Privacy Policy

MAND DIGITAL PRIVACY POLICY Version 1.2

Last Updated: September 11, 2026

This Privacy Policy explains how MAND INVEST 12003 WA LLC, operating under the Mand Digital brand (“Mand Digital,” “we,” “us,” or “our”), collects, uses, stores, and shares personal information when you use our websites, Client Portal, and related services.

By using our services, you acknowledge the practices described in this Privacy Policy.

This Version 1.2 replaces Version 1.1 for acceptances recorded on or after its effective date. A previously recorded acceptance continues to identify the version accepted at that time.

1. INFORMATION WE COLLECT

Depending on how you interact with Mand Digital, we may collect the following categories of information.

Account and Contact Information

This may include:

• first and last name;
• email address;
• telephone number, where you provide one;
• company or business name;
• account identifiers and project identifiers; and
• authentication-related information.

Passwords for the Client Portal are handled by our authentication infrastructure and are not available to Mand Digital personnel in plain text.

Project Information

When you create or manage a project, we may collect information including:

• business information;
• services and service areas;
• website goals;
• design preferences and branding information;
• domain and hosting information;
• contact information to be displayed on your website;
• project instructions;
• revision and change requests;
• approvals and acceptance records; and
• other information you provide through the project briefing or Client Portal.

Files and Materials

You may provide files including:

• logos;
• photographs and images;
• documents;
• branding materials;
• project assets; and
• support attachments.

Uploaded files are stored in private storage. Access is restricted to your account, authorized Mand Digital personnel, and, where the project has been released for production, the assigned developer.

You should only provide information and materials that you are authorized to provide.

Website and Domain Access Information

To publish your website we may need to know how your domain or hosting is administered. For that purpose we may collect:

• the access method you choose (for example, an invitation to your hosting or registrar account, DNS records, or another arrangement);
• the provider name as you describe it;
• an account identifier such as the login email or username of the account;
• a control-panel address; and
• notes you write to explain your setup.

Where the Client Portal offers a choice, Mand Digital asks first for an access arrangement that does not involve sharing a password — for example, an invitation to your own hosting account, which you can withdraw at any time.

**Temporary hosting login.** If your provider does not offer that kind of invitation, you may instead choose to give Mand Digital a temporary login for the hosting account so that we can install and configure your website. This is optional, and it is offered only for that purpose.

When you choose that option:

• the login is encrypted before it is stored, and is held separately from the rest of your project information;
• it is not displayed again in the Client Portal, and it is not returned to your browser after you save it;
• access to it is limited to the Mand Digital personnel carrying out the setup work; personnel assigned only to build your website do not receive it;
• each time an authorized person opens it, that access is recorded in your project history, where you can see it;
• you can replace it or delete it at any time, and deleting it removes the stored login itself rather than marking it as deleted; and
• no history of previous logins is kept — replacing a login overwrites the one before it.

Mand Digital does not operate a general password vault, and does not seek to hold hosting logins beyond the setup work they were provided for. Apart from the field designed for this purpose, you should not send hosting passwords, registrar passwords, domain transfer codes, or similar secrets through the Client Portal, support messages, briefing fields, or email.

Website Email Configuration

If your website needs to send email — for example, contact-form messages sent from your own domain — you may provide the sending configuration for your own mailbox, which may include a server host, port, encryption setting, sender address, and the mailbox authentication password.

That password is treated as a temporary operational secret, not as stored account data:

• it is encrypted before it is stored, using authenticated encryption, with the encryption key held in the application's server environment and never in the database;
• it is never displayed back to you after it is saved, and it is never returned to the browser;
• it is used only to test sending and to install the configuration on your website;
• it is never written to logs, notifications, emails, or analytics; and
• it is intended to be deleted from Mand Digital's systems after the configuration is handed over to you, and the Client Portal provides an operation that performs that deletion and records that it happened.

Non-secret parts of the configuration, such as the host, port, and sender address, may be retained as ordinary project records.

This Policy intentionally does not describe Mand Digital's internal security implementation in further detail.

Payment Information

Payment-card transactions are processed by Stripe. Card numbers, expiration dates, and card security codes are entered into and handled by the payment processor.

Mand Digital does not collect or store complete payment-card numbers or card security codes in the Client Portal database.

Mand Digital maintains records relating to:

• payment status;
• payment amount and currency;
• payment method and installment;
• processor and transaction identifiers;
• payment references you provide for a bank or Zelle transfer;
• proof-of-payment files you upload;
• refunds; and
• payment disputes.

