Privacy Policy
Effective May 12, 2026
Logan Garbacki dba Garbacki Digital
§1 Who We Are
Logan Garbacki, operating as a sole proprietor under the name Garbacki Digital, is the data controller for all personal data described in this policy. Logan is based in Hicksville, NY and is one person — there is no dedicated privacy team. If you have a privacy question, email Logan directly.
This policy covers garbackidigital.com (the agency site) and app.garbackidigital.com (the Platform). Some sections apply only to agency clients; others apply only to Platform users; the analytics and contact sections apply to everyone who visits the site.
Email: logan@garbackidigital.com
§2 What We Collect and Why
§2.1 Agency Clients
If you hired Logan to build your business website, Logan collects:
Business information you provide. Your business name, address, phone, email, hours, services list, photos, logo, brand colors, and any other content submitted through the intake form or over email. Used exclusively to build and maintain your website. Not sold or used to market to your customers.
Contract and billing records.Your name, email, and payment records. Retained for at least 6 years as required by the NY Freelance Isn’t Free Act.
Project communications. Emails and change requests related to your engagement. Retained for the duration of the engagement plus 2 years.
AI chatbot conversation logs from your site visitors.When Logan configures an AI chatbot on your site, visitor messages and chatbot responses are logged to a Supabase database scoped to your account. These logs belong to you as the site operator. Logan uses them to monitor chatbot performance and diagnose issues. On termination, Logan exports them on your request and deletes them from Logan’s database within 30 days.
Contact form submissions. If your site includes a contact form, visitor submissions are processed by a third-party form service that forwards messages to Logan by email. Logan does not store form submissions in a separate database.
§2.2 Platform Users
If you have an account on the Garbacki Platform (app.garbackidigital.com), Logan collects:
Account information. Your name, email address, and (if you signed in with Google) your Google profile picture.
Lead search queries and AI-generated site content. The industry type and location you enter when searching for leads, and the website content the Platform generates, stored in Supabase linked to your account.
Subscription and billing data.Once Platform billing is active via Stripe, Logan will receive confirmation of your subscription status. Logan does not receive or store your credit card number — Stripe handles that.
Usage data. Page views and session activity collected via Vercel Analytics (see §4).
§2.3 All Visitors
Page views and referrer data.Collected by Vercel Analytics — no cookies, no cross-site tracking, no fingerprinting. Logan sees aggregate counts, referrer URLs, and approximate geographic distribution. Individual visitor records are not used for advertising or sold to any third party.
Contact form submissions. If you use the contact form on garbackidigital.com, your submission is forwarded to Logan by email. Logan may keep your contact information to follow up. Logan does not add unsolicited contacts to any marketing list.
§2.4 /card — QR Business Card Scan Tracking
When someone scans Logan’s physical business card (garbackidigital.com/card), that visit is logged for attribution analytics:
- A one-way SHA-256 hash of your IP address (raw IP is never stored)
- Your user agent in general terms (e.g., “mobile browser on iOS”)
- Approximate geographic location: country, region, city — derived from IP at time of visit, not stored as a precise coordinate
- Timestamp
This tells Logan how many scans a card is getting and from which general area. The data is not personally identifiable, not shared with any third party, and not used for advertising. Retained indefinitely and occasionally purged.
§3 Third-Party Services
§3.1 Vercel — Hosting and Analytics
This site and the Platform are hosted on Vercel, Inc. Vercel stores access logs and serves all web traffic. Logan uses Vercel Web Analytics, which tracks page views without cookies, without cross-site tracking, and without personal profiling.
Vercel’s privacy policy: vercel.com/legal/privacy-policy
§3.2 Supabase — Database and Authentication
User accounts, Platform session history, AI-generated site content, and chatbot conversation logs are stored in Supabase, operated by Supabase Inc. Data is stored in the US (AWS us-east-1 region by default). Supabase enforces row-level security so each user’s data is isolated from other users’ data.
Supabase’s privacy policy: supabase.com/privacy
§3.3 OpenRouter — AI Inference Routing
The AI chatbot and site-generation features use OpenRouter to route requests to large language model providers. By default, OpenRouter does not log prompt content — only request metadata (model used, token count, timestamp) for billing purposes. Logan does not enable persistent prompt logging through OpenRouter.
