for the engagement plus 3 years, and financial or contract email for 7 years where needed for the corresponding record.

Provider-side logs follow the configured provider account, plan, contract, and provider terms. Steelo does not claim it can delete provider-side logs earlier than the provider permits and does not publish an exact provider-side period unless it is verified for the current account. Verified deletion requests are honored where applicable, subject to lawful retention requirements for contracts, payments, taxes, security incidents, disputes, and legal holds.

We use access controls, server-side processing, environment separation, rate limits, hashed network signals, and provider security controls appropriate to the path. No transmission or storage method is guaranteed to be completely secure.

Your rights and contact

Depending on where you live and the law that applies, you may request access, correction, deletion, restriction, objection, or a copy of personal information held about you. Send a verified request to privacy@steelodigital.com. We may need enough information to verify the request and may retain information required for legal, security, accounting, or dispute purposes.

Steelo is based in Omaha, Nebraska and may use providers that process information in other jurisdictions. By sending a request, you understand that the information may be processed where Steelo or its approved providers operate, subject to applicable safeguards and provider terms.

Steelo Designs LLC · Omaha, Nebraska · privacy@steelodigital.com