Privacy Statement

1. Information we collect

Information you provide to us

• Contact & inquiry forms. When you submit our contact form, we collect your name, business/company name (optional), email address, phone number (optional), the service you're interested in, and your message.
• Live chat widget. When you start a chat, we collect your name, email address, phone number (optional), and the contents of your messages so we can respond to you.
• Service orders. When you place an order through our services site, we collect the order details and the contact information you provide.
• Client accounts. If you become a client, we maintain an account that may include your name, email address, business details, login credentials (passwords are stored only as a securely salted hash — never in plain text), your service subscriptions, order history, and any service requests or messages you submit through the client portal.

Information collected automatically

• Technical & security data. Our servers automatically log information such as your IP address, browser type and device information, the pages you visit, and timestamps. We use this for site operation, troubleshooting, fraud prevention, rate limiting, and protecting our forms and accounts from abuse.
• Cookies & local storage. We use a small number of strictly functional cookies and browser local-storage values, described in Section 3.

We do not use third-party advertising networks, and we do not collect special categories of sensitive personal information through this website.

2. How we use your information

We use the information we collect to:

• Respond to your inquiries, chat messages, and requests;
• Prepare quotes and provide, manage, and support the services you order;
• Operate client accounts, process orders, and handle service requests;
• Send service-related communications (for example, order updates, service-request replies, and billing notices);
• Operate, secure, and improve our website and services, including preventing fraud and abuse; and
• Comply with our legal obligations.

We do not sell your personal information, and we do not use it for third-party advertising.

3. Cookies & local storage

We keep our use of cookies and local storage minimal and functional:

• Session cookies. Used to keep you securely signed in to the client portal or admin areas and to protect form submissions (anti-forgery protection). These are essential to operate those areas.
• Preference storage. Your browser remembers your display preferences locally — for example, your choice of day/night theme and accessibility settings (text size, high-contrast mode, dyslexia-friendly font). On this website, these values stay in your browser and are not sent to us. If you are signed in to the client portal, your display preferences are also saved to your account so they follow you across devices; they are used only to render the portal the way you chose and never for tracking, profiling, or advertising, and they are included in any copy of your data you request.

We do not use advertising or cross-site tracking cookies. You can clear or block cookies in your browser settings, though some features (such as signing in) may not work without essential cookies.

4. How we share information

We share information only as needed to operate our business, and never sell it. We may share information with:

• Hosting & infrastructure providers that store and serve our website and data on our behalf (our website is hosted with Hostinger, with Cloudflare providing content delivery and security).
• Messaging & email providers used to deliver our communications. Our live chat is relayed through Telegram so we can respond to you, and we use an email service to send and receive messages and notifications.
• Our payment processor, Square (Block, Inc.), for billing, as described in Section 5.
• Legal & safety recipients when required by law, to enforce our agreements, or to protect the rights, property, or safety of Kustom FX Dev, our clients, or others.

These providers are permitted to use the information only to perform services for us.

We do not load fonts, scripts, styles, or other assets from third-party content delivery networks on kustomfx.dev, our client portal, or our menu boards. Everything is served from our own infrastructure, so browsing our site does not hand your IP address to an outside asset provider.

Reviews & testimonials

Reviews can only be written by our own clients, from inside the client portal, using an active account, and only about work we actually did for them — one review per job and one per service. There is no public review form: visitors can read reviews but cannot post, comment, or reply anywhere on our site.

If you write a review, we may publish it on our public reviews page along with your first name and last initial only (for example, "Maria D."), your rating, your words, which job or service it was about, and any reply we write. Your business name is published only if you tick the optional box when writing the review; leave it alone and it stays off. That is the complete list. We never publish your surname, your email address, phone number, account details, or anything about your billing. Nothing goes public until we have looked it over.

A review is final once you submit it — the portal does not let you edit or delete it afterwards, so that what is published stays as it was written. That does not take away your rights: email [email protected] and we will correct or remove your review promptly, no reason needed, as Section 8 requires. A copy of any review published under your name, and our reply to it, is included in the data export described in Section 8.

5. Payment information

Payments for our services are handled through Square (Block, Inc.), our third-party payment processor. When you pay an invoice by card in the client portal, the card fields on the payment page are provided and secured by Square: your card number, expiration, and security code go directly to Square and never touch or pass through Kustom FX Dev's servers. Square processes your payment information under its own terms and privacy policy.

