YOUR PRIVACY
Privacy Policy
Summary
- We collect what you give us to answer inquiries and provide IT services, plus basic technical data needed to run the site securely.
- We don’t sell or share personal information, show ads, or use third-party analytics or tracking.
- You can ask to see, correct, or delete your information at any time using our privacy request form, by email, or by phone.
Information we collect
In the last 12 months we have collected the following categories of personal information:
| Category | Examples | Source |
|---|---|---|
| Identifiers and contact details | Name, company, email address, phone number, business address | You, through our contact form, customer portal, email, or phone |
| Account information | Customer portal login email, name, company membership, invitation records and access permissions, and a one-way hash if you set a password; if you choose Google sign-in, your Google account identifier and email. For connected customer Workspaces, verified users may receive a basic portal account on first sign-in; we retain its Workspace connection and Google identifier and periodically verify active membership. Company admins can view their company’s portal members and manage their permissions; if you add a passkey, its public key and the name you give it (fingerprint and face data never leave your device) | You; Google, if you use Google sign-in |
| Communications and support records | Messages you send us, including emails to info@, support requests and replies, approvals of planned changes; and the service emails we send you | You and your organization’s portal users |
| Commercial information | Services provided, quotes you accept (with the name and email given when accepting), service agreements, invoices, selected tax locations and tax calculation records, payment status and amounts | Our records; Stripe processes card and bank payments, and we never receive full card or bank account numbers. If you turn on automatic payments, Stripe stores your card or bank account and we keep only the card brand or bank name and the last four digits |
| Network and device information (managed customers) | Names, models, and serial numbers of equipment we manage; Wi-Fi network names; MAC addresses of devices you ask us to block; network event logs that can include connected devices’ names and MAC addresses | Your organization and the network equipment we manage for it (Cisco Meraki or Ubiquiti UniFi) |
| Google Workspace security reviews (connected organizations) | Account security flags, administrator status and last sign-in dates are processed to produce aggregate findings. We retain the primary domain, Google organization and connecting administrator identifiers, an encrypted authorization token, the latest aggregate report, relevant public DNS evidence, and dismissal notes and history. Authorized Coastside staff may load affected account email addresses, organizational units and security flags on demand; those directory details are displayed transiently and are not saved to reports or shown in the customer portal. Security review reports do not retain employee directory records or access mailbox and Drive contents. Separately, Workspace portal sign-in stores the account records described above and the organization’s verified domains. | Google Directory API with administrator consent; public DNS records |
| Internet activity | IP address, browser type, pages requested, and security events in server logs | Automatically, when you use the website |
We do not collect sensitive personal information such as Social Security numbers, financial account credentials, precise geolocation, or health information, and we ask you not to send passwords or other secrets through our forms.
How we use it
- To respond to inquiries and provide, support, and bill for our services.
- To operate the customer portal, verify company membership, apply access permissions, and process authorized network changes. Basic users see their own requests; services admins and company admins can see company requests and services; billing access requires billing or company admin permission.
- To provide read-only Google Workspace security reviews. Organization-level findings, dismissal status and notes are visible to Coastside and, for customer connections, that customer’s authorized portal members. Google Workspace review data is not sent to AI drafting services or used for advertising.
- To keep the website and our customers’ systems secure, prevent abuse, and troubleshoot problems.
- To draft suggested replies to support requests and to emails sent to our info@ address. When a Coastside staff member chooses to use this feature, the text of that request or email is sent to Anthropic’s Claude service; drafts are reviewed by a person before anything is sent.
- To meet legal, tax, and accounting obligations.
We don’t use personal information for advertising, profiling, or automated decisions that have legal or similarly significant effects.
Who we disclose it to
We disclose personal information only to service providers that help us run our business, under contracts that limit their use of it to providing services to us:
- Railway hosts the website and its database.
- Google Workspace provides our email, including the info@ mailbox our business workspace reads so we can reply and follow up, and sends the service emails described above; Google also provides optional sign-in, authorized directory access for security reviews, and public DNS lookups.
- Stripe processes online payments and, if you choose automatic payments, securely stores the card or bank account you save.
- Anthropic provides AI drafting of support and email replies, as described above.
- Cisco Meraki and Ubiquiti provide the network management platforms for customers whose networks we manage.
- UptimeRobot checks that the website is online. It does not receive personal information.
For California tax-rate lookups, we send the selected street address, city and ZIP code to the California Department of Tax and Fee Administration (CDTFA). We do not send customer names, email addresses, invoice amounts or payment details in those requests. We retain the selected location and rate evidence with the related commercial record.
We may also disclose information when required by law, to protect rights and safety, or as part of a business transfer, in which case this policy continues to apply.
We don’t sell or share personal information
We have not sold or shared personal information in the last 12 months, and we don’t do so, including for cross-context behavioral advertising. We don’t knowingly sell or share the personal information of anyone under 16. We don’t use or disclose sensitive personal information for purposes that would require offering a right to limit its use.
How long we keep it
- Website inquiries, and emails to our info@ address, that don’t lead to a customer relationship: up to 24 months.
- Copies of service emails we send you (support request updates, invoices, payment receipts, and quotes): 24 months.
- Customer, support, and portal records: for the length of the relationship, then up to 3 years so we can support you if you return.
- Invoices, tax calculation evidence and payment records: up to 7 years, for tax and accounting obligations.
- Network event logs: 90 days.
- Workspace review credentials and the latest aggregate report: while connected, until disconnected or replaced by the next successful review. Disconnecting clears the saved credentials, report and dismissal history from the active application; copies may remain in routine database backups until those backups expire. Google authorization can also be revoked in Google Account permissions.
- Security logs and anti-abuse records: typically days to weeks, and no more than 12 months.
- Privacy requests and our responses: 24 months, to show how we handled them.
Your California privacy rights
California residents have the right to:
- Know and access the personal information we have collected about you, including the categories, sources, purposes, and the recipients we disclosed it to, and to receive a copy in a portable format.
- Delete personal information we collected from you, subject to legal exceptions (for example, records we must keep for taxes).
- Correct inaccurate personal information.
- Opt out of the sale or sharing of personal information. We don’t sell or share it, and we honor Global Privacy Control.
- Limit the use of sensitive personal information. We don’t use it in ways that trigger this right.
- Not be discriminated against for exercising any of these rights.
We extend these rights to everyone who asks, wherever you live.
How to make a request
- Use our privacy request form.
- Email [email protected] with the subject “Privacy request”.
- Call (650) 720-5441.
We’ll confirm we received your request within 10 business days and respond within 45 days. If we need more time (up to another 45 days), we’ll tell you why. To protect your information, we verify requests by matching the details you give us with our records, usually by confirming through the email address we have on file. We may ask for more information for requests involving account or support records.
An authorized agent can submit a request for you. We may ask for your signed permission and ask you to verify your identity directly with us.
If we can’t fulfill a request, for example because a legal exception applies, we’ll explain why.
Security
We protect information with encrypted connections, access controls, and encryption of stored secrets such as Wi-Fi passwords, and we limit access to people who need it to do their jobs. No system is perfectly secure, so please contact us right away if you believe your information has been compromised.
Children
Our website and services are for businesses and are not directed to children under 16. We don’t knowingly collect personal information from children.
Changes and contact
When we update this policy, we’ll change the effective date above, and for significant changes we’ll notify customers through the portal or by email. You can review this policy on this page at any time.
Questions? Contact Coastside IT Services at [email protected] or (650) 720-5441.
This policy is available in accessible formats on request.