Privacy Policy

Scope of This Policy

This policy is published by Samford Labs, LLC (“Samford Labs,” “we,” “us”) and applies to this website (samfordlabs.com) and to the products and services we operate, including Collect (collect.samfordlabs.com). It is the single, umbrella privacy policy for Samford Labs and its products.

For most of this website, Samford Labs is the data controller. When you use one of our products as a paying customer, however, you control what information you collect from your own clients, and Samford Labs acts as a data processor handling that information on your behalf and under your instructions. The Samford Labs Products section below explains how that works. Each product is also governed by its own terms of service — for Collect, the Collect Terms of Service.

Information We Collect

Contact form submissions. When you reach out through our contact form, we collect the information you provide: your name, email address, company name, phone number, project details, estimated budget, and message content. All fields except name, email, and message are optional.

Automatic data. When you visit our website, our analytics services automatically collect usage data including pages viewed, time on site, device type, browser, operating system, and approximate geographic location derived from your IP address. See the Analytics & Cookies section below for details.

We do not require account creation, and we do not collect payment information on this website.

How We Use Your Information

Contact form submissions are used to respond to your inquiry, discuss potential project engagements, and manage our relationship with you. This data is stored in our customer relationship management system (see Third-Party Services below).

Analytics data is used to understand how visitors use our website, identify technical issues, and improve the user experience. We do not use this data to identify individual visitors.

We do not sell, rent, or trade your personal information to any third party for any purpose, including marketing.

Analytics & Cookies

This website uses the following analytics services:

• Google Analytics (GA4) — Collects page views, session duration, device and browser information, and approximate geographic location. Uses cookies to distinguish unique visitors, and loads only if you accept analytics cookies in the consent banner. Data is processed by Google in accordance with their privacy policy.
• Vercel Analytics — Collects aggregate page view counts and web performance metrics. Privacy-focused: does not use cookies and does not collect personally identifiable information.
• Vercel Speed Insights — Measures Core Web Vitals (page load speed, interactivity, visual stability) to help us optimize site performance. Does not collect personally identifiable information.

When you first visit our site, a consent banner appears at the bottom of the page with “Accept” and “Decline” options. Google Analytics does not load unless you click “Accept,” and declining does not affect the core functionality of this website. Your choice is stored in your browser; clearing your browser’s site data will reset it. Vercel Analytics and Speed Insights are cookieless, collect no personally identifiable information, and run regardless of this choice.

Third-Party Services

We use the following third-party services to operate this website. Each provider processes data under their own terms and privacy policies:

• Zoho CRM — Contact form submissions are stored in Zoho CRM to manage project inquiries and client relationships. Zoho processes this data in accordance with their privacy policy.
• Google Analytics — Usage data as described above.
• Vercel — Website hosting, analytics, and performance monitoring.

Samford Labs is not responsible for the privacy practices of these third-party providers. We encourage you to review their respective privacy policies.

Samford Labs Products (including Collect)

When you sign up for and use one of our products, additional processing applies. Collect is a service that lets our customers request documents, information, and signed acknowledgments from their own clients.

• Account data (we are the controller). When a customer creates an account, we collect name, email, organization details, and billing information needed to provide and bill for the service.
• Customer and end-client data (we are the processor). Our customers use Collect to gather documents, form answers, and electronic signatures from their own clients. That content — which may include sensitive personal and financial information — belongs to the customer, who decides what to collect and is responsible for having a lawful basis and any required consent. We process it solely to provide the service, on the customer’s instructions, and do not use it for our own purposes or sell it.
• Sub-processors. To run Collect we rely on a small set of vendors: Supabase (cloud hosting and database), Vercel (application hosting), Stripe (payment processing), Resend (transactional email), and Sentry (error monitoring). Each is bound by its own data-protection obligations and processes data only as needed to provide its function.
• Product analytics. The Collect application uses privacy-friendly, cookieless analytics (Vercel Analytics and Speed Insights) to measure aggregate usage and performance. These do not use tracking cookies or identify individual visitors.
• Retention. Customer and end-client content is retained for as long as the customer’s account is active or as configured by the customer, and is deleted following account closure subject to a short export/recovery window and any legal retention obligations.
• End-client requests. If you submitted information to a Collect request, the business that sent you that request is the controller of your data. Please direct access or deletion requests to that business; we will assist them as their processor.

Data Security

We implement commercially reasonable security measures to protect your information. All data transmitted to and from our website is encrypted using TLS. Our contact form is protected against cross-site request forgery (CSRF) and includes rate limiting to prevent abuse.

While we take appropriate precautions, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee the absolute security of your information.

Data Retention

Contact form submissions are retained in our CRM system for the duration of our business relationship and for a reasonable period thereafter for record-keeping and legal compliance purposes. Analytics data is retained according to the default retention periods of each analytics provider. You may request deletion of your data at any time (see Your Rights below), subject to any legal obligations requiring us to retain certain records.

Your Rights

You have the right to request access to, correction of, or deletion of your personal information. To exercise any of these rights, contact us at james@samfordlabs.com. We will respond to your request within 30 days. We reserve the right to verify your identity before processing any request and to decline requests that are unreasonable, repetitive, or not required by applicable law.

GDPR (European Privacy Rights)

If you are located in the European Economic Area (EEA) or the United Kingdom, the General Data Protection Regulation (GDPR) provides you with additional rights regarding your personal data.

• Data controller. Samford Labs, LLC is the data controller for personal information collected through this website (for product end-client data, the customer who sent the request is the controller — see Samford Labs Products above). You may contact us at james@samfordlabs.com.
• Legal basis for processing. We process your data under the following legal bases: consent for Google Analytics cookies (set only if you accept them in the consent banner) and for contact form submissions (you voluntarily provide your information when you reach out to us), and legitimate interest for cookieless, aggregate analytics (understanding how visitors use our site to improve it).
• Additional rights. In addition to the rights described above, you have the right to data portability, the right to restrict processing, and the right to object to processing based on legitimate interest. You also have the right to lodge a complaint with your local data protection authority.
• International data transfers. Your data may be transferred to and processed in the United States, where our third-party service providers (Google, Vercel, Zoho) operate. These transfers are necessary for the provision of our services and are conducted in accordance with applicable data protection laws.

CCPA (California Privacy Rights)

If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with specific rights regarding your personal information:

• Right to know. You have the right to request that we disclose the categories and specific pieces of personal information we have collected about you.
• Right to delete. You have the right to request deletion of your personal information, subject to certain exceptions permitted by law.
• Right to opt out. You have the right to opt out of the sale of your personal information. We do not sell your personal information.
• Non-discrimination. We will not discriminate against you for exercising any of your CCPA rights.

To exercise any of these rights, contact us at james@samfordlabs.com. We will respond within 45 days as required by law.

Changes to This Policy

We may update this privacy policy from time to time. Changes will be posted on this page with an updated revision date. Your continued use of the website after any changes constitutes acceptance of the updated policy. Material changes will be highlighted at the top of this page.

Contact

If you have questions about this privacy policy or how we handle your data, contact us at james@samfordlabs.com.