Privacy Policy

1. Who this policy is for

Several kinds of people use what we run, and this policy applies to each of them:

• Visitors to coastalcarolinatech.com, including anyone who sends us a request through its forms.
• A business with a Main Street Suite account, and the team members it invites. Much of this policy calls the business “you”.
• A business’s customers: people who book, check in, pay, sign, upload or hear from a business by text or email because it uses the suite.
• Workers whose hours and pay a business runs through TimeFlow, including the staff of a business’s payroll clients.

When a business keeps records about its customers or workers in the suite, the business decides what is recorded and who on its team sees it. We handle those records on the business’s behalf, as its service provider, and only to run the suite for it. If you are a customer or worker, the business is the first place to ask about your records. We help it answer, and you can also write to us.

CrowdFrame and the projects we build or run for clients, such as a website or an AI agent, have their own agreements. There, the event host or client decides what is collected from their guests or customers, and we handle it for them only to provide the service. We never sell it or use it for advertising. The agreement for that product or project says more.

2. What we collect

From visitors to this website

• Requests you send us: when you fill in one of our forms, such as a solution request or the contact form, we collect what you type. That is your name, email address and phone number, your business or organization and its details, and what you need.
• Emails and calls: what you tell us when you write or call.

We use a request only to answer you and follow up about it. It goes straight into our own customer records in Main Street Suite, where our team picks it up. Sending a form does not sign you up for text messages or a mailing list. This website sets no cookies of its own and runs no analytics or advertising trackers. Its fonts and images come from this site itself.

From businesses and their teams

• Account details: your name, work email address and role, and the business you belong to.
• The business profile: its name, address, phone number and hours; its locations, services and prices; staff schedules and time off.
• Sign-in records: the single-use links and codes we email you and, if you add a passkey, its public key and the name you give the device. Your face, fingerprint or screen lock never leave your device.
• Session records: when you signed in, and the IP address and browser you used, so a sign-in that is not you can be spotted.
• Billing details for the suite: Stripe collects your card on its own page. We keep Stripe’s reference for it, the card’s brand and last four digits, and your invoices. We never see or store the full card number.
• Connections you set up, such as your Stripe account, your email domain’s settings, and the assistants you give access to.
• Messages you send us for support.

About a business’s customers

Entered by the business, or by the customer on the pages the suite serves for the business:

• Name, phone number and email address.
• A record of each time they agreed to text messages (when, how, who at the business recorded it, and the words they were shown or asked), and any STOP or START they later send.
• Appointments, check-ins and walk-ins, and the notes the business keeps about a visit.
• Enquiries, deals and projects, and the customer’s answers to the business’s booking questions.
• Invoices, payments and receipts, including the payment method’s brand and last four digits, which come from Stripe. If a customer saves a card for future invoices, Stripe keeps the card and we keep the consent they gave and the date.
• Documents the business creates for them, files they upload when asked, and requests for documents.
• Signature records: the typed name, the consent statement agreed to, the language, the time, and the IP address and browser used to sign.
• Customer lists a business imports from a spreadsheet or from Square.

About workers (TimeFlow and client payroll)

• Name, contact details, employer, position and department.
• Pay rates and compensation, timesheets and hours, piecework, time off and requests.
• Paystubs and payroll runs, and the files a business exports for QuickBooks.
• Tax forms a worker uploads themselves, such as a W-4, an I-9 or a state withholding form. A Social Security number enters the suite only inside such a file. It is never typed into a field, only the worker and the business’s managers and admins can open the file, and staff access to it is recorded.
• Sign-in records for the worker portal, including passkeys and security events with the IP address involved.

Hosted email and websites

If a business asks us to host its email, we store its mailboxes: addresses, messages and attachments, folders, and sign-in records. The business’s owner can see counts of sign-ins and mail activity. Attachments a user saves to Documents are stored there too. If we build or host a website for a business, we store the business profile and offerings the site is written from, the pages, and the domain.

Collected automatically

• Server logs: IP address, browser, the pages and requests made, and when. Cloudflare, which serves this website and the suite, keeps these briefly for security and troubleshooting.
• Error reports the suite’s apps send when something breaks: the page, the browser and device, and the error.
• A count of the actions the suite performs for a business, which is what it is billed on.
• An activity log of who changed what in a business’s records.
• Delivery results for texts and emails, and replies to our texting number such as STOP and START.

3. How we use information

We use information to:

• Answer requests sent through this website, and follow up about them.
• Run the suite: take bookings, send reminders, run the front desk, send invoices and take payments, create and sign documents, track time and run payroll.
• Sign you in and keep accounts secure.
• Send texts and emails on a business’s behalf about appointments, documents, payments and sign-in. The suite sends no marketing.
• Bill a business for what it used, and collect what is owed.
• Answer support requests and fix problems.
• Prevent abuse, fraud and misuse of this website and the suite.
• Meet legal obligations and enforce our Terms of Use.
• Understand how the suite is used, in aggregate, so we can improve it.

