Privacy Policy

This Privacy Policy explains how Nilewright LLC (“Nilewright,” “we,” “us”) collects, uses, shares and protects personal information through nilewright.com, our client portal, our emails, and the websites we build and host for our clients (together, the “Services”), and the choices and rights you have. We wrote it in plain language on purpose.

1. The short version

• We collect only what we need to provide the Services and get paid.
• We do not sell personal information, “share” it for cross-context behavioral advertising, use it for targeted advertising, or profile you in ways that produce legal or similarly significant effects. We never have.
• We use no advertising cookies, tracking pixels or third-party ad trackers. Our website statistics are cookieless and do not store IP addresses.
• Card and bank details are handled by our payment processor, Stripe. We never see or store full card numbers.
• You can ask to see, correct, delete or get a copy of your information at any time.

2. Who is responsible for your information

For information about our own prospective clients, clients and their staff, and visitors to nilewright.com, Nilewright is the business (or “controller”) responsible for it.

For websites we build and host for clients, the client business is responsible for its own website and for information its visitors submit (for example, a contact form message sent to that business). We act as the client’s service provider (or “processor”) and handle that information only on the client’s instructions and under a written agreement. If you visited a client’s website and have a privacy question, please contact that business first; we will help them respond.

3. Information we collect

Information you give us.

• Inquiries: your name, business name, email address and anything you write in your message.
• Client accounts: name, email, phone number, business name and address, login credentials (stored only as a one-way hash), and your agreement acceptance records (name typed, date, time and agreement version).
• Website content: the text, photos, logos, hours, prices and other material you provide for your website. This is generally business information, not personal information, but it may include names or photos of people you choose to include.
• Billing records: invoice amounts, dates, payment status and plan details. Stripe gives us only limited payment details such as card brand, the last four digits and expiration date.
• Communications: messages, change requests and support conversations you send us.
• Portal assistant: questions you type into “Ask Nile,” the AI help assistant in the client portal. To answer, we send your question, the conversation so far, and a summary of your own account (such as your plan, billing status and website statistics) to our AI provider, Anthropic. We don’t store these conversations ourselves, and the assistant never receives other clients’ information. Please don’t type passwords or card numbers into it.

Information collected automatically.

• Sign-in cookie: one strictly necessary cookie that keeps you signed in to the client portal (see Section 6).
• Security logs: our hosting and security providers briefly process technical data, such as IP address, browser type and request time, to deliver pages, prevent abuse and investigate security incidents. These logs are kept for a short period, generally no more than 30 days, unless needed for an active investigation.
• Website statistics: on nilewright.com and on client websites, aggregate, cookieless statistics: pages viewed, the referring website or campaign tag, device type (phone, tablet or desktop), approximate city provided by our hosting provider, page loading speed, and counts of taps on phone, email and map links and of form submissions (we count that a form was sent, not what it says). To count a visitor once per day without cookies, we create a one-way code from the IP address and browser type combined with a secret value that changes every 24 hours and is then discarded. The IP address is never stored, the code cannot be reversed or linked to a person, and it is not used to follow anyone across days or websites. We do not use device fingerprinting.

Information from others. Stripe tells us whether a payment succeeded. If a password is set or changed, we check it against lists of passwords exposed in known data breaches using a privacy-preserving method: only the first five characters of a one-way hash are sent to the checking service (Have I Been Pwned), never the password itself.

Sensitive information. We do not ask for or intentionally collect sensitive personal information, such as Social Security numbers, health information, precise geolocation, biometric data, or information revealing racial or ethnic origin, religion, sexual orientation or immigration status. Please don’t send it to us. Client websites we build are not designed to collect it unless a client specifically requests a feature that does, in which case we build it with appropriate safeguards and the client must provide any required notices and obtain any required consent.

4. How we use information

• To provide the Services: designing, building, hosting, securing, maintaining and supporting websites.
• To create and manage client accounts and the client portal.
• To bill for the Services, process payments, send receipts and payment reminders, and keep accounting and tax records.
• To show each client statistics about their own website.
• To respond to inquiries and requests and to communicate about the Services.
• To protect the Services, our clients and visitors, including detecting and preventing fraud, spam and attacks.
• To comply with law, enforce our agreements, and establish or defend legal claims.
• To improve the Services using aggregate, de-identified information.

We collect and use personal information only as reasonably necessary and proportionate for these purposes (data minimization). We do not use personal information for purposes that are incompatible with these without asking for your consent.

5. How we share information

We share personal information only as follows, and never sell it:

• Service providers that help us run the Services, under contracts that limit their use of the information to serving us: website hosting and security (Vercel), database and authentication (Supabase), payments (Stripe), transactional email (Resend), the portal’s AI help assistant (Anthropic, which processes assistant conversations to generate answers, may keep them briefly for safety and abuse monitoring under its commercial terms, and does not use them to train its models), and breached-password checking (Have I Been Pwned, which receives only a partial hash). We may add or change providers; this list will stay current.
• Our clients: a client sees its own website statistics (which are aggregate and do not identify visitors) and the messages its own website visitors send to it.
• Legal and safety: when required by law, subpoena or court order, or when we believe in good faith it is necessary to protect the rights, property or safety of anyone.
• Business transfers: as part of a merger, acquisition, financing or sale of assets, subject to this policy’s protections; we will notify you of any change in ownership affecting your information.
• With your direction or consent.

Each client’s information is kept separate. One client can never access another client’s data.

