What we collect, and what we do with it.

Blank Slate Creative, LLC runs blankslate.biz. For anything about this notice or your information, email privacy@blankslate.biz.

• The quote form: your name, work email, company, a line on what it does, what you need, what’s driving it, a deadline if you give one, and anything else you write. It also records which page sent you to the form, any campaign tags in the link, and your answer to “How did you find us?” if you give one. The form also sends two technical values for its spam checks: how long the page was open before you sent it, and the result of Cloudflare’s check (see below).
• An order: at checkout, Stripe collects your name, email, billing address, payment details, and your answers to the checkout questions, and sends us your name, email, business name, those answers, and a record of the payment. For a service order, we then email you intake questions, and you send us your answers and, for the questionnaire order, your questionnaire file.
• Email you send us at hello@blankslate.biz or privacy@blankslate.biz: the message and anything in it.
• Every visit: like any website, the requests your browser makes carry technical data such as your IP address and browser type. Our host, Cloudflare, processes it to deliver and protect the site. We don’t keep logs of it ourselves.
• Visit counts: for each page view, Cloudflare Web Analytics records which page, which site sent you, your country, your device type, browser and operating system, and how fast the page loaded. See “Counting visits” below.
• Ad measurement: the data the Google tag receives, described under “Measuring our ads” below.

Please don’t send confidential material through the form: no credentials, customer data, or internal documents. If we need details like that, we’ll arrange it by email. The same goes for an order: your intake answers and questionnaire should describe how your company works, and need no credentials or customer data.

We count visits with Cloudflare Web Analytics, to see which pages and links bring people to the site and whether pages load quickly. Its script loads from Cloudflare on every page of blankslate.biz. For each page view it records the page, the site that sent you (the referrer), your country, your device type, browser and operating system, and how fast the page loaded. It doesn’t log the query string of the address, the part after a question mark. We see totals and breakdowns of these, not individual visitors.

Cloudflare says its analytics use no cookies and no local storage, and that for its analytics it doesn’t track people over time by IP address, browser string, or any other fixed attribute; Cloudflare explains its approach here. Cloudflare receives your IP address and browser details with the request, as for any website; its privacy policy covers that. If you’d rather not be counted, a content blocker that blocks Cloudflare’s analytics script works, and the site is the same without it.

We use Google’s tag on blankslate.biz to see whether any Google ads we run lead to orders. The tag loads from Google on every page of the site. It does not load on our test copies of the site. It receives the address of the page you are on, your IP address, and your browser details, as any website element does. If you arrived by clicking one of our ads, the ad link adds a click identifier to the address, and the tag stores that in a cookie from our domain so it can match a later order to the ad. Google says the cookies for this, named _gcl_au and _gcl_aw, last 90 days. When we loaded the site in a browser with the tag switched on, it set _gcl_au on our domain; after a visit that came through an ad-click link, it also set _gcl_aw on our domain and partitioned GCL_AW_P cookies under googleadservices.com, doubleclick.net, and google.com, all lasting 90 days. With the tag switched off, as it starts in the EU, UK, and Switzerland, it set no cookies at all. Google can change what it sets, and may set or read its own cookies, such as IDE, which Google says lasts 13 months in the EEA and UK and 24 months elsewhere, if its settings allow.

After you pay, the order confirmation page tells Google that an order happened: its amount, its currency (US dollars), and the Stripe checkout session ID as a reference number. It does not send your name, email address, or payment details. We have not turned on Google’s “enhanced conversions”, which would send an encrypted copy of an email address. We don’t use the tag to build lists of past visitors to show them our ads again.

If you are in the European Economic Area, the United Kingdom, or Switzerland, the tag starts with advertising and analytics storage switched off (Google’s “Consent Mode”, set to “denied”), so it sets no advertising cookies on your device. Google can still receive the request itself, including the page address and your IP address. This site has no cookie banner, so nothing on it switches the tag on for you. Everywhere else, the tag starts with storage switched on, but with personalised advertising off. If your browser sends the Global Privacy Control signal, the tag starts switched off for you, wherever you are.

Google handles what it receives under its own terms: How Google uses information from sites or apps that use its services and Google’s privacy policy. We cannot identify you from the tag. To limit it, use Google’s Ads Settings, block or delete cookies in your browser, or use a content blocker; the site works the same without the tag.

The quote form uses Cloudflare Turnstile to tell people from bots. It loads from Cloudflare on the quote page only. Cloudflare says Turnstile collects signals such as your IP address, TLS fingerprint, and browser user agent, and uses them to detect and block bots. When we loaded the quote page in a browser, the check set no cookies, but it kept one small item in the browser’s local storage, under Cloudflare’s own domain (challenges.cloudflare.com). What it stores is Cloudflare’s to describe and may change. Its Turnstile privacy addendum explains what Cloudflare collects.

The SOC 2 criteria study tool keeps your progress and drill settings in your browser’s local storage, on your own device only. We never receive it, and the tool’s “Reset progress” button, or clearing this site’s data in your browser, removes it.