We do not sell personal information. We do not use it for advertising. We do not use it to train AI models, and neither do the AI providers we use.

4. Text messages

Main Street Suite texts people only about their own dealings with a business: an appointment booked, moved or coming up; your turn in line after you check in; a document to sign or upload; an invoice to pay; a reminder that a document the business keeps for you is about to expire; a timesheet alert; a sign-in link. It sends no marketing texts. The forms on this website do not sign anyone up for texts.

Consent

Texts go only to people who agreed to receive them. A customer agrees by ticking the box on a business’s booking page, or by telling the business in person or by phone, which the business then records in the suite. Someone checking in at a business’s lobby tablet who ticks “Text me when it’s my turn”, or tells the front desk yes, agrees to at most two texts about that visit. A worker agrees by turning on TimeFlow alerts, and gets a text confirming it, or by telling their payroll office, which records it. Agreeing to texts is never a condition of booking, buying or working. Every way someone agrees, with a picture of each screen and its exact words, is on the suite’s text messages page.

What the texts cost and how often they come

Message and data rates may apply. Message frequency varies with your appointments, visits, documents and requests. Texts come from a number Coastal Carolina Tech operates through Twilio on behalf of the businesses using the suite. A text to a customer starts with the business’s name; a worker’s timesheet alert starts with “TimeFlow”.

Stopping and getting help

Reply STOP at any time to stop. Because the number is shared by every business using the suite, STOP stops texts from all of them, and you get one text confirming that. Reply START to allow them again. Reply HELP for help, contact the business that texted you, or write to [email protected]. Carriers are not liable for delayed or undelivered messages.

Your phone number and your opt-in

We keep the phone number and a record of each time someone agrees to texts: when, how (the form they filled in, or the member of the business’s staff who recorded a yes given in person or by phone), and the words they were shown or asked, in the language shown. For a form someone fills in themselves, the record also keeps the IP address and browser it was sent from. Each STOP and START reply is kept the same way, with the text itself. We keep this so that we and the business can show that consent existed and honor a STOP. Twilio receives the phone number and the message in order to deliver it, and nothing else.

The full program terms for texts are in section 7 of the Terms of Use.

5. Payments and card details

Card numbers never touch our servers. Stripe collects them on pages it hosts and keeps them under its own privacy policy.

• When a customer pays a business’s invoice, the payment goes to the business’s own Stripe account. The business is the merchant. We keep the amount, the status, and the card’s brand and last four digits, so the invoice can show as paid.
• If a customer chooses to save a card for future invoices, Stripe keeps the card. We keep the sentence they agreed to and the date, and every receipt carries a link to stop it.
• When a business pays for the suite, Stripe keeps the card on file. We keep Stripe’s reference for it, the brand and last four digits, and the invoices.

Payments a business records itself, such as cash, a check or a transfer, are records only. No money moves through the suite.

6. AI features

Two features of the suite use Anthropic’s Claude models through Anthropic’s API: drafting and the assistant in Documents, and writing a business’s website. When a business uses one, we send Anthropic the instructions given, the template chosen, the business’s profile, the customer record named, and the text of the document being written. Under Anthropic’s commercial terms, content sent through its API is not used to train its models and is kept only for a limited time, for safety and abuse monitoring.

We also use Cloudflare’s Workers AI to turn uploaded files into text so Documents can search them; that runs inside Cloudflare’s network, where the suite already lives. Search indexes stay in our database. Drafts are suggestions for the business to check. A business that does not use these features sends nothing to Anthropic.

7. Who else handles information

We share information only with the services that help us run this website and the suite, with the business whose records they are, and when the law requires. Each service receives only what its job needs and may use it only for that job.

• Cloudflare, Inc.

  Does Hosts this website and the suite: pages, database, file storage, logs, and text extraction for Documents. Delivers hosted email for some businesses.

  Receives Everything this website and the suite store passes through Cloudflare’s infrastructure, including the requests sent through this website’s forms.

• Stripe, Inc.

  Does Card payments, the card on file for suite billing, and each business’s own merchant account.

  Receives Card details, which Stripe collects directly; names, email addresses and amounts.

• Twilio Inc.

  Does Delivers text messages and receives replies.

  Receives Phone numbers and the message text.

• Resend, Inc.

  Does Delivers email from the suite: sign-in links, invitations, invoices, documents and signature requests.

  Receives Email addresses and the message content.

• Anthropic, PBC

  Does AI drafting in Documents and website writing, when a business uses them.

  Receives What section 6 describes.

• Amazon Web Services, Inc.

  Does Receives inbound email for some hosted-email setups.

  Receives Mail addressed to those domains.

• GitHub, Inc.

  Does Stores the code and settings we deploy a business’s hosted email or website from.

  Receives The business’s site content and, encrypted, the settings of its deployment.

• Google LLC

  Does Supplies the fonts on the suite’s public pages, and signs you in to our browser extension if you install it.