6. Cookies and similar technologies

We use exactly one cookie: a strictly necessary, secure, HTTP-only cookie that keeps you signed in to the client portal. It contains no tracking information, is not shared with anyone, and expires when you sign out or after a limited time. Because it is necessary for the service you request, it does not require consent.

We do not use analytics cookies, advertising cookies, social media pixels, session recording, or third-party trackers on nilewright.com or, unless a client asks us to add them, on client websites. If a client asks us to add a third-party tool to its own website (for example, an embedded map, booking widget or the client’s own analytics or advertising tags), that tool is covered by that client’s and that provider’s privacy policies, and the client is responsible for any notice and consent it requires. We will tell the client what it needs.

Do Not Track and Global Privacy Control. We honor “Do Not Track” and Global Privacy Control (GPC) browser signals: when we detect either, we do not count that visit in our statistics at all. Because we do not sell or share personal information or engage in targeted advertising, there is nothing else to opt out of; if that ever changes, we will treat a GPC signal as a valid opt-out request.

7. How long we keep information

• Client account and website content: for as long as you are a client. After your service ends, we keep your website files and content for 90 days so you can request a copy, then delete them.
• Billing and agreement records: as long as tax and business record laws require, generally up to seven years.
• Inquiries from people who don’t become clients: up to 24 months, then deleted.
• Website statistics: aggregate counts for as long as the client relationship lasts; the daily visitor codes are discarded within 24 hours.
• Security logs: generally up to 30 days.

8. How we protect information

We use administrative, technical and physical safeguards appropriate to the information we hold, including encryption in transit (HTTPS) and at rest, passwords stored only as salted one-way hashes, breached-password screening, sign-in throttling, database-level access controls that keep each client’s data separate, least-privilege access for our team, two-step sign-in on the hosting, payment and email accounts we use to run the Services, and regular software updates. Our hosting provider protects the Services against denial-of-service and other attacks. No system is perfectly secure; if a breach affecting your personal information occurs, we will notify you and any regulators as required by applicable state law, without unreasonable delay.

9. Your privacy rights

Wherever you live, you may ask us to:

• Know and access the personal information we hold about you, including the categories, sources, purposes and recipients.
• Correct inaccurate information.
• Delete your information, subject to legal exceptions (for example, records we must keep for tax purposes).
• Get a copy of your information in a portable, commonly used format.
• Opt out of the sale or sharing of personal information, targeted advertising and significant profiling. We do none of these, so these rights are honored automatically.
• Limit the use of sensitive personal information. We do not collect it, so this right is honored automatically.

Residents of California, Maryland, Virginia, Colorado, Connecticut, Texas, Oregon, Delaware, New Jersey and other states with comprehensive privacy laws have these rights by law; we extend them to everyone. We will not discriminate against you, charge you a different price or provide a different quality of service for exercising them.

How to make a request. Email hello@nilewright.com with “Privacy request” in the subject, or use the contact options in your client portal. We will confirm receipt within 10 business days and respond within 45 days; if we need more time (up to another 45 days, as the law allows), we will tell you why. To protect you, we verify your identity, usually by confirming you control the email address on file, and we will ask only for the information needed to do so. You may use an authorized agent; we may ask for proof of the agent’s authority and to verify your identity directly.

Appeals. If we decline your request, you may appeal by replying to our decision or emailing hello@nilewright.com with “Privacy appeal” in the subject within 60 days. We will respond in writing within 60 days, explaining our decision. If you are not satisfied, you may contact your state Attorney General (for Maryland residents, the Maryland Attorney General’s Consumer Protection Division).

Requests about a client’s website. If your request concerns information you submitted to one of our clients’ websites, we will forward it to that business and help it respond.

10. Additional information for California residents

In the past 12 months we collected these categories of personal information, from the sources and for the business purposes described in Sections 3 and 4: identifiers (such as name, email, phone and account ID); customer records (such as billing address and limited payment details); commercial information (services purchased and billing history); internet or electronic network activity (security logs and aggregate website statistics); and professional information (business name and role). We disclosed these categories to the service providers listed in Section 5 for business purposes. We have not sold or shared personal information, have no actual knowledge of selling or sharing the information of anyone under 16, and do not use or disclose sensitive personal information. Under California’s “Shine the Light” law, we do not disclose personal information to third parties for their own direct marketing purposes.

11. Emails from us

We send service emails, such as receipts, payment reminders, security notices and account messages; these are part of the Services and can’t be turned off while you are a client. If we ever send marketing emails, we will send them only as the law allows, each will identify us, include our postal address and contain a working unsubscribe link, and we will honor unsubscribe requests within 10 business days.

12. Children

The Services are designed for businesses and are not directed to children. We do not knowingly collect personal information from children under 13 (or under 16 where state law sets a higher age). If you believe a child has given us personal information, contact us and we will delete it.

13. Where information is processed

We are based in the United States, and our service providers process information in the United States. If you contact us from outside the United States, your information will be transferred to and processed in the United States.

14. Changes to this policy

We will update this policy whenever our practices change, before the change takes effect, and update the date at the top. If a change is material, for example if we ever begin using information in a new way, we will notify clients by email at least 30 days in advance and, where required, ask for consent.

15. Contact us

Nilewright LLC · Laurel, Maryland · hello@nilewright.com

This policy is available in an accessible format and, on request, explained in Amharic. If you have a disability and need it in another format, email us.