Privacy policy

Scope and operator

Sanford Labs LLC, a Michigan limited liability company, operates sanfordlabs.io. This policy explains how we handle information when you browse this website or contact us through it. The site presents our software portfolio; it does not provide product accounts, take payments or store your product files.

Each product’s own privacy policy covers its accounts, integrations and customer data. Following a product link takes you to that product’s site and its policies. This notice does not replace those policies or limit rights that applicable law gives you.

Information we collect

• Contact information you provide. The contact form collects a reply email address, a topic, your message and, optionally, your name. Replies and follow-up correspondence become part of the inquiry. Please do not send passwords, access tokens, payment details or sensitive information about other people.
• Website and device information. Requests to the site expose technical information such as your IP address, requested URL, browser user agent and request time to our hosting infrastructure. Operational and security records may contain this information.
• Page analytics. When analytics are enabled, PostHog receives page-view and technical information such as the page URL, referring URL, browser and device characteristics, and network information used for measurement. Avoid putting personal information into URLs.
• Spam-prevention information. Cloudflare Turnstile processes technical signals, including IP address, browser information and site origin, to distinguish people from automated traffic. Our contact service receives the verification result and uses temporary IP-based counters to limit repeated submissions.

Providing a name is optional. A valid reply address and message are necessary to submit an inquiry and receive a response. Browsing the portfolio does not require a contact submission.

How we use information

We use contact information to respond to questions, investigate reported problems, handle privacy and legal requests, and maintain a record of relevant correspondence. We use technical information to operate and protect the website, troubleshoot failures, prevent spam and understand which pages are useful.

We do not use contact submissions to subscribe you to marketing, sell or rent personal information, or run targeted advertising. We do not use this website’s information for automated decisions that produce legal or similarly significant effects on you.

Where European or UK data protection law applies, our purposes may rely on legitimate interests in operating and securing the site and responding to inquiries; steps you request before entering a contract; compliance with legal obligations; or consent where required. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing. A website visit or a message is not blanket consent to unrelated uses.

Analytics and browser signals

Our marketing analytics configuration uses PostHog’s cookieless mode with memory-only client persistence. It does not intentionally set persistent analytics cookies or store a visitor identifier in local storage. Automatic interaction capture, session replay and person profiles are disabled. Cookieless analytics can still involve processing technical information on the provider’s servers; it does not mean that no information is collected.

Turnstile is a separate security service, not an advertising tracker. Its processing is described in Cloudflare’s Turnstile Privacy Addendum. Security-related browser behavior can differ from our analytics configuration.

Browser settings and content blockers can restrict analytics or third-party scripts; blocking spam verification may prevent contact submissions. We do not currently change collection in response to the older Do Not Track signal. We do not sell personal information or share it for cross-context behavioral advertising, so there is no such sale or sharing to opt out of through Global Privacy Control. These statements do not restrict rights that apply to other processing.

Providers and disclosures

We use providers to host the website, measure visits, prevent abuse and deliver messages. They receive information needed for those functions. Their policies describe their own processing and any separate legal responsibilities.

We may also disclose relevant information to professional advisers, when reasonably necessary to comply with legal process, protect rights or investigate abuse, or in connection with a merger, acquisition or transfer of the business, subject to applicable obligations. We do not publish contact messages as testimonials without permission.

Retention

Retention depends on the purpose and the system holding the information. We keep inquiry correspondence while handling the request and as reasonably needed afterwards for follow-up, a dispute, a security investigation, or a legal obligation. The nature of the inquiry, whether it remains unresolved, and applicable legal requirements determine that period; we do not promise a fixed deletion date for every message.

Operational records and analytics are subject to the retention configuration of the relevant service. Temporary contact-form rate-limit entries expire after ten minutes. Postmark’s delivery records and message content follow its configured retention period; its published default is 45 days. Deleting delivery records does not delete the separate message in our mailbox.

Backups, security records and records subject to a legal hold may remain after an active copy is deleted. We restrict their use to the purpose for which they are retained. You can request information about retention for a particular inquiry through the contact form.

International processing

Our website infrastructure is hosted in Hillsboro, Oregon, United States, and our analytics project uses United States (PostHog US Cloud). Our providers may process information in the United States and other countries where they operate. Those countries may have different privacy protections from your country.

Where applicable law requires safeguards for an international transfer, the relevant transfer must be covered by an appropriate legal mechanism. Contact us to ask about the safeguards applicable to your information. This notice does not claim that every provider is certified under a particular transfer framework, or that visiting the site waives your rights.

Your choices and rights

Use the privacy contact form to ask about information we hold about you or request access, correction or deletion. Describe your request and the address or correspondence involved, without sending identity documents in the initial message. We may request proportionate information to verify your identity or an authorized representative’s authority.

Depending on applicable law, you may also have rights to a portable copy, to object to or restrict certain processing, to withdraw consent, to appeal a decision on a request, and to complain to your state attorney general or relevant data protection authority. We will assess and respond within the period required by applicable law and explain any applicable limitation or extension. We do not discriminate against people for exercising legally protected rights.

Some information cannot be linked reliably to an individual, particularly cookieless analytics. We may be unable to locate or delete an individual record without additional information, and we do not create identifying records solely to identify anonymous visits. Requests can also be limited by other people’s rights, security needs, legal retention requirements or other lawful exceptions.

Security

We use safeguards appropriate to this website, including HTTPS, restricted service access, validation and abuse controls. Our security page describes the site and how to report a vulnerability. No transmission method or storage system is guaranteed secure. If an incident triggers notification duties, we will address them under applicable law.

Children

This publisher website is not directed to children under 13, and we do not knowingly collect their information through the contact form. If you believe a child has provided personal information, contact us so we can investigate and address it. Individual products may have different audiences and policies.

Changes and contact

The date above identifies this version. We will publish revisions here and, where required, provide additional notice or obtain consent before a material change applies. A revision does not remove rights that apply to information already collected.

For questions or requests, contact Sanford Labs LLC through the privacy contact form. Michigan is our home jurisdiction; this policy does not displace mandatory privacy protections that apply where you live.