Privacy policy

At a glance

• We collect what you type into our contact form or put in an email, plus a few technical signals that keep spam out.
• We use it to reply to you, to scope and quote your project and to protect the site. If you tell us how you heard about us, we also use that to learn which ways of finding us work. Nothing else.
• This site sets no cookies of its own and runs no analytics, advertising or tracking scripts. Our server counts views of each page per day, without recording anything that identifies you.
• We don’t sell your personal information, share it for cross-context behavioral advertising, or use it for targeted ads.
• We honor the Global Privacy Control signal. See Your privacy choices.
• Anyone, in any state, can ask us to see, correct or delete their information by emailing hello@snowdriven.com. We respond within 45 days.

Who we are

SnowDriven is the brand of Snow Driven LLC, a software engineering studio based in Pittsburgh, PA. In this policy, “we”, “us” and “our” mean Snow Driven LLC. We decide how and why the information described here is used, so we are responsible for it (under European law, the “controller”). You can reach us about privacy at hello@snowdriven.com.

What this policy covers

This policy covers snowdriven.com and the inquiries people send us through its contact form or by email. It does not cover work we do for clients under a signed agreement: that agreement says how client and project data is handled. It also does not cover other websites, including ones we link to.

What we collect

Information you give us

When you use the contact form, we collect:

• Contact details: your name and email address (required), and your company name and phone number if you add them.
• Project details: your description of the project (required), the kind of project, a preferred platform, a timeline, your current website address, and a budget status (for example “Budget approved” or “Just exploring”; we never ask for an amount). Only the description and the kind of project are required.
• If you ask for a call: the times that suit you.
• If you send the readiness check’s answers: they’re added to your project description, and you can edit them before sending.
• Where you came from on our site: the page or service you started from (for example the WordPress service page), filled in by the form so we know what you were looking at.
• How you heard about us, if you tell us: an optional question with a few choices, such as a search engine, an AI assistant, LinkedIn or a referral. You can leave it blank. We use your answer only to learn which ways of finding us work, and we keep and share it with your inquiry like the rest of the form.

If you email us, we receive your email address, your name as your email program shows it, anything you write or attach, and the usual technical details that travel with an email (such as the date and the sending mail servers).

Please don’t send us sensitive information, such as health or financial account details, or anyone else’s personal information without their permission.

Information collected automatically

• With a form submission: the date and time, whether your browser sent a Global Privacy Control signal, a spam score our server calculates (from things like how quickly the form was filled in and whether a hidden anti-bot field was filled), the result of the Cloudflare Turnstile check (passed, failed or missing), and a priority flag based on your answers.
• Your IP address: when you submit the form, we use it to limit how many submissions can come from one address in a short time, and we pass it to Cloudflare Turnstile to help tell people from bots. We don’t store it with your inquiry.
• Request and security logs: like any website, every page request passes through our hosting provider, Cloudflare, which processes technical information such as IP address, browser type, the page requested, the referring page and the time, to deliver the site and protect it from attacks. See Who helps us.
• Page counts: when you view a page, our server adds one to that page’s count for the day. Nothing that identifies you is kept with it. See Page counts.
• Data files, feed and calendar: downloading our data files, feed or calendar works like any page request; we don’t know who subscribes.

Once a day our server fetches public statistics from WordPress.org; nothing about our visitors is sent.

Information from other sources

The only information we receive about you from another company is Cloudflare Turnstile’s pass or fail result when you submit the form. We don’t buy personal information or contact lists.

How we use it

• To reply to you and to scope, quote and plan the project you asked about, including a call if you want one.
• To keep a record of your inquiry so we can follow up and pick up the conversation later.
• To learn how people find us, from the optional “How did you hear about us?” answer, counted across inquiries.
• To keep the site and the form safe: to block spam, abuse and attacks.
• To honor your choices, including a Global Privacy Control signal, and to answer privacy requests.
• To meet legal obligations and to protect our rights if there is a dispute.

We don’t add you to a newsletter or send you marketing email. We only write to you about your inquiry, or about a project once you’ve asked us to. We don’t use your information to make automated decisions that have legal or similarly significant effects on you.

For visitors from the UK and the European Economic Area

We are a US business and this site is aimed at US clients. To the extent UK or EU data protection law applies to an inquiry, we rely on these legal bases: taking steps at your request before entering into a contract (replying to and scoping your inquiry); our legitimate interests in running and securing the site, keeping records of our business conversations and learning how people find us; and compliance with legal obligations. You can object to processing based on legitimate interests, and you can complain to your local data protection authority.

