Privacy Policy

1. Two kinds of data, two roles

This policy describes two different roles we play:

• Account Data is information about our customers — freelancers who hold a ClientFoyer account — and their use of the service. For Account Data, we decide why and how it is processed (we are the "controller" / "business").
• Client Data is information about a freelancer's clients, submitted through portals, intake forms, comments, files, and invoice pages, or uploaded by the freelancer. For Client Data, the freelancer decides why and how it is processed (they are the "controller" / "business") and we process it only to provide the service on their instructions (we are their "processor" / "service provider"), under the Data Processing Terms in our Terms of Service.

2. What we collect and why

We collect only what the service needs. We do not buy data from brokers, and we do not collect advertising identifiers.

3. Who processes data for us

We disclose personal information only to the providers below, which may use it only to provide their service to us:

• Stripe, Inc. — subscription billing and payment processing.
• Resend, Inc. — delivery of transactional email (account notices, and the portal and invoice notifications a freelancer triggers).
• ImprovMX — forwards mail sent to our @clientfoyer.com addresses to our mailbox.
• Google (Gmail) — hosts the support mailbox.
• Meta Platforms, Inc. (Muse) — the operator's AI assistant, used for support and operations tasks under the operator's direction. A training opt-out is in effect: information processed through it is not used to train AI models.
• PostHog, Inc. — product analytics: how account holders use the service (pages visited, actions taken, and the funnel events described in Section 4), including session replay in which all form inputs are masked. Session replay is disabled on the client portal and on public invoice pages.
• Microsoft Corporation (Clarity) — analytics for our public pages only (the homepage, pricing, blog, and legal pages): heatmaps and session replay of those visits, with form inputs masked. Clarity is not present in the signed-in service.
• Cloudflare, Inc. — routes traffic between visitors and the service over a secure tunnel and terminates the encrypted (TLS) connection, processing connection metadata (such as IP addresses) to deliver and protect that traffic. It does not store account or portal content.

The service itself runs on infrastructure we operate — there is no third-party hosting company holding your data. We also disclose information where required by law or legal process, to protect rights, safety, or the security of the service, or in connection with a sale or reorganization of the business, on notice.

We do not sell personal information, we do not share it for cross-context behavioral advertising, we operate no advertising trackers, and we do not use Client Data to train AI models.

4. Cookies and analytics

We use strictly necessary cookies to sign you in, keep your session secure (including CSRF protection), and remember essential preferences. We do not use advertising or cross-site tracking cookies. The analytics tools below store a random identifier on your device so repeat visits can be told apart from new ones; that identifier is not used for advertising.

For website statistics we use GoatCounter, which we host ourselves, configured to be cookieless: it records the page visited, the referring site, browser and system type, screen size, country, and language; it stores no IP address and no tracking identifier (a temporary hash used to count a session is held only in memory and never written to disk), and it reports only aggregate counts.

For product analytics we use PostHog: it records pages visited and actions taken in the service — such as signing up, creating an invoice, sending an invoice to a client, starting checkout, and receiving a payment — so we can see where people get stuck, and it can record a replay of a session, with every form input masked, on the same basis. Session replay is switched off on the client portal and on public invoice pages, and the events above carry the invoice number and amount but never client names or contact details. For the public pages (the homepage, pricing, blog, and these legal pages) we also use Microsoft Clarity, which produces heatmaps and session replays of those visits, again with form inputs masked; Clarity is not loaded inside the signed-in service.

5. Retention

We keep personal information only as long as needed:

• Account Data — while your account is open.
• Client Data and files — until you delete them or close your account.
• Billing, invoice, and tax records — 7 years, as tax and accounting law requires. (Payment records themselves are held by Stripe under its own policy.)
• API usage logs and webhook delivery logs — up to 90 days.
• Portal activity records — the download event log is kept up to 90 days; the per-file download count and most recent download time are kept with the file until the file or the account is deleted.
• Operational and security logs — up to 12 months.
• Support correspondence — up to 24 months after the request closes.
• Email delivery records — held by our email provider under its retention policy.
• Copyright notices and repeat-infringer records — while your account is open and for 3 years after.
• Password reset tokens — 2 hours, and deleted as soon as they are used.

Website analytics are aggregate counts; there are no raw visitor records to retain.

6. Export and deletion

Export. You can download a ZIP export of your account at any time in Settings: your account details, your projects (with updates, tasks, invoices, intake responses, and testimonials), your uploaded files, and metadata about your API keys and webhooks. Secrets and keys themselves are never exported.

Deletion. You can delete your account in Settings. Deletion takes effect immediately for access, and we delete your live data at that time (in all cases within 30 days). We cancel your Stripe subscription as part of deletion; Stripe keeps its own records under its policy. We retain only the narrow residue listed in Section 5 (for example, tax records). ClientFoyer does not keep separate long-term backup copies of account data, so deletion does not need to age out of backups. Deletion cannot recall copies already downloaded by your clients, delivered by email, or held by your own payment provider.

If you are a client of a freelancer: the freelancer controls the information they collected about you. Contact them first for access or deletion. You may also contact us at [email protected] — we will forward your request to the freelancer and assist them, and we will delete Client Data on the freelancer's instruction.

7. Security

We maintain safeguards appropriate to our size and the data we hold, consistent with the New York SHIELD Act: encryption in transit (TLS), passwords stored using a one-way hash, API keys stored as hashes and webhook secrets encrypted at rest, access limited to the operator on a need-to-know basis, security logging and monitoring, and providers required by contract to maintain safeguards. No system is perfectly secure and we do not guarantee absolute security. If a breach affecting your personal information occurs, we will notify affected individuals and regulators as required by law — in New York, without unreasonable delay and in any event within 30 days of discovery — and tell you what happened, what information was involved, and what we are doing about it.

8. Your rights

Wherever you live, you may ask us for: access to your personal information; correction; deletion; a portable copy (see Export, Section 6); and to object to or restrict our use of Account Data for marketing. Use the in-app controls or email [email protected]. We will verify your identity in a way proportionate to the request, respond within 30 days (and tell you if we need up to 30 more), and we will not charge a fee or treat you differently for exercising a right. If we decline a request we will explain why and, where a law gives you one, how to appeal or complain to your regulator or attorney general.

Transactional email (password resets, billing notices, and the client notifications a freelancer triggers) is part of the service and cannot be opted out of while an account is open. If we ever send product or marketing email, it will carry an unsubscribe link honored across marketing streams, and opting out will never affect transactional notices.

9. Children

The service is for users 18 and over and is not directed to children under 13. If we learn we hold personal information of a child under 13 without parental consent, we will delete it.

10. Changes and contact

If we make a material change to this policy we will notify account holders by email or in-app before the change takes effect, and will provide the prior version or a summary of changes on request.

Privacy questions and requests: [email protected] · General support: [email protected] · Copyright: see our DMCA page.