Privacy policy

• The contact form. Your name, email address, the topic you pick and your message. The form emails them to us. We don't store them anywhere else.
• Payments. Stripe runs checkout. We receive your name, email address, business name, billing address, tax ID if you give one, the domain you want audited and whether the payment went through. We never see your card number.
• The client portal and the Sapid Portal app. Your email address and password, handled by Firebase Authentication. We store your company details, your audits and their findings in our database. Signing in sets one cookie, __session, which keeps you signed in to the portal.
• Security audits. An audit of your business reads what anyone on the internet can already see about your domains: DNS and email records, certificates, response headers and the pages your sites serve. An audit of a person also looks up the email address they give us in breach databases (XposedOrNot and Hudson Rock) and in public profiles (Gravatar and GitHub). We only audit people who ask us to.
• Websites we build for clients. A client site's contact form sends the visitor's name, email address, phone number and message to that business, and keeps a copy in our database so the business can read it in their portal. The business decides what happens to those messages.
• Traffic. Cloudflare sits in front of sapidlabs.com and records basic request data, such as IP addresses and the pages requested, to deliver the site and block attacks.

To answer you, do the work you hired us for, bill you and keep the site secure. We don't sell or rent your information, and we don't use it for advertising.

• Google: Firebase Authentication, our database and hosting on Google Cloud, and our email.
• Cloudflare: DNS, the network in front of the site, and email forwarding.
• Stripe: payments and invoices.

Client records and audits stay while you're a client, and until you ask us to delete them. Messages from the contact form stay in our inbox. Stripe keeps payment records for as long as the law requires.

Email us to see, correct or delete what we hold about you, and we'll do it. A client can also edit their company details in the portal at any time.

When this policy changes, the date at the top changes with it.