Cookies and similar technologies

This site sets no cookies of its own and doesn’t use your browser’s local storage. We don’t run analytics or advertising scripts, pixels, social media plugins, session recording or embedded third-party content. Our fonts are served from our own domain, so loading a page doesn’t contact a font service.

Page counts. Our server counts page views: how many times each page is viewed each day. With each count it notes whether the request came from a person, a search engine, an AI crawler or another automated tool, and which kind of site referred it, by the site’s name from a fixed list (such as Google, ChatGPT, LinkedIn or our own site; any other site counts as “another site”). It doesn’t record IP addresses, browser details or any identifier. It sets no cookies and runs no tracking script, so a count can’t be tied to anyone. We keep the counts for up to 25 months.

Our host, Cloudflare, also shows us aggregate traffic totals from its own request logs, such as requests per page; they aren’t tied to you, and we don’t combine them with your inquiry. Search engines’ webmaster tools show us how often our pages appear in their results.

The one third-party script is Cloudflare Turnstile, an anti-spam check on the contact page. It loads only on /contact/, and only once you start using the form. It is strictly necessary to protect the form from bots. By default it works with a one-time token that is sent with your form, not with a cookie. According to Cloudflare, Turnstile processes signals such as your IP address, browser and device characteristics, and the site you are on, solely to detect bots and to improve its bot detection, and not to identify, profile or target you. The widget runs in a frame served by Cloudflare, which may use its own browser storage inside that frame. Cloudflare’s Turnstile privacy addendum describes this in more detail.

As our host, Cloudflare may also set a strictly necessary security cookie if it needs to challenge suspicious traffic, and it may ask your browser to send network error reports (a web standard called Network Error Logging) to Cloudflare when a page fails to load. Those reports contain technical details about the failed request, such as the page address, the error and your IP address, and are used to keep the network reliable.

Who helps us (service providers)

We share personal information only with the service providers and specialists described here. Service providers handle it for us, under contracts that limit their use of it to providing their service to us:

• Cloudflare (United States, with a global network) hosts and delivers the site, stores form submissions in its D1 database in its eastern North America region, rate-limits the form and runs Turnstile.
• Resend (United States) delivers an email notification of each new inquiry to our team. Submissions caught by the hidden anti-bot field are marked as spam, stored and not emailed.
• HubSpot (United States data center) is our customer relationship management (CRM) system. We send it your contact and project details, server to server, so we can manage the conversation. Submissions flagged as likely spam are not sent.
• Zoho Mail (Zoho Corporation) hosts our mailbox, where inquiry notifications and any email you send us are received and kept.

Independent specialists and agencies that we bring in to help scope or deliver a project, such as a designer or an infrastructure specialist. We share only what they need about your inquiry or project, only under written confidentiality terms, and we tell you who they are.

We may also disclose information if the law requires it, to protect our rights or someone’s safety, or to a successor if our business is sold or reorganized. A successor would remain bound by this policy for information collected under it.

No sale, no sharing, no targeted ads

We don’t sell personal information, and we haven’t in the past 12 months. We don’t share it for cross-context behavioral advertising, use it for targeted advertising, or let any third party track you on this site for those purposes. We don’t disclose it to third parties for their own direct marketing.

Global Privacy Control and Do Not Track

Global Privacy Control (GPC). If your browser or an extension sends a GPC signal, we treat it as a valid request to opt out of the sale or sharing of your personal information, and of targeted advertising, for that browser. We already do none of these, but if you send us an inquiry, we record the signal with it, flag it in the email notification we receive, and pass it to our CRM with any inquiry we send there (likely spam is not sent) so the opt-out stays attached to your record. More on the Your privacy choices page.

Do Not Track (DNT). DNT is an older browser setting with no agreed standard for how websites should respond, so we don’t change how the site works when we receive it. Because the site doesn’t track you over time or across other websites, and doesn’t let third parties do so for advertising or profiling, there is no tracking for it to switch off. The site’s one third-party script is Cloudflare Turnstile on the contact page, which processes browser and device signals to detect bots, as described in Cookies and similar technologies. We do honor GPC, which replaces DNT for this purpose under several state laws.

