1. Who We Are and What This Policy Covers
This Privacy Policy explains how Avesom Web Services, doing business as avesom web and Zen Webmaster ("we", "us"), Wilmington, DE, handles personal information when you visit web.avesom.com (the "Site"), request a free audit, contact us, or buy our services. For privacy questions, write to [email protected].
1.1 Business services. Our services are for businesses. This policy covers the personal information of people at businesses who visit the Site and deal with us, such as a site owner, technical director, or operations manager.
1.2 Our clients' websites. When we maintain a client's website, we may handle personal information of that site's visitors and customers. In that case, we act as the client's service provider and handle the information only on the client's instructions and to provide the services. The client's own privacy policy explains how that information is used, and requests about it should go directly to the client.
1.3 Terms. Our Terms of Service also apply to your use of the Site and the services.
2. Information We Collect
We collect the information below, in the last 12 months and going forward. This table is also our notice at collection.
| Category | Examples | Where it comes from | Why we collect it | Shared with |
|---|---|---|---|---|
| Contact details | Name, work email, company name, website address, phone number if you give it | You, through the audit form, contact form, email or checkout | To answer you, deliver the audit, and provide the services | Email provider, hosting provider, Cloudflare |
| Request details | Platform, message text, the page you sent the request from | You | Same | Same |
| Order and payment information | Plan, billing name and address, card type and last four digits, payment status, Stripe customer ID | You and Stripe | To process orders and subscriptions, send receipts, and keep financial records | Stripe, our accountant |
| Access details for services | Site administrator accounts and other technical access you provide | You | Only to perform the paid maintenance and development services you ordered | Not shared |
| Technical and usage information | A hashed IP address, browser type, pages viewed, referring page, approximate region, date and time | Automatically, when you use the Site | To run and protect the Site, stop spam, and understand how the Site is used | Cloudflare, Plausible Analytics, hosting provider |
| Communications | Emails and support requests | You and us | Support and record-keeping | Email provider |
We do not receive full credit card numbers or bank account numbers, because Stripe takes your payment details directly. We keep only a cryptographic hash of your IP address for abuse and rate-limit prevention, and not the raw address itself.
We do not ask for sensitive personal information, such as government ID numbers, race, or health data. Please do not send it to us.
3. How We Use Information
We use personal information to:
- Answer your requests and deliver the free technical site audit;
- Provide, support, and bill for the services you order, including receipts, renewal notices, and critical service messages;
- Run, secure, and improve the Site, and prevent spam, fraud, and abuse;
- Keep business and tax records, follow the law, and enforce our Terms;
- Send occasional technical updates about our services to people who contacted us or are active clients. Each email contains an instant unsubscribe link, and we never send unsolicited promotional spam.
We do not use personal information for automated decision-making or profiling that produces legal or similarly significant effects.
4. How We Share Information
4.1 No sale and no advertising sharing. We do not sell personal information, and we do not share it for cross-context behavioral advertising. We have not done either in the last 12 months.
4.2 Service providers. We partner with trusted infrastructure vendors that help us run the Site and provide the services. They may use the information strictly to serve us under binding contracts.
| Provider | What it does | Information it receives |
|---|---|---|
| Stripe | Payments, subscriptions, and the customer portal | Billing details, payment metadata, email address |
| Resend | Transactional email dispatch (receipts, notifications, alerts) | Name, email address, and correspondence content |
| Cloudflare | DNS, edge caching, DDoS protection, bot filtering (Turnstile) | IP address and technical HTTP request headers |
| Edge Hosting Provider | Hosts the Site runtime and structured data storage | Server logs, audit requests, and cryptographic IP hashes |
| Plausible Analytics | Privacy-first site statistics, counting visits without cookies or persistent user profiles | Aggregate usage data |
| Accounting & Encrypted Backups | Financial bookkeeping, tax records, and encrypted off-site disaster recovery backups | Financial transaction logs and encrypted configuration snapshots |
4.3 Legal reasons. We may disclose information when required by law, in response to valid court orders, or to defend the legal rights, property, and safety of our clients, staff, or others.
4.4 Business changes. If we merge with another business entity or sell our operations, personal information may be transferred to the successor entity, which must honor this policy.
