Privacy policy

1. Who we are

Gobeyn Enterprise LLC ("Gobeyn Enterprise," "we," "us") provides business consulting, website and software development, and support services. We are responsible for personal information collected through our website, our contact and booking forms, our client portal, and our invoicing and payment systems.

3948 24th Ave, Port Huron, MI 48060 · [email protected] · (810) 333-4905

2. What we collect

Enquiries and bookings: name, company, email address, phone number, the services you are interested in, budget and timeline ranges, and the message or topic you write.

Reviews you submit: name, company, and the review text. Reviews are published only after we approve them.

Client portal users: name, email address, job title, the client company you belong to, your sign-in credentials (password stored only as a hash), and your two-step sign-in setup (an authenticator app).

Project records: project details, milestones, messages you send, files you upload, and comments.

Agreements and approvals: proposal acceptances (the typed name, date, time, IP address and browser), and records of signed paper agreements (the document version, the date written on it, and the name on it).

Invoices and payments: invoice details and payment status. Card details are handled by Stripe. We receive the card brand, the last four digits and the payment result. We do not store full card numbers.

Security and usage records: IP address, browser type, sign-in events including failed attempts, and an audit log of logins, views, downloads and changes to client records.

We do not collect Social Security numbers or bank account details.

3. How we use it

To respond to enquiries, book calls, and deliver proposals, projects, support and invoices.

To run the client portal, send project messages and notices, and keep project records.

To take payments and keep the financial and tax records the law requires.

To keep our systems secure, prevent fraud and abuse, and investigate misuse.

To meet legal obligations and defend legal claims.

We do not use personal information for advertising, and we do not sell it.

4. Cookies and similar technology

See the Cookie Notice for the details. In short: we use a sign-in session cookie that is needed for the portal and admin area, and the bot-protection service on our forms may set its own technical cookies. We do not set advertising or cross-site tracking cookies.

5. Who we share it with

We share information only as needed to provide the service:

Provider: Stripe. What they do: Payment processing and payment records. Where data is held: United States.

Provider: Neon. What they do: Database hosting (PostgreSQL). Where data is held: United States (AWS us-east-1).

Provider: Railway. What they do: Application and worker hosting. Where data is held: United States.

Provider: Amazon Web Services (S3). What they do: Storage of uploaded project files, encrypted with AWS KMS. Where data is held: United States (us-east-1).

Provider: Cloudflare. What they do: DNS, web application firewall, bot protection (Turnstile). Where data is held: Global network.

Provider: Resend. What they do: Transactional email (notices, invitations, password resets). Where data is held: United States.

Provider: ClamAV (our service on Railway). What they do: Malware scanning of uploaded files. Where data is held: Same as hosting.

Provider: Plausible. What they do: Privacy-friendly website analytics, without cookies, once enabled. Where data is held: European Union.

Provider: Sentry. What they do: Error monitoring, once connected. Error reports are scrubbed of passwords, tokens, session identifiers and file contents before they are sent. Where data is held: United States.

Provider: Have I Been Pwned. What they do: Password breach check. Only the first five characters of a password's hash are sent. Where data is held: United States.

We do not put your personal information into AI tools. If we ever use an AI service that would receive personal information, we will add it to this table first.

We may also disclose information to professional advisers, insurers or government authorities where the law requires it, or to protect people or our rights. Each provider processes data under its own agreement with us.

6. How long we keep it

We keep client and business records for at least seven (7) years from the date of the record. Nothing is deleted before that minimum period. This covers enquiries, contracts and signed agreements, project files and messages, invoices and payments, and the audit log.

After the minimum period, information may be deleted or de-identified on request, unless a legal hold, tax rule, dispute or other legal duty requires us to keep it. Backups are removed on their normal rotation.

7. How we protect it

Passwords are stored as Argon2id hashes, must be at least 12 characters, and must not appear in a known data breach.

Owner and client portal users must use two-step sign-in with an authenticator app.

Sessions end after 30 minutes without activity.

All traffic is encrypted in transit (HTTPS with HSTS).

Uploaded files are scanned for malware before they can be downloaded. Downloads use links that expire within minutes.

Files are encrypted at rest with AWS KMS. Database and file storage are private, and the application uses a least-privilege database role.

Client data is scoped to the client's own account on every request. Clients cannot see another client's records.

Audit records are append-only.

Sign-in and password requests are rate limited.

No system is completely secure. If you believe your account has been compromised, contact us immediately.

8. Your choices and rights

You may ask us to tell you what personal information we hold about you, to correct it, or to delete it once the seven-year minimum has passed. We will confirm your identity first and respond within 30 days, unless the law sets a different period. To make a request, email [email protected] or call (810) 333-4905.

9. Security incidents

If we learn of unauthorised access to personal information, we will act promptly to contain it and will notify affected people and regulators as the law requires, including under Michigan's security breach notification law (MCL 445.72).

10. Children

Our services are for businesses and adults. We do not knowingly collect personal information from children under 13.

11. Changes and contact

We may update this policy. We will change the effective date and version, and we will tell portal users about material changes.

Gobeyn Enterprise LLC, 3948 24th Ave, Port Huron, MI 48060 · [email protected] · (810) 333-4905.