  Receives Your IP address and browser when a suite page loads a font; your Google account’s email address for the extension.

• Your DNS provider

  Does Publishes the DNS records for hosted email or a website when a business chooses one-click setup.

  Receives The records to publish.

We also disclose information:

• To the business whose records they are, and to the customer or worker the records are about, through their own portal.
• When the law requires it: a subpoena, a court order, or a request from a regulator or law enforcement that we must honor. We tell the business when we are allowed to.
• To protect people, this website or the suite from harm, fraud or abuse.
• If Coastal Carolina Tech is sold or merges, to the new owner, who must honor this policy.
• With your consent.

We never sell personal information, and we never share phone numbers or text opt-ins for marketing, as section 4 says.

8. Cookies and similar tools

This website sets no cookies of its own. The suite uses cookies only to keep you signed in, and your browser’s storage only to remember settings on your device.

• A staff sign-in cookie, good for seven days and extended as you use the suite.
• Portal cookies for customers and workers who sign in with a link, a code or a passkey.
• Settings such as your language, kept in your browser on your device.
• Cloudflare may set a cookie of its own to tell people from bots.

We use no advertising cookies, no third-party analytics and no tracking pixels. Because we do not track you across sites, a Do Not Track or Global Privacy Control signal changes nothing; there is nothing to opt out of. The suite’s public pages load their fonts from Google, which sees your IP address and browser when they load.

9. How long we keep information

• Requests sent through this website: as long as we need them to answer you and follow up. Ask and we delete yours.
• A business’s records: for as long as its account is open. The business can delete customers, documents and other records from inside the suite at any time, and can ask us to delete anything it cannot.
• After a business closes its account: we delete or anonymize its records within 90 days, except records we must keep by law, such as invoices and tax records, and records the business asks us to keep for a handover.
• Signature records: kept with the signed document for as long as the business keeps the document, because they are what shows who signed it.
• Text opt-ins and STOP requests: for as long as needed to honor them, and for the time the law requires us to be able to show that consent existed.
• Sign-in links and codes: five minutes. Portal links: thirty minutes. Sessions: up to seven days without use.
• Hosted email: until the mailbox’s owner deletes a message or the business closes the mailbox.
• Server logs and error reports: a short time, for security and troubleshooting.
• Billing records: as long as tax and accounting rules require.

10. Security

• This website and the suite are served only over HTTPS, and Cloudflare encrypts what it stores for us at rest.
• Every request to the suite is scoped to one business. TimeFlow’s payroll records sit on their own tables, which the other apps cannot read, and an automated check fails any change that would cross that line.
• Sign-in uses single-use links, codes and passkeys instead of passwords. Public pages are rate-limited.
• The keys of services a business connects are encrypted and never shown again once saved.
• Card numbers never reach our servers, and Social Security numbers exist only inside files workers upload themselves, with staff access recorded.

No system is perfectly secure. If you believe an account or a record has been misused, write to [email protected] and we will look into it right away.

11. Your choices and rights

If you sent us a request through this website

Write to [email protected] to see, correct or delete what you sent us.

If you run a business on the suite

You control your records. You can see, correct and delete them from inside the suite, export what the suite offers to export, and ask us for anything else. To close your account, write to us; we give you time to take your data with you before we delete it.

If you are a customer or worker of a business

Your records belong to the business, so ask it first to see, correct or delete them. Its portal link lets you update your contact details and manage your appointment. Reply STOP to end texts, use the link in any receipt to stop a saved card, and ask the business to stop emails. If you write to us instead, we pass your request to the business and help it answer.

State privacy laws

Some states give their residents the right to know what personal information is held about them, to correct or delete it, to get a copy, and not to be treated differently for asking. We act as a service provider to the businesses that use the suite, so requests about a business’s records go to the business. Requests about information we hold for ourselves, such as a request sent through this website or an account holder’s details, can be sent to [email protected]. We need to verify who you are before acting, and we answer within the time the law allows. Someone may act for you if they can show your permission. We do not sell personal information or share it for targeted advertising, so there is no sale or sharing to opt out of.

12. Children

This website and the suite are for businesses and for the adults who deal with them. We do not knowingly collect information from children under 13. A business may record an appointment or a document for a child with a parent or guardian’s permission; that record is the business’s, kept for it as this policy describes.

13. Where information is kept

This website and the suite are hosted by Cloudflare, and our storage is in the United States. Cloudflare’s network handles requests close to where they come from, so a request from outside the United States may be processed nearby before it reaches our storage. If you use this website or the suite from outside the United States, your information is transferred to and kept in the United States.

14. Changes to this policy

When we change this policy we post the new version here and update the date at the top. For a change that matters to you, such as a new use of information or a new kind of service provider, we tell suite account holders by email or on the dashboard before it takes effect.

15. How to reach us

Questions about a business’s records go to the business first, then to us. Questions about your account or the suite itself go to [email protected].