What we collect, why we collect it, and how to make us forget you.

Who we are

This site (corridorwebco.com) is operated by MarathonMeta LLC, an Iowa limited liability company doing business as Corridor Web Co., located in Coralville, Iowa. When this policy says "we" or "us," it means MarathonMeta LLC.

What we collect

We only collect what we need to respond to you, deliver work you've hired us for, and keep the site running. Specifically:

• Contact & intake forms. Name, email, phone, business name, the city you operate in, and whatever you type into the form (current website, what your business does, photos you choose to upload, etc.).
• Client account data. If we've done work for you, we keep records of your business, the package you purchased, your subscription state, the URL of your live site, and any leads you log in your dashboard.
• Payment information. When you pay for a build or a Care plan, you enter card details on Stripe's checkout page. We never see or store your card number. Stripe gives us a customer ID and the last 4 digits, billing ZIP, and card brand for our records.
• Server logs. Our hosting provider (Vercel) logs standard request data: IP address, browser type, the URL you requested, timestamp. Used to debug problems and detect abuse. Typically retained for 30-90 days.
• Analytics. We use Vercel Analytics, which measures aggregate page-view counts without setting tracking cookies and without identifying individual visitors. No third-party advertising trackers, no Meta Pixel, no Google Analytics.

What we don't collect

We don't use advertising cookies. We don't fingerprint visitors. We don't buy data from list brokers. We don't run third-party retargeting pixels. We don't sell or rent personal information to anyone, full stop.

Why we collect it

• To respond to you. If you fill out the contact form, we need your contact info to reply.
• To deliver work we've agreed on. Building your site requires knowing what your business is, what pages you want, what photos to use, and where to send you proofs.
• To process payment. Hard to bill you without billing info.
• To keep the site running. Server logs let us fix bugs and block abusive traffic.
• To improve the site. Aggregate analytics tell us which pages people read and which they bounce off of. We never look at individuals.

Cookies we set

We set exactly three kinds of cookies. None for advertising.

• Theme preference. Remembers whether you chose light or dark mode so it persists across visits.
• Authentication. If you sign into a client dashboard or the site editor, we set an HTTP-only signed cookie so you don't have to log in on every page load.
• Hosting infrastructure. Vercel may set short- lived cookies for load balancing and DDoS protection. These are functional and exempt from consent requirements.

Who we share data with

Running a small web business requires a few service providers (subprocessors). We share only the data each one needs:

• Stripe (payments) — your name, email, billing ZIP, and card details you enter on their checkout page.
• Resend (transactional email delivery) — your email address and the contents of any email we send to or from you about your project.
• Vercel (hosting + database + analytics) — everything stored on the site lives on Vercel infrastructure (which uses AWS under the hood).
• Google (Workspace email) — emails you send to hello@corridorwebco.com pass through Google's mail infrastructure.
• Government or law enforcement — only if we're legally required (court order, subpoena, etc.). We push back on overbroad requests.

We do not share your data with anyone else, ever. Not for advertising, not for "partner" deals, not as part of data-broker exchanges.

How long we keep data

• Contact form submissions: kept indefinitely unless you ask us to delete them. We use them to remember context if you reach out again later.
• Client engagement records: kept for the length of the engagement, plus seven years afterward to satisfy U.S. tax and accounting requirements.
• Server logs: 30-90 days, then purged automatically.
• Analytics: aggregated, no individual records to retain.

Your rights

You can email hello@corridorwebco.com at any time and ask us to:

• Send you a copy of everything we have on you.
• Correct anything that's wrong (a typo in your business name, a stale address, etc.).
• Delete your data. We'll honor this for everything we aren't required by law to keep (tax records, signed agreements). We'll explain what stays and why.
• Opt out of any non-essential email we send.

We typically respond within a few business days. We won't charge you to exercise any of these rights.

If you're in California, the EU, or another regulated jurisdiction

CCPA, CPRA, GDPR, and similar laws give residents specific rights (access, deletion, portability, the right not to be sold). We've listed all of those above in plain English. If you'd rather invoke them by name, that works too — we'll honor the request the same way. We don't sell personal information, so the "Do Not Sell or Share" right is moot, but we'll confirm that in writing if you ask.

Children

This site isn't directed at children under 13, and we don't knowingly collect their information. If you believe a child has submitted information through one of our forms, email us and we'll delete it.

Security

We use HTTPS site-wide, store data on Vercel and Stripe (both SOC 2 compliant), and limit who has access to client data (currently: one person — the owner). We don't store payment card numbers ourselves; that data lives entirely with Stripe. No system is perfectly secure, but we take reasonable precautions and disclose breaches as required by law.

Changes to this policy

If we change something material — adding a new subprocessor, collecting a new category of data — we'll update the "Last updated" date at the top and, where the change affects existing clients, send you a heads-up email.

Contact

Questions, requests, complaints — email hello@corridorwebco.com or text (319) 328-8022. You can also write us at:

MarathonMeta LLC
d/b/a Corridor Web Co.
Coralville, IA