OpenRouter’s privacy policy: openrouter.ai/privacy
§3.4 Anthropic and Google — AI Model Providers
OpenRouter routes site-generation requests to Anthropic (Claude) and chatbot requests to Google (Gemini). Each provider processes each message during inference under their own data retention policies.
Anthropic’s privacy policy: anthropic.com/privacy
Google’s privacy policy: policies.google.com/privacy
§3.5 Google OAuth — Sign-In
If you sign in to the Garbacki Platform with your Google account, Logan receives your name, email address, and profile picture from Google. Used only to create and identify your Platform account. Logan does not post to your Google account or access any other Google data.
§3.6 Stripe — Subscription Billing
When Platform billing is active, subscription payments will be processed by Stripe, Inc. Logan will receive confirmation of your subscription status and payment amounts. Logan will not store your credit card number — Stripe handles all payment card data.
Stripe’s privacy policy: stripe.com/privacy
§4 Cookies and Tracking
Garbacki Digital does not use marketing cookies or cross-site tracking. Vercel Analytics is cookieless. The Garbacki Platform uses first-party session cookies necessary to keep you logged in; these expire on logout or after inactivity.
§5 Chatbot Conversation Handling
When a visitor interacts with an AI chatbot on a Garbacki Digital client’s website, the conversation is logged to a Supabase database scoped to that client’s account. The log includes the visitor’s messages, the chatbot’s responses, a timestamp, and a session identifier (not linked to any name, email, or persistent profile).
Logan does not cross-reference chatbot logs across client sites. Conversations stay in that client’s data partition.
PII risk. Visitors sometimes volunteer personal information (name, phone, health symptoms) in chatbot conversations even when not asked. The chatbot system prompt instructs the bot not to solicit sensitive personal or health information. If a visitor provides such information anyway, it is stored in the log and protected by the same security measures as all other data. Logan does not use visitor chatbot conversations for any purpose other than supporting the client whose site the conversation occurred on.
Retention.Chatbot logs are retained while the client’s service agreement is active. On termination, Logan exports the logs on client request and deletes them from Logan’s database within 30 days.
§6 Data Retention and Deletion
| Data type | Retention period |
|---|---|
| Client business content (copy, photos, brand assets) | Duration of engagement + a limited period after termination (typically less than 90 days), giving you time to retrieve a copy |
| Contract and billing records | 6 years minimum (NY Freelance Isn’t Free Act) |
| Platform account data and AI-generated site content | A limited period after account deletion (typically less than 90 days), giving you time to retrieve a copy |
| Chatbot conversation logs | Duration of client engagement + 30 days post-termination |
| /card scan logs (hashed IP + metadata) | Indefinite, occasionally purged |
| Vercel Analytics data | Governed by Vercel’s retention policy |
| Contact form submissions (third-party form service) | Governed by that service’s retention policy |
Requesting deletion. Email logan@garbackidigital.comwith “Delete My Data” in the subject. Logan will confirm within 5 business days and complete deletion within 30 days, except where retention is required by law (e.g., NY Freelance Isn’t Free Act contract records).
§7 Your Rights
California residents (CCPA/CPRA). You have the right to know what personal information Logan has collected, request deletion, and opt out of any sale of your information. Logan does not sell personal information.
Other US residents.Logan’s primary audience is New York–based. Logan extends the same request and deletion rights to all users regardless of state, to the extent practicable for a one-person operation.
GDPR-shape rights.Logan does not actively target EU residents, and Garbacki Digital is not subject to GDPR as a primary obligation. If you are an EU resident who has used Logan’s services, Logan will respond to access, rectification, or deletion requests on a good-faith basis.
To make any rights request, email logan@garbackidigital.com.
§8 Data Security
- Data is stored with row-level access controls in Supabase — each user’s data is scoped to their own account.
- All data in transit is encrypted via HTTPS/TLS.
- API keys and credentials are stored as environment variables, never in source code.
No system is perfectly secure. If Logan becomes aware of a data breach affecting your personal information, Logan will notify you by email within a reasonable time and describe the nature of the breach and steps being taken.
§9 Changes to This Policy
Logan may update this policy from time to time. If the changes are material, Logan will post an updated “Effective” date at the top and, for Platform users, send a notification to the email address on your account. Continued use of the services after the updated policy is posted constitutes acceptance of the new terms.
§10 Contact
Logan Garbacki dba Garbacki Digital
Hicksville, NY
Email: logan@garbackidigital.com
Put “Privacy” or “Delete My Data” in the subject line so Logan can route it correctly.