The read-aloud player, on every guide page and in the study tool, keeps the reading speed you choose in your browser’s local storage, on your own device only, and only if you change it. We never receive it, and clearing this site’s data in your browser removes it.

Our fixed-price orders are paid on a page that Stripe hosts. Apart from the Google tag described under “Measuring our ads”, this site sets no cookies, and it loads nothing from Stripe: a button here takes you to Stripe’s page. Once you are on it, Stripe may set its own cookies and collect technical data, such as your IP address, as described in Stripe’s privacy policy. We never see your card number. What we receive from Stripe is listed under “What we collect” above.

Each buy button adds three source tags to the Stripe link (the page it came from and which order it was for). After you pay, Stripe adds the same tags to the address of the page it sends you back to on this site. They say nothing about you. Other than the ad measurement described under “Measuring our ads”, we use them for no tracking. Google’s tag on the confirmation page can see the address, including these tags and the session ID.

• To reply to you and prepare a quote.
• To take your order, draft and deliver it, and keep a record of the sale and of any refund.
• To decide whether the work is a fit, including checking for conflicts of interest.
• To learn which of our pages and links bring in inquiries, from the source details the form records.
• To learn whether any Google ads we run lead to orders, from the Google tag’s order reports.
• To keep a record of the inquiry and of anything we agree.

We email you only about your inquiry, your order, or work you’ve asked us to do.

A form submission is saved as a record in our private project tracker on GitHub. GitHub may also send a notification of it to our email inbox, and that notification can carry the text of your message. Our founder, Eric Cecchi, can read it, and so can the AI assistants that help run the company. They help sort inquiries and draft replies. They also draft order deliverables from your intake answers and questionnaire file. A person sends every reply, and a human security professional reads every custom deliverable before it goes out.

Those assistants run on a Claude account whose “Help improve Claude” setting is off. With it off, we don’t allow Anthropic to use the inquiries and order materials they read to train its models. Anthropic’s own terms still allow some uses, such as content its systems flag for safety review, and feedback submitted through the product. Anthropic explains them here.

We don’t sell your information for money, and we share it with no one except the service providers below, and, apart from Google’s ad-measurement tag (see “Measuring our ads”), only so they can do their part. The exceptions are where the law requires it, advisers who keep it confidential (such as an accountant), and a sale of the business.

Cloudflare

Hosts this site, counts visits to it (Web Analytics), runs the quote form’s spam check (Turnstile), and forwards the email you send to our @blankslate.biz addresses to our inbox.

GitHub

Stores quote-form submissions in our private project tracker.

Google

Our email inbox (Gmail): where your emails arrive, and where we write our replies and keep copies of them. It may also receive a notification of a form submission.

Google (ads)

Our Google Ads account and ad-measurement tag. It receives the data described under “Measuring our ads” and handles it under its own terms.

Resend

Sends the email we write from our @blankslate.biz addresses, including our replies to you. It receives your email address, the message we send you, and any files we attach.

Anthropic

Provides the AI models (Claude) our team uses to sort inquiries, draft replies, and draft order deliverables from your intake answers and questionnaire files.

Stripe

Takes payment for our fixed-price orders, on Stripe’s own checkout page. See “Orders and payment” below for what it collects and what we receive.

• Visit counts: Cloudflare says it keeps full detail for 7 days, then aggregates it, and shows about 6 months of history.
• Ad measurement: the cookies above last up to 90 days (Google’s IDE cookie, if it is ever set, 13 or 24 months). Google keeps what it receives under its own terms; we haven’t found a fixed period to quote.
• Inquiries that don’t become work: we aim to delete them, and any email copies, 12 months after we last hear from you.
• Email we send you: Resend, which sends it, keeps a copy of each message, including any files we attach. Resend’s pricing page lists “30-day data retention” for our plan, but Resend doesn’t promise to delete it then: its backups, and its own records of who each message was from and to, can last longer, under Resend’s privacy policy.
• If you place an order: we keep your intake answers, your files, and what we delivered for as long as the work and our business records need. Payment records stay in Stripe and in our books for as long as the law requires.
• Copies in our AI assistants’ conversation history follow Anthropic’s retention terms, not ours. Anthropic says deleted chats leave its back end within 30 days, content its systems flag can be kept for up to 2 years, and some data may be kept for legal reasons.

You can ask what we hold about you, ask us to correct it, or ask us to delete it. Email privacy@blankslate.biz. We aim to reply within 30 days. To protect your information, we act on a request only once we have confirmed it comes from the email address you used with us, and we send our reply to that address. If you ask us to delete, we’ll delete the record and our email copies, then reply to confirm what we did. We can’t delete Resend’s copy of email we sent you, including that reply; it lasts as long as Resend keeps it (see “How long we keep it” above). If we have to keep something, such as a payment record we’re required to retain, we’ll tell you what and why. What Stripe holds is Stripe’s to answer for; its privacy policy says how to ask it.

To limit ad measurement, see “Measuring our ads” above. This site doesn’t change its behavior for browsers’ “Do Not Track” setting, but it does honor the Global Privacy Control signal (see above).

If we change what we collect or who processes it, we update this page, and the date at the top, before the change goes live.