Privacy Policy

CodeLabs88, LLC (“CodeLabs88,” “we,” “us,” or “our”) is a web development agency based in Albuquerque, New Mexico. We build and maintain websites, e-commerce stores, and web applications, and we bill clients for that work.

We are the party responsible for the information described in this policy. You can reach us at codelabs88dev@gmail.com or (505) 352-4674. We operate out of Albuquerque, New Mexico; we do not publish a street address on this site, so if you need to reach us by postal mail, email or call us first and we will give you a mailing address.

This policy covers:

• the public website at codelabs88.com;
• our contact form, and the emails we send in response;
• the private links we email to clients for invoices, proposals, and contracts, and the payment pages they lead to;
• the client portal used by our maintenance clients to file and track support requests.

It does not cover the websites we build, host, or maintain for our clients — those are our clients’ own sites, with their own privacy policies and their own operators. It also does not cover third-party websites you reach by clicking a link from our portfolio, or the live previews of client sites we embed on our home and Our Work pages.

Contact form submissions. When you use the contact form we collect your name, email address, phone number, and the inquiry type you select. We also record the IP address the submission came from, which we use to rate-limit and filter automated spam. The form includes a hidden anti-spam field that real visitors never see or fill in.

Client and project records. If we work together, we keep the business records the engagement requires: contact and business name, email addresses (including any separate billing or CC address), phone number, mailing address, website, our notes about the project, proposals, contracts, invoices and their line items, payment records, and a log of which emails we sent you and when. When a proposal or contract is signed electronically, we store the typed signer name, the drawn signature image, and the time it was signed.

Payment information. Card and bank payments are processed by Stripe on Stripe-hosted pages. Full card numbers, CVCs, and bank login credentials are entered on Stripe’s pages and never reach our servers, and we never see or store them. What we store is the Stripe identifier for the payment, the amount, date, method, and status — and, if you enroll in autopay, the Stripe customer/payment-method identifiers plus the bank name or card brand and the last four digits, for display on your account.

Client portal accounts. Portal accounts are keyed to your site’s domain. We store the domain, a one-way hashed password (never the password itself), an optional display name and contact email, the time of your last login, and the support tickets and messages you submit.

Analytics and site usage. We use Google Analytics 4 on this website. It sets cookies in your browser and reports things like which pages were viewed, how visitors arrived, approximate location derived from IP address, and browser and device type. We use it in aggregate to understand what people look at; we do not use it to build advertising profiles, and this site does not run advertising or retargeting pixels.

Accounts you connect for reporting. Some clients ask us to produce SEO or advertising reports. If you authorize that, we store the OAuth tokens that let us read your Google Analytics, Search Console, or Google Ads data for reporting only. You can revoke that access at any time from your Google account or by asking us to disconnect it.

Server logs. Our servers keep ordinary technical logs (IP address, request, timestamp, user agent) for security, abuse prevention, and debugging.

• to answer your inquiry and send you a quote;
• to scope, deliver, host, and support the work you hire us for;
• to invoice you, take payment, apply and remit New Mexico gross receipts tax, and keep the accounting and tax records a business is required to keep;
• to send service and reporting emails you have asked for;
• to protect the site — rate limiting, spam filtering, fraud and abuse prevention, and securing accounts;
• to understand, in aggregate, how the website is used so we can improve it.

We do not sell or rent personal information, and we do not share it with anyone for their own advertising or marketing.

Cookies and similar storage are used on this site for three things:

• Analytics — Google Analytics 4 cookies, as described above.
• Sign-in sessions — if you log in to the client portal (or if we log in to our admin area), a session cookie keeps you signed in. These are required for those areas to work.
• Third-party pages — Stripe sets its own cookies on its checkout pages, under Stripe’s privacy policy, not ours.

You can block or delete cookies in your browser settings, and you can opt out of Google Analytics entirely using Google’s browser add-on. Blocking analytics cookies does not affect your ability to use this site or to contact us.

These are the outside services that handle information on our behalf. Each one is used for the purpose listed and nothing else.

• Stripe — card and bank payment processing, including the hosted checkout page and bank auto-draft enrollment.
• Resend — delivery of our transactional email (contact-form confirmations, invoices, reminders, proposals, contracts, notifications), sent from notifications@codelabs88.com.
• Google Analytics 4 — website analytics.
• Google Fonts — the typefaces on this site load from Google’s font servers, which means Google receives the request from your browser.
• Mapbox — the interactive map on the home and contact pages. Map tiles load from Mapbox, so Mapbox receives your IP address and browser information when the map renders.
• Amazon Web Services — hosting for this site and its database, plus encrypted daily backups. Our servers and database are in the United States.
• Google APIs — where a client has authorized it, the Google Analytics, Search Console, and Google Ads APIs for reporting; and the Gmail API for correspondence we send from our own business mailbox.
• Telegram and Anthropic — we run an internal, owner-only assistant that answers questions about our own business records (for example, which invoices are outstanding). Limited business data such as invoice amounts, client and business names, and lead notes may be processed by these providers for that purpose. It is not used for advertising and is not shared further.
• Embedded client-site previews — our home and Our Work pages load live previews of client websites. Those sites load directly in your browser and can see your IP address and browser information, the same as if you had visited them.

We may also disclose information if we are required to by law, or where it is necessary to establish or defend a legal claim.

• Inquiries and leads — kept while we are in contact and for our own follow-up afterwards. Ask us and we will delete them.
• Invoices, payments, and tax records — retained for as long as accounting and tax rules require (generally at least seven years). We deliberately never hard-delete payment records, so these are the one category we cannot delete on request.
• Contracts and signed documents — retained for the life of the engagement and afterwards as a record of what was agreed.
• Client portal tickets and messages — retained while the account is active, as a support history.
• Internal assistant message logs — pruned automatically after about 30 days (condensed summaries after about 180 days).
• Backups — encrypted daily backups and point-in-time database backups mean a copy of deleted data can persist in backup storage for a period after it is deleted from the live system.

We are a small New Mexico business, and we are not claiming here to be subject to the GDPR, the CCPA/CPRA, or any other specific privacy statute. We will honor the following requests from anyone who asks, regardless of where you live:

• Access — ask us what we hold about you and we will send you a copy.
• Correction — tell us what is wrong and we will fix it.
• Deletion — ask and we will delete what we hold, except records we are required to keep for tax, accounting, or legal reasons (see retention, above). We will tell you specifically what we kept and why.
• Stopping emails — ask and we will stop sending reports and non-essential email. Billing email tied to an open invoice or an active engagement will continue until the engagement ends.

The site is served over HTTPS. Passwords are stored only as one-way hashes. Card and bank details are handled by Stripe and never stored on our systems. Administrative access to client records is limited to CodeLabs88 personnel, and our databases and backups sit behind access controls on Amazon Web Services.

No system is perfectly secure, and we do not claim otherwise. If a security incident affects your personal information, we will notify you as required by applicable law, including New Mexico’s data breach notification law.

This site and our services are for businesses. They are not directed to children under 13, and we do not knowingly collect personal information from children. If you believe a child has submitted information to us, contact us and we will delete it.

If we change how we handle information, we will update this page and change the effective date at the top. For material changes that affect existing clients, we may also notify those clients by email.

CodeLabs88, LLC — Albuquerque, New Mexico
Email: codelabs88dev@gmail.com
Phone: (505) 352-4674