4.5 With your direction. We share information in other ways only with your explicit consent or upon your direct written instruction.
5. Cookies and Analytics
5.1 Cookies. The Site uses only cookies and similar technologies that are strictly necessary to function and maintain edge security. Cloudflare may set a security cookie for bot detection, and Stripe sets cookies on payment portals. We do not use third-party advertising or cross-site tracking cookies.
5.2 Analytics. We measure website traffic using Plausible Analytics, an open-source analytics platform built to record visits without cookies and without constructing behavioral profiles of individual visitors. We also review Google Search Console to monitor search engine crawl health.
5.3 Browser signals. Because we do not sell or share personal information for advertising, we treat Global Privacy Control (GPC) and similar opt-out signals as already fully honored. The Site does not modify its behavior in response to legacy "Do Not Track" headers because we do not track visitors across other sites.
6. How Long We Keep Information
We retain personal information only for as long as necessary to fulfill the purposes described in this policy, satisfy statutory tax obligations, and resolve disputes.
| Information | How long we keep it | What happens after |
|---|---|---|
| Audit and contact requests that did not convert to an order | 24 months after the last contact | Permanently deleted |
| Customer records: contact details, plan history, and invoices | Active subscription tenure + 7 years (tax and corporate compliance) | Permanently deleted or anonymized |
| Correspondence, emails, and technical support tickets | 3 years after the last message | Permanently deleted |
| Hashed IP addresses used for form spam protection | 30 days | Rotated and purged |
| Server access and security audit logs | 30 days | Overwritten and deleted |
| Administrative credentials for client websites | Until the service ends, purged within 30 days | Cryptographically shredded from credential vaults |
| Encrypted system backups | Up to 35 days after primary deletion | Overwritten as backup media rotates |
| Aggregate analytics | Indefinitely (contains zero personal data) | Retained in aggregate form |
7. Your Privacy Rights
7.1 Your rights. Depending on your jurisdiction, including California (CCPA/CPRA) and several other US states (Virginia, Colorado, Connecticut, Utah, Texas, Oregon), you may have the right to:
- Know and Access: Request disclosure of the personal information we collect, use, and share about you;
- Delete: Request deletion of personal information collected directly from you;
- Correct: Request correction of inaccurate personal records;
- Opt Out: Opt out of the sale or sharing of your personal information, or profiling (note: we do not sell or share data);
- Non-Discrimination: Receive equal service and pricing without discrimination for exercising your statutory privacy rights.
7.2 How to make a request. Submit your request by emailing [email protected] with the subject "Privacy Rights Request". As a digital-first webmaster service, email is our designated intake mechanism.
7.3 Verification and authorized agents. We verify requests by matching your identity against our primary client records. You may designate an authorized agent by providing written power of attorney.
7.4 Timing. We respond to verifiable consumer requests within 45 calendar days. If reasonably necessary, we may extend this period by an additional 45 days upon notice. Requests are processed without fee unless clearly unfounded or repetitive.
7.5 Appeals. If we deny your request, you may appeal by replying with "Appeal" in the email subject. We respond within 60 days. If unsatisfied, you may lodge a complaint with your state attorney general.
7.6 California "Shine the Light". We do not disclose personal information to third parties for direct marketing purposes.
8. Security Safeguards
We employ robust technical and organizational safeguards: TLS 1.3 encryption in transit, AES-256 vault encryption at rest, least-privilege role-based access controls, mandatory multi-factor authentication (MFA) for administrative tools, and automated brute-force rate-limiting. In the event of a security incident affecting your data, we will notify you in compliance with applicable breach notification statutes.
9. Children's Data
Our services and Site are strictly intended for commercial entities and business owners over 18 years of age. We do not knowingly solicit or collect data from anyone under 16 years of age. If such data is discovered, it is deleted immediately.
10. Changes to This Policy
We review this policy periodically and update it to reflect evolving legal standards. The "Last updated" date indicates the current revision. For material updates, we notify active subscribers by email or via a prominent announcement on the Site.
11. Contact Us
For questions, concerns, or rights requests regarding this Privacy Policy, please contact our data stewardship desk:
Avesom Web Services
Data Stewardship Desk
Wilmington, DE, United States
Email: [email protected]
Technical Escalations: [email protected]