Privacy Policy

Fill in the Blank · Effective September 18, 2026

Fill in the Blank builds, hosts and supports websites and web applications. This policy explains what information we collect through fillintheblank.app (the client portal, support desk, site monitoring and invoicing), why we collect it, and what you can ask us to do with it.

What we collect

• Contact details you or your company give us: name, email, phone, company and billing address.
• Support requests: the emails, messages and files you send to our support desk.
• Billing records: quotes, invoices and payment status. Card and bank details are entered on Stripe's pages and go to Stripe. We never see or store full card or account numbers, only the brand and last four digits of a method you choose to save.
• Website monitoring data for sites we look after: uptime, response time, SSL and domain expiry.
• Credentials you share with us so we can work on your systems. These are stored encrypted and shown only to staff who need them.
• Basic technical data: IP address and browser type in security logs, and a sign-in cookie. We do not use advertising or tracking cookies in the portal.

Our own bank data

To reconcile payments, we connect our own business bank accounts to our invoicing system through a regulated data provider (such as Plaid) or by importing statements. This reads transactions on accounts owned by Fill in the Blank only. We do not access our clients' bank accounts. Where a payment you made appears on our statement, we use it solely to mark your invoice as paid.

How we use information

• To deliver the services you hired us for, answer support requests and keep your sites running.
• To send quotes, invoices, receipts and service notices.
• To keep our systems secure and meet tax and accounting obligations.

We do not sell personal information, and we do not use it for advertising.

Who we share it with

Only service providers that help us operate, each under their own security and privacy commitments: Stripe (payments), Amazon Web Services (email delivery and file storage), Cloudflare (network security), Google Workspace (email), and our bank data provider. We disclose information if the law requires it.

Security

All traffic is encrypted in transit. Passwords are hashed, and credentials, access tokens and API secrets are encrypted in our database. Staff access is role-based, requires multi-factor authentication, and support staff cannot see financial data. Client portal users see only their own company's information.

How long we keep it

Billing and tax records are kept for seven years. Support history and contact details are kept for the life of our relationship plus three years. Deleted items are purged after 30 days and backups roll off after 14 days.

Your choices

You can ask for a copy of your information, ask us to correct it, or ask us to delete it. You can remove a saved payment method in the client portal at any time. Email [email protected] and we will respond within 30 days. Some records, such as invoices, must be kept for the legal period.

Changes and contact

If this policy changes in a meaningful way we will update the date above and notify active clients. Questions: [email protected].