Privacy Policy
Draft version July 23, 2026 · Not approved for production payment collection
This notice is designed to accurately describe the information practices of Built By Elephant and its client portal. It should be reviewed by qualified counsel before live checkout is enabled.
1. Who We Are
This Privacy Policy explains how The Social Elephant, LLC, doing business as Built By Elephant (“Built By Elephant,” “we,” “us,” or “our”), collects, uses, shares, retains, and protects personal information through builtbyelephant.io, the Built By Elephant client portal, project intake, checkout, and related website-design and Managed Website Care services.
2. Information We Collect
We may collect contact and account information such as your name, business or organization name, email address, telephone number, account role, and authentication identifiers. We collect project information you submit, including goals, timelines, website addresses, branding, copy, images, documents, links, approvals, support messages, and other materials needed to plan, build, launch, and maintain a website.
When you use the website or portal, we and our service providers may receive technical information such as IP address, browser and device type, referring page, timestamps, session information, security events, and activity needed to operate, protect, troubleshoot, and improve the service.
Stripe collects payment-card, billing, transaction, and fraud-prevention information through Stripe Checkout. We receive transaction identifiers, payment status, customer and subscription references, billing selections, and limited billing details, but we do not receive or store full card numbers.
3. How We Use Information
We use information to respond to inquiries; recommend and quote services; create and administer accounts; authenticate users; process purchases and recurring payments; plan, design, build, host, secure, maintain, and support websites; request and review project materials; communicate project status; maintain records of agreements and approvals; prevent fraud and abuse; troubleshoot and improve our services; comply with law; and establish, exercise, or defend legal rights.
We do not sell personal information. We do not use private client-portal content or uploaded project materials for unrelated advertising.
4. Client Materials and Third-Party Information
Project materials may contain personal information about your customers, employees, members, donors, vendors, or other people. You are responsible for having the rights, notices, permissions, and lawful basis needed to provide that information to us and to instruct us to use it for your project. We use that information only to provide the requested services, follow your documented instructions, protect the service, or comply with law.
5. How We Share Information
We may share information with service providers that help us operate the business and services, including Supabase for authentication, database, and private file storage; Stripe for payment processing, billing, and fraud prevention; hosting.com and related infrastructure providers for application hosting; and email, domain, analytics, monitoring, backup, and technical-support providers used for a project.
We may also disclose information when reasonably necessary to comply with law or valid legal process; protect customers, systems, or others; investigate fraud, abuse, or security incidents; enforce agreements; or complete a merger, financing, reorganization, sale, or transfer of all or part of the business. We may share information with your consent or at your direction.
6. Accounts, Authentication, and Security
Client-portal access is invitation-only. You are responsible for keeping your login credentials confidential, using a unique password, signing out of shared devices, and promptly notifying us of suspected unauthorized access. Password authentication is handled by Supabase; we do not receive your readable password.
We use reasonable administrative, technical, and physical safeguards appropriate to the information and our services, including access controls, row-level database restrictions, private file storage, encrypted network connections, and limited administrative access. No system can be guaranteed completely secure, and you should not upload highly sensitive information unless we specifically request and approve a secure method.
7. Cookies and Similar Technologies
The portal uses essential cookies or similar browser storage to maintain authentication, security, preferences, and form progress. Stripe and other service providers may use their own cookies or similar technologies for checkout, fraud prevention, and service operation under their policies. We will update this notice and provide any legally required choices before adding nonessential advertising or cross-site tracking technologies.
8. Retention and Deletion
We keep personal information only as long as reasonably necessary for the purposes described here, including active services, account administration, support, security, dispute resolution, and legal, tax, accounting, and contractual obligations. Retention periods vary by record type.
When Managed Website Care ends, website archives may be retained for up to 90 days as described in the Terms of Service and may then be permanently removed. Account, consent, transaction, invoice, security, and legal records may be retained longer when reasonably required. Backups may retain deleted information for a limited period before routine overwrite.
9. Your Choices and Requests
You may request access to, correction of, or deletion of personal information associated with your account, or ask questions about our practices, by emailing hello@builtbyelephant.io with the subject “Privacy Request.” We may need to verify your identity and authority before completing a request. We may retain or decline to delete information when required or permitted for contracts, billing, security, legal claims, recordkeeping, or other lawful purposes. Additional rights may apply based on where you live.
10. Children’s Information
Our website and services are intended for businesses and organizations and are not directed to children under 13. We do not knowingly collect personal information directly from children under 13. If you believe a child has provided personal information without appropriate authorization, contact us so we can review and address it.
11. United States Processing
Built By Elephant is based in New York, and information may be processed and stored in the United States and other locations where our service providers operate. Those locations may have different data-protection laws than your location.
12. Changes and Contact
We may update this Privacy Policy to reflect changes in our services, providers, practices, or legal obligations. The effective date and version shown on this page identify the current notice. Material changes will be communicated when required by law.
Privacy, project, and account questions may be sent to hello@builtbyelephant.io. Please use the subject “Privacy Request” for privacy-rights requests.