How long we keep it

• Form submissions are deleted from our database automatically 18 months after they were sent.
• Submissions our system marks as spam (because the hidden anti-bot field was filled in) are deleted automatically after 90 days.
• Delivery records (whether the email notification and the CRM copy went through) are deleted with the submission they belong to.
• Page counts, which contain no personal information, are deleted automatically after 25 months.
• Emails and CRM records about an inquiry are deleted 18 months after our last contact with you, unless we are working together, in which case they are kept for the engagement under our client agreement. We delete these by hand.

We may keep information longer if the law requires it, or to resolve a dispute. Deleted database records can remain in Cloudflare’s database recovery history for up to 30 days. Cloudflare’s request logs and the email notification logs kept by Resend are held for limited periods under those providers’ own terms.

How we protect it

The site is served only over HTTPS. Inquiries are stored in a database that only our team can reach, and access to our email, CRM and hosting accounts is limited to people who need it. No system is perfectly secure, so we can’t guarantee absolute security, but if a breach affects your personal information we will notify you as the law requires.

Where it is processed

We and our service providers are in the United States, and we store and process personal information in the United States, except that our form database is held in Cloudflare’s eastern North America region. Cloudflare delivers pages from the data center nearest to you, which may be outside the United States. If you contact us from outside the United States, your information will be transferred to and handled in the United States, where privacy laws may differ from yours.

Your rights

Whatever state or country you live in, you can ask us to:

• Know and access: tell you what personal information we hold about you, how we got it, why we use it and who we disclosed it to, and give you a copy.
• Correct information that is inaccurate.
• Delete your information, unless we need to keep it (for example, to meet a legal obligation).
• Opt out of the sale or sharing of your personal information, targeted advertising and profiling. We don’t do these, but you can still record an opt-out.
• Limit the use of sensitive personal information. We don’t ask for it, and we don’t use it to infer anything about you.

How to ask. Email hello@snowdriven.com and tell us what you want. We confirm receipt within 10 business days and respond within 45 days. If we need more time, up to 45 more days where the law allows, we’ll tell you why within the first 45 days. Requests are free.

Verification. To protect you, we confirm that a request comes from the person it is about, usually by replying to the email address we have on file. We may ask for a little more information if needed, and we use it only to verify the request.

Authorized agents. Someone you authorize can make a request for you. We’ll ask for your signed permission or a power of attorney and may ask you to confirm your identity with us directly.

Appeals. If we decline your request, you can appeal by replying to our decision or emailing hello@snowdriven.com with “Appeal” in the subject. We’ll respond within 45 days and explain our reasons. If you are still not satisfied, you can contact your state attorney general.

No discrimination. We won’t treat you differently, or charge you differently, for exercising any of these rights.

State-specific notices

California. In the past 12 months we collected the categories described in What we collect: identifiers (name, email, phone, and IP address used briefly for security), professional information (company), internet activity limited to the page you came from and security signals, and the contents of your inquiry. We collected them from you and your browser for the purposes in How we use it, disclosed them only to the service providers and specialists described in Who helps us, and kept them for the periods in How long we keep it. We don’t sell or share personal information, and we don’t collect sensitive personal information to infer characteristics about anyone. California’s “Shine the Light” law lets you ask about disclosures for direct marketing; we make none. Our page counts aren’t listed here because they are totals that can’t be linked to anyone.

Nevada. We don’t sell covered information as Nevada law defines it. You can still submit a request not to sell by emailing hello@snowdriven.com, and we’ll confirm it.

Delaware and other states with privacy laws (including Colorado, Connecticut, Oregon, Texas and Virginia). The rights in Your rights, including the right to appeal, are available to residents of every state. We don’t sell personal data, process it for targeted advertising, or use it for profiling that produces legal or similarly significant effects.

Children

This site is for businesses and isn’t directed to children. We don’t knowingly collect personal information from anyone under 16. If you believe a child has sent us information, email hello@snowdriven.com and we’ll delete it.

Changes to this policy

We’ll update this policy when our practices change, and change the “Last updated” date at the top. If a change materially affects how we use information we already hold, we’ll tell you before it takes effect, for example by email if you have an open inquiry. This version took effect on October 16, 2026.

Contact us

Questions, requests or complaints about privacy: email hello@snowdriven.com. We are Snow Driven LLC, Pittsburgh, PA. You can also write to the same address if you need this policy in another format.