Communications and Support

We may maintain records of communications concerning:

• projects;
• support requests and their attachments;
• account matters;
• payment matters;
• revisions;
• approvals;
• in-portal notifications; and
• transactional emails we send you.

Technical and Security Information

We may collect or retain reasonable technical information used to operate, secure, and document our services, including:

• IP address, where it is recorded as part of electronic acceptance evidence or a security record;
• browser or user-agent information, in the same circumstances;
• timestamps recorded by our servers;
• authentication and session information;
• security-related events, such as records of access being granted or revoked; and
• records relating to important account or project actions.

Abuse-prevention counters used for rate limiting do not store your IP address or email address in readable form; they store an irreversible fingerprint used only to count requests within a short time window.

Mand Digital does not use advertising trackers, advertising cookies, cross-site tracking, device fingerprinting for advertising, or third-party analytics in the Client Portal.

Electronic Agreement and Acceptance Records

When you electronically accept an agreement or provide another legally or operationally significant approval, we may retain evidence including:

• document type;
• document version;
• document hash or integrity information;
• the acceptance language presented to you;
• date and time recorded by our server;
• account, Client, or project identifier;
• acceptance method;
• the page or process used;
• IP address;
• user-agent information; and
• other information reasonably necessary to document the electronic transaction.

Where a Project Agreement provides that a website may be treated as accepted after a stated review period has passed without a response, that event is recorded separately and identifies itself as arising from the passage of time. Records of that kind do not include an IP address or user-agent, because you did not perform an act at that moment.

2. HOW WE USE INFORMATION

Mand Digital may use personal information to:

• create and manage accounts;
• provide the Client Portal;
• create and manage projects;
• communicate with Clients;
• provide website design and development services;
• process and document payments;
• manage briefings;
• provide previews;
• process revision and change requests;
• record approvals and acceptance;
• publish or deliver completed work;
• configure and test website email sending on your behalf;
• provide support;
• maintain agreement and acceptance records;
• authenticate users;
• protect accounts and systems;
• prevent fraud and abuse;
• investigate security incidents;
• maintain operational records;
• comply with legal obligations;
• establish, exercise, or defend legal claims;
• resolve payment disputes; and
• improve the reliability and operation of our services.

We may also use aggregated or de-identified information where reasonably appropriate for operational, analytical, security, or service-improvement purposes.

3. PROJECT INFORMATION

Information submitted through a project briefing is used primarily to provide the services requested by the Client.

Mand Digital does not sell Client project information to third-party advertisers.

Project materials are not used for unrelated third-party advertising.

Where you have not withdrawn permission under the portfolio provision of your Project Agreement, Mand Digital may reference completed and already-public work as described there. That provision does not permit publication of your revenue, lead volume, performance metrics, confidential business information, unpublished materials, private correspondence, credentials, or a testimonial you did not provide.

4. HOW WE SHARE INFORMATION

Mand Digital may share information when reasonably necessary to operate our business and provide requested services.

Mand Digital may also disclose information when reasonably necessary to:

• comply with applicable law;
• respond to valid legal process;
• protect Mand Digital, Clients, or others;
• investigate fraud, abuse, or security incidents;
• enforce applicable agreements;
• respond to payment disputes; or
• establish, exercise, or defend legal claims.

Mand Digital does not sell personal information and does not share personal information for cross-context behavioral advertising.

5. SERVICE PROVIDERS

The Client Portal is currently operated using the following service providers:

Supabase — application database, authentication, and private file storage for the Client Portal.

Stripe — payment processing for card payments, including the payment pages where card details are entered.

Hostinger — application hosting for the Client Portal, and the outbound mail service used to send transactional project emails.

Where a project requires it, information may also reach a provider that the Client themselves selected — for example, the Client's own hosting provider, domain registrar, or email provider — for the purpose of performing the work the Client requested.

Service providers process information on Mand Digital's behalf subject to their applicable agreements, privacy practices, and legal obligations. Each provider's processing may also be governed by its own privacy policy and terms.

The specific providers used may change as Mand Digital's infrastructure evolves. This Section is updated when that happens.

6. PAYMENT CARD INFORMATION

Payment-card transactions are handled through the payment processor's own payment infrastructure.

Mand Digital does not collect or store complete payment-card numbers or card security codes in its own Client Portal database.