If you choose to save a card for future payments or enable auto-pay for a subscription, the card itself is stored by Square, not by us. On our systems we retain only a masked reference — the card brand, last four digits, and expiration date — along with Square's token identifiers and a record of your consent, so we can show you which card is saved and process the charges you authorized. You can remove your saved card or turn auto-pay off at any time from your client portal profile or by contacting us; removing it disables the card reference with Square as well.

Kustom FX Dev never stores your full card or bank-account numbers; we retain only billing records such as invoices, amounts, dates, and payment status needed to manage your account.

6. How we protect your data

Security is a core priority for us. Measures we use include:

• Encryption in transit (HTTPS/TLS) across our sites;
• Securely hashed passwords (we never store passwords in plain text);
• Optional two-factor authentication for portal accounts;
• Anti-forgery protection, proof-of-work and honeypot checks on public forms, rate limiting, and automatic blocking of abusive sources;
• Hardened sessions and security headers; and
• Access controls that limit who can view account data.

No method of transmission or storage is completely secure, but we work to protect your information using reasonable and appropriate safeguards.

7. Data retention

We keep personal information only for as long as it is needed for the purposes described in this statement — for example, to respond to your inquiry, to provide and support your services, and to meet our legal, accounting, and tax obligations. When information is no longer needed, we delete or anonymize it.

For clients specifically: after your service ends, we retain your website files, display content, and backups for 60 days so you can request a copy, after which they may be permanently deleted, as described in our Refund & Cancellation Policy and Service Agreement. Billing, invoice, and tax records are kept for as long as required by applicable law.

8. Your privacy rights & opt-out signals

We honor the following privacy rights for our users, consistent with applicable law — and, for North Carolina residents, in keeping with the North Carolina Personal Data Privacy Act. Depending on where you live, you may have the right to:

• Confirm & access. Confirm whether we are processing your personal information and request access to it.
• Correct. Ask us to correct inaccurate personal information we hold about you.
• Delete. Ask us to delete personal information we hold about you.
• Obtain a copy. Receive a copy of the personal information you provided, in a portable and usable format where feasible.
• Opt out. Opt out of the sale of personal information, targeted advertising, or profiling that produces legal or similarly significant effects. As stated throughout this notice, we do not sell personal information, do not serve targeted advertising, and do not profile you — so in practice there is nothing to opt out of, but you may still submit a request.

How to exercise your rights

To make a request, contact us using the details in Section 12. We will respond to a verifiable request within 45 days; if we reasonably need more time, we may extend that period by up to an additional 45 days and will notify you. We may need to verify your identity before acting on a request, and we will not discriminate or retaliate against you for exercising any of these rights. You may also use an authorized agent to submit a request on your behalf, in which case we may ask for proof of the agent's authorization and separately verify your identity.

Appeals

If we decline to act on your request, you may appeal our decision by replying to our response or contacting us again using the details in Section 12. We will inform you in writing of the outcome of your appeal and our reasons. If your appeal is denied, you may contact the North Carolina Attorney General's Office to submit a complaint.

Global Privacy Control & opt-out preference signals

Your browser, device, or a browser extension may send an opt-out preference signal — such as the Global Privacy Control (GPC) — that communicates your choice to opt out of the sale of your personal information and targeted advertising. We recognize and honor GPC and similar signals as a valid opt-out request. Because we do not sell personal information or use targeted advertising, there is no such data sharing for us to stop; nevertheless, we treat a received signal as an opt-out for any activity to which it would apply, without requiring you to take any further action.

9. Minors' privacy

Our website and services are intended for businesses and adults. We do not knowingly collect personal information from minors under 18. If you believe a minor has provided us with personal information, please contact us and we will delete it.

10. Third-party links

Our website may link to third-party sites (such as live demos or our social media). We are not responsible for the privacy practices of those sites. We encourage you to review the privacy statements of any third-party site you visit.

11. Changes to this statement

We may update this Privacy Statement from time to time. When we do, we will revise the "Last updated" date above. Significant changes will be highlighted on this page. Your continued use of our website after an update means you accept the revised statement.

12. Contact us

If you have questions about this Privacy Statement or how we handle your information, please contact us: