This notice covers Sevra’s managed website service, operated by VibeCraft Inc. The former local-app waitlist is closed and has a separate privacy notice. Its subscribers are not enrolled in website-service marketing.
Information you provide
The website request form asks for your name, email, business name, services and location. You may include a website or business-profile link. We store your request, contact consent, reference number and submission time to prepare your website and respond. Please do not send passwords, payment-card details or sensitive personal information through the form.
For customers, we also handle the content, domain configuration and communications needed to deliver the website. Stripe processes subscription payments and payment details. Sevra does not receive your full card number.
Providers and access
Vercel hosts the website, Supabase stores inquiries, Resend sends inquiry notifications and sign-in links, and our email provider handles correspondence. Stripe handles billing. Carlos accesses requests to provide the service. Information may be processed in the United States and other countries where these providers operate.
Customer websites and private inboxes
On a ready-to-use or subscribed business website, estimate requests include the visitor’s contact information, message and service-specific answers. We store them for the relevant business and grant inbox access only to authorized members. Before adoption, access is restricted to the researched business contact and Carlos. The business must request its own sign-in link. Inquiry notifications go to Carlos until the owner enables them in the inbox. Private notes, inquiry status and follow-up dates help that business manage the request. A saved inquiry remains available if its notification email fails.
For dashboard access, we store approved email memberships, hashed single-use sign-in tokens and hashed session identifiers. Sign-in links expire after 15 minutes. A secure, HTTP-only session cookie keeps you signed in for up to 30 days. Signing out revokes that session. Abuse counters use keyed hashes. Expired authentication records are cleaned during subsequent sign-in processing.
We may use AI tools to draft or revise website content and code. We use business information needed for that work. Do not send confidential material unless we have agreed how it will be handled. We do not sell your inquiry information or automatically add you to a marketing list.
Website measurement and abuse prevention
We use PostHog to understand public-page visits and interactions. Analytics starts automatically and respects the browser’s Do Not Track setting. Form inputs are masked, the inquiry form is excluded from session recordings, and URLs sent to analytics omit query strings and fragments. Prospect preview pages and private waitlist actions are excluded from analytics, as are customer sites and private inquiry dashboards. Hosting and security providers may retain operational logs.
We store keyed hashes of request and email addresses to limit abuse. They are used for intake controls, not advertising. They cannot be read as raw addresses from the stored hash.
Retention and your choices
Unconverted website requests are kept for up to six months, then removed during our operating review. Customer correspondence and records are retained while needed to deliver the service, handle disputes and meet applicable recordkeeping obligations. Website handoff copies are retained for 30 days after hosting ends. Copies in provider backups may remain until those providers’ retention periods expire.
To ask for access, correction or deletion, or to stop further sales contact, email carlos@sevrahq.com. We may need to verify your identity. We retain information we are required to keep and a minimal suppression record when necessary to honor a no-contact request.
Examples and proposed websites
Public examples describe fictional businesses and their forms are simulated. Proposed business websites use researched public business facts. Working websites offered before payment accept real inquiries and stay out of search indexing until adoption. Their inboxes require authorized sign-in, while the public pages can be viewed by anyone with the address. A business owner can request corrections or removal by email. We do not treat a prepared website as proof of the business’s endorsement or paid subscription.