We retain transaction identifiers, payment status, amounts, payment method and installment information, references you supply for bank transfers, and other records necessary for accounting, project administration, fraud prevention, refunds, and payment disputes.

7. COOKIES AND SIMILAR TECHNOLOGIES

The Client Portal uses cookies that are strictly necessary to operate the service:

• authentication and session cookies that keep you signed in; and
• cookies required for security and for the correct operation of the application.

These cookies are set by the Client Portal and its authentication infrastructure. They are required for the service to function, and disabling them will prevent you from signing in.

At the time of this version, the Client Portal does not use advertising cookies, advertising pixels, cross-site tracking technologies, or third-party analytics or measurement services.

If Mand Digital later introduces analytics, advertising technologies, or other non-essential tracking, this Privacy Policy will be updated and any consent mechanism required by applicable law will be implemented before that technology is used.

8. WE DO NOT SELL PERSONAL INFORMATION

Mand Digital does not sell personal information to data brokers or third-party advertisers.

Mand Digital does not sell Client briefing information, project materials, or Client Portal activity for third-party advertising purposes.

9. DATA SECURITY

Mand Digital uses reasonable administrative, technical, and organizational measures intended to protect personal information and its systems.

These measures include authenticated access to the Client Portal, row-level access controls in the database so that a Client reaches only their own records, private file storage with time-limited access links, restricted internal fields that Clients do not receive, encryption of the one temporary secret described in Section 1, and rate limiting on sensitive actions.

However, no internet transmission, storage system, website, or online service can be guaranteed to be completely secure.

Clients are also responsible for protecting their account credentials and must not share passwords or permit unauthorized persons to use their accounts.

If you believe your account may have been compromised, you should contact Mand Digital promptly.

This Policy does not describe Mand Digital's internal security architecture, configuration, or implementation details.

10. DATA RETENTION

Mand Digital retains personal information for as long as reasonably necessary for the purposes for which it was collected, including:

• providing services;
• maintaining project records;
• maintaining transaction records;
• documenting agreements, approvals, and acceptance;
• providing support;
• security and fraud prevention;
• accounting and business records;
• resolving disputes;
• enforcing agreements; and
• complying with legal obligations.

Different categories of information are retained for different periods:

• contractual, acceptance, payment, and dispute records are retained as needed for legal, accounting, and evidentiary purposes, and are not deleted on request while that need continues;
• project data — briefing content, uploads, revision requests, and support history — is retained as reasonably necessary for the project and for the period after it in which questions, disputes, or warranty matters may arise;
• the temporary website email password described in Section 1 is not retained indefinitely, and is intended to be deleted after the configuration is handed over;
• the optional temporary hosting login described in Section 1 is likewise not retained indefinitely. It is intended to be deleted once the setup work it was provided for is complete, and you may delete it yourself at any time. Deletion removes the stored login itself; a record that a login was provided, replaced, or deleted, and when, is kept as part of the project's security and audit history; and
• security and audit records are retained for the period reasonably necessary for security and accountability purposes.

Mand Digital may delete or de-identify information when it is no longer reasonably necessary to retain it, subject to legal, contractual, security, and operational requirements.

11. ELECTRONIC AGREEMENT RECORDS

Requests to delete an account or personal information do not require Mand Digital to delete records that it reasonably needs to retain to document:

• contracts;
• transactions;
• electronic acceptances;
• payments;
• approvals and acceptance of delivered work;
• ownership transfers;
• disputes;
• fraud prevention; or
• legal compliance.

Where appropriate, access to retained information may instead be restricted.

Records of legal acceptance are append-only by design: they are not edited or overwritten after they are created, and publishing a new version of a document does not change a record of a previous acceptance.

12. CLIENT FILES

Files uploaded through the Client Portal are used for project delivery, support, or another Client-requested purpose.

Clients should not upload unnecessary sensitive personal information.

Clients are responsible for ensuring that they have the right to provide materials uploaded to Mand Digital.

13. PASSWORDS AND CREDENTIALS

Client Portal passwords are handled by our authentication infrastructure and are not stored or made available to Mand Digital personnel in plain text.

Mand Digital asks for a password in only two specific places, both described in Section 1: the website email configuration, and the optional temporary hosting login. In both cases the password is encrypted before it is stored, is never displayed again, and can be deleted by you. Outside those two fields, Mand Digital does not ask for and does not store your passwords.

Where website or hosting access is reasonably required for a project, Mand Digital asks first for an arrangement that does not require sharing a password, such as an invitation to your own account. A temporary login is offered only where that kind of invitation is not available.

