Privacy Policy

We collect the following types of information:

• Account information: your name, email address, and company name when you create an account or onboard.
• Billing information: billing address (street, city, state, ZIP) collected during checkout for payment processing.
• Payment data: card details are tokenized and processed by Square. We never see or store full card numbers.
• Usage data: which features you use, project submissions, credit usage, and activity within the portal.
• Brand files: logos, images, and other assets you upload to your Brand Library for use in your design projects.
• Communications: messages sent between you and Loudest Creative through the portal.
• Phone number: your mobile or business phone number, if provided, for SMS and voice communications related to your projects and account.

We use your information to:

• Provide and improve the Service, including completing your design requests.
• Process payments and manage your subscription billing.
• Send transactional emails (account notifications, project updates, billing confirmations).
• Communicate with you about your projects, account, and billing, including via SMS text messages and phone calls.
• Monitor usage to ensure the Service is functioning correctly.
• Comply with legal obligations.

We do not sell, rent, or trade your personal information to any third party.

We use the following third-party services to operate the platform:

• Square:processes payments, stores tokenized card data, and manages recurring billing. Square's privacy policy governs payment data they process. We do not store card numbers.
• Resend: sends transactional emails on our behalf (signup confirmations, project notifications, billing alerts). Resend processes your email address and name for delivery.
• Supabase:provides our database, authentication, and file storage. Your data is stored on Supabase's infrastructure. Supabase's privacy policy applies to data processed on their platform.
• Twilio:provides SMS messaging services on our behalf. When we send you a text message, your phone number and message content are processed by Twilio. Twilio's privacy policy governs data they process.
• Google Fonts: loaded on our public website for typography. Google may collect limited usage data per their privacy policy.
• Google Analytics 4: we use Google Analytics on our public marketing website (loudestcreative.com) to measure aggregate traffic and improve the site. Google Analytics may collect your IP address (truncated), device and browser information, pages viewed, and approximate location. Google may use this data per their privacy policy. We do not load Google Analytics inside the authenticated client portal. Google Analytics is suppressed when your browser sends a Global Privacy Control (GPC) signal or when you opt out via our Your Privacy Choices page. We have disabled Google Signals and ad-personalization features on our property.
• Vercel: hosts our website and provides Speed Insights, which collects anonymous performance metrics (page load timing, Core Web Vitals) without using cookies. Vercel may also process limited request metadata for hosting and DDoS protection.

Your data is stored on servers operated by Supabase. Payment data is handled by Square's PCI-DSS compliant infrastructure. Card details never touch our servers. We take reasonable technical measures to protect your information, including encrypted connections (HTTPS) and access controls.

No method of transmission over the internet is 100% secure. While we work to protect your data, we cannot guarantee absolute security.

We retain personal information only for as long as needed for the purposes described above:

• Account information & communications: retained for the life of your account, plus up to 24 months after account closure for legitimate business records.
• Billing & transaction records: retained for 7 years to comply with California and federal tax/accounting requirements.
• Brand files & project deliverables: retained while your account is active; deleted within 90 days of account closure unless you request earlier deletion.
• Phone numbers & SMS consent records: retained while opt-in is active; opt-out records retained for 4 years to demonstrate TCPA compliance.
• Web analytics data: Google Analytics user-level data is set to expire after 14 months. Aggregate, non-identifiable metrics may be retained indefinitely.
• Authentication logs: retained for 12 months for security and fraud prevention.

We may retain information longer where required by law, to resolve disputes, or to enforce our agreements. When the retention period ends, we delete or de-identify the data.

All users of our Service have certain rights regarding their personal information:

• Right to know / access: request a copy of the personal information we hold about you, including categories collected, sources, purposes, and any third parties we share it with.
• Right to correct: request correction of inaccurate personal information.
• Right to delete: request deletion of personal information we hold about you, subject to legal retention requirements.
• Right to opt out of sale or sharing: direct us not to sell or share your personal information for cross-context behavioral advertising.
• Right to limit use of sensitive personal information: direct us to use sensitive personal information only for permitted purposes.
• Right to non-discrimination: we will not deny service, charge different prices, or provide a different level of quality because you exercised any of these rights.
• Right to opt out of marketing: stop receiving marketing emails or SMS messages at any time.

Sale or sharing of personal information: We do not sell personal information for money. To the extent that our use of Google Analytics on our public website may be considered "sharing" for cross-context behavioral advertising under the California Privacy Rights Act (CPRA), we honor opt-out signals as described below. We have disabled Google Signals, advertising features, and data sharing for advertising purposes on our Google Analytics property.

In the prior 12 months we have not sold personal information for monetary consideration and have not knowingly sold or shared the personal information of consumers under 16 years of age.

How to exercise your rights — at least two methods:

• Web form: visit loudestcreative.com/privacy-choices to opt out of analytics sharing or submit a privacy request.
• Email: contact james@loudestcreative.com with the subject line "California Privacy Request" and describe what you would like us to do.

We will verify your request by matching the information you provide to records we already have (typically the email on your account). For requests submitted by an authorized agent, we may require written authorization. We respond to verifiable requests within 45 days, with one possible 45-day extension as permitted by law.

Global Privacy Control (GPC) and Do Not Track: Our public website honors the Global Privacy Control browser signal. When we detect GPC, we treat it as a valid opt-out of sale and sharing of personal information for that browser, and we suppress Google Analytics for that visit. Most modern browsers do not transmit a meaningful Do Not Track (DNT) signal, but where DNT is sent we treat it the same way as GPC.

If you provide your phone number, Loudest Creative may send you SMS text messages and/or call you regarding project updates, website preview links, billing matters, and other business communications. By providing your phone number, you consent to receive these communications from Loudest Creative.

• Message frequency: low volume, typically 1–5 messages per month.
• Standard rates apply: message and data rates may apply depending on your carrier and plan.
• Opt out: you can stop receiving SMS messages at any time by replying STOP to any message. After opting out, you will receive a one-time confirmation and no further texts.
• Help: reply HELP to any message for assistance, or contact us at james@loudestcreative.com.
• Data security: your phone number is stored securely and is not sold, rented, or shared with third parties for their marketing purposes. Text messaging originator opt-in data and consent will not be shared with any third parties, excluding aggregators and providers of the text messaging services.

Our authenticated client portal uses only strictly-necessary session cookies for login. Our public marketing website (loudestcreative.com) additionally loads Google Analytics 4 to measure aggregate traffic, with Google Signals and ad-personalization features disabled. We honor the Global Privacy Control browser signal and provide an opt-out on our Your Privacy Choices page. When either is set, Google Analytics is not loaded. See our Cookie Policy for the full list of cookies and durations.

Our Service is not directed at anyone under the age of 18. We do not knowingly collect personal information from minors. If you believe a minor has provided us data, contact us and we will remove it.

We may update this Privacy Policy from time to time. If changes are material, we will notify you by email or through the Service. Continued use after changes take effect constitutes acceptance.

Questions or requests about your privacy? Contact us at james@loudestcreative.com. Loudest Creative is based in Los Angeles, California.