Clients should not send passwords or other sensitive credentials through ordinary email, support messages, briefing text fields, or other channels not designed for secure credential handling.

14. CHILDREN

Mand Digital's services are intended for businesses and adults and are not directed to children under the age of 13.

Mand Digital does not knowingly seek to collect personal information from children under 13 through the Client Portal.

If Mand Digital becomes aware that such information was collected inappropriately, we may take reasonable steps to delete it.

15. YOUR PRIVACY REQUESTS

Depending on applicable law and the circumstances of your relationship with Mand Digital, you may request that Mand Digital:

• provide information about personal information associated with you;
• provide a copy of that information in a portable format, where required by applicable law;
• correct inaccurate personal information;
• delete certain personal information; or
• address another privacy-related concern.

Some requests may be limited where Mand Digital must retain information for contractual, transactional, security, fraud-prevention, dispute-resolution, or legal purposes. Where a request is limited, Mand Digital will explain the reason.

Mand Digital may take reasonable steps to verify the identity and authority of a person making a privacy request before providing, modifying, or deleting information.

Mand Digital does not discriminate against a person for exercising a privacy right.

Much of your information is also directly available to you inside the Client Portal, including your project records, your uploads, your support history, and the agreements you accepted.

Privacy requests may be sent to:

legal@manddigital.com

16. STATE PRIVACY LAWS

Mand Digital is a Florida limited liability company providing services primarily to businesses in the United States.

United States privacy laws apply based on factors such as the state involved, the size and revenue of the business, the volume of personal information processed, and whether personal information is sold or shared for advertising. Mand Digital does not sell personal information and does not share personal information for cross-context behavioral advertising.

This Policy does not state that Mand Digital is or is not subject to a particular state privacy statute. Where a state privacy law applies to a request, Mand Digital will honor the rights that law provides.

If you believe a state privacy right applies to you, contact legal@manddigital.com and identify the right you are exercising.

Nothing in this Privacy Policy is intended to limit rights that cannot legally be waived.

17. COMMUNICATIONS

Mand Digital sends two different kinds of messages, and they are treated differently:

Service and transactional communications relate to your account, project, payments, security, approvals, support, and agreements. They are necessary to provide the service you requested, and you receive them while you have an active account or project. Examples include a reply to a support request, a notice that a preview is ready, and a payment confirmation.

Marketing communications promote Mand Digital's services. At the time of this version, Mand Digital does not operate marketing email campaigns from the Client Portal, and creating an account does not subscribe you to marketing email. If Mand Digital later sends marketing email, it will include an unsubscribe mechanism, and unsubscribing from marketing email will not stop service and transactional communications.

Mand Digital communicates by email and through the Client Portal. The Client Portal does not collect a telephone number for marketing purposes, and a telephone number you provide for your project is used for the project.

18. INTERNATIONAL ACCESS

If you access Mand Digital's services from outside the United States, you understand that information may be processed or stored in the United States or other locations where Mand Digital's service providers operate, subject to applicable law and provider safeguards.

19. BUSINESS TRANSFERS

If Mand Digital or its applicable business assets are involved in a merger, acquisition, reorganization, financing, sale, or similar business transaction, information may be transferred as part of that transaction, subject to applicable law and appropriate confidentiality or privacy obligations.

20. LEGAL AND SECURITY DISCLOSURES

Mand Digital may preserve, access, or disclose information when reasonably necessary to:

• comply with law or valid legal process;
• protect the security of its systems;
• investigate suspected fraud or abuse;
• protect the rights or safety of Mand Digital, Clients, or third parties;
• enforce agreements; or
• establish, exercise, or defend legal claims.

21. CHANGES TO THIS PRIVACY POLICY

Mand Digital may update this Privacy Policy as its services, technology, providers, or legal obligations change.

Updated versions will be identified by a new version number and effective date.

Mand Digital preserves historical records where a specific Privacy Policy version is associated with a recorded electronic acceptance, and a previously recorded acceptance continues to identify the version accepted at that time.

Material changes will be communicated or presented for renewed acceptance when required by applicable law or when Mand Digital determines that renewed acceptance is appropriate.

22. CONTACT

Privacy questions and requests may be directed to:

MAND INVEST 12003 WA LLC Operating under the Mand Digital brand

Email: legal@manddigital.com

We intentionally do not publish a residential address in this Privacy Policy unless disclosure becomes legally required for a particular purpose.