This policy describes how the reviewed Next.js application served from the business domains handles information. It applies beginning October 29, 2026. Customer confirmation emails, analytics, public client accounts, uploads, and payment processing are not activated.
Scope and identity
This policy explains how M. Etienne Web Designs LLC handles information through metiennewebdesigns.com and related approved services.
M. Etienne Web Designs LLC is an owner-confirmed Louisiana Limited Liability Company operating publicly as M. Etienne Web Designs. An address, tax identifier, registration number, or personal identifier must not be published without a separate necessity and privacy review.
The public business domains serve the reviewed Next.js application from Vercel. Wix remains the DNS manager and may retain historical website assets or records from the prior site, but it is not the current public application host. Historical Wix records, if any, remain subject to separate account-level access, retention, and deletion settings.
Information collected
Submitting either form does not enroll the visitor in marketing communications.
Contact form
The implemented contact form can receive:
- full name;
- email address;
- optional phone number;
- subject and message;
- consent confirmation;
- a client-generated submission identifier;
- a hidden anti-abuse field; and
- technical request information used to validate origin and apply security controls.
Project inquiry
The project inquiry can additionally receive:
The inquiry does not collect a payment, card number, bank information, or other payment credentials. A payment preference is a planning input and is not a quote, contract, or authorization to charge.
- requested project types;
- contact preference, business or organization name, city, state, and industry;
- existing website address;
- project descriptions, goals, audience, desired features, and reference URLs;
- design preferences, brand information, and exact color selections;
- conditional website, application, software, and branding requirements;
- budget range, timeline, funding status, project-phase, and payment-preference selections; and
- consent to be contacted about the inquiry.
Administration information
The private administration system can process an authorized administrator's email address, authentication session, role, account and audit identifiers, security events, portfolio changes, media metadata, and administrative settings. The current system is intended for authorized administrators, not public account registration.
Prepared client portal
The invitation-only client portal can process a verified client's name and email, organization and project memberships, project scope and status, milestones, messages and read states, private file metadata and uploads, proposals, agreement-acceptance facts, approvals, invoices, payment status, notification delivery state, authentication and security events, and audit records. Public registration is not implemented. Portal access, uploads, downloads, email delivery, agreement acceptance, and Stripe billing remain inactive pending separate authorization and provider, operational, privacy, and legal review.
Request and security information
Hosting and security providers may process network address, device/browser headers, timestamps, requested URLs, and diagnostic information in their logs. For configured administrator login rate limiting, the application derives keyed hashes from the network address and normalized login email before creating short-lived Redis keys. It does not intentionally use raw addresses or email addresses as those Redis key names.
Inquiry delivery and business correspondence
Validated contact or consultation contents are sent through Resend to info@metiennewebdesigns.com. Resend and the Google-hosted business mailbox therefore process the visitor's contact details and submitted project information to deliver and receive the message.
The application does not store the inquiry in Supabase and does not send a customer confirmation. Inquiry contents may remain in provider delivery records and the business mailbox according to those systems' settings and the approved retention schedule.
How information is used
Information may be used to:
- respond to messages and requested service discussions;
- evaluate scope, timing, and fit for a proposed project;
- send operational confirmations if that feature is approved and activated;
- authenticate authorized administrators and maintain sessions;
- protect forms and login endpoints from abuse, duplication, and excessive attempts;
- administer approved portfolio content and private media;
- investigate errors, security events, and service reliability; and
- meet legal obligations or protect rights and safety where applicable.
Current implementation boundary
The current public inquiry endpoint is email-oriented. Database inquiry persistence is not activated for public submissions. The isolated development database contains the prepared analytics schema, but visitor collection is disabled and no analytics events exist. No advertising integration is installed.
Current and planned service providers
This list distinguishes active providers from inactive foundations. Provider terms, subprocessors, locations, and practices may change independently; this policy will be reviewed when the service architecture materially changes.
| Provider | Reviewed role | Current status |
|---|---|---|
| Wix | DNS manager and possible custodian of historical website records or assets | Not the current public application host; retained submissions, contacts, collaborators, exports, deletion settings, and recovery copies require an account inventory |
| Vercel | Production hosting, request infrastructure, and protected operational deployment URLs | Active at the business domains; generated and Preview deployment URLs remain protected while the public marketing domains are reachable |
| Supabase | Development authentication, database, private media, client-portal, and analytics foundations | Active only in the isolated development environment; no real client records, public inquiry persistence, visitor analytics collection, or public portfolio database rendering is activated |
| Upstash | Redis-compatible rate limiting and security keys | A separate Production database is configured for administrator login and inquiry abuse controls |
| Resend | Transactional inquiry email delivery | The Production sending credential and approved sender/recipient configuration deliver validated inquiry messages; customer confirmations remain disabled |
| Google-hosted business mailbox | Receives transactional inquiry messages addressed to the approved business inbox | Public MX records confirm Google mail hosting; Workspace/Vault license, users, delegates, forwarding, routing, retention, exports, access, and deletion require owner inventory |
| Apple and Google | External application-store destinations | Linked from the portfolio; their independent practices apply after a visitor follows a link |
| Vercel Web Analytics | Potential aggregate page-view and visitor reporting | Not enabled; separate privacy, cost, and activation approval is required |
| Supabase analytics events | Potential bounded first-party business-event reporting | Schema applied only to the isolated development database; collection disabled and zero events recorded |
| Stripe | Potential invoice hosting, payment processing, payment status, and refund synchronization for approved client projects | Server and webhook foundation prepared; no account credentials, live invoices, payments, refunds, or charges activated |
Browser privacy signals
The reviewed application does not activate advertising, sale-or-sharing integrations, cross-site behavioral tracking, or visitor analytics. It therefore does not currently change its behavior in response to browser Do Not Track or Global Privacy Control signals. If practices change so that a legally recognized signal becomes relevant, the application and this policy will be reviewed before that practice is activated.
Retention
The owner has approved business retention preferences subject to applicable law, contracts, and accounting requirements. They do not prove compliance, activate deletion, or create a universal period for every provider copy.
Approved preferences are: unconverted inquiries 12 months after last meaningful interaction; completed projects 3 years after completion; portal messages 3 years after closure; client files 12 months after completion unless otherwise agreed; expired invitations 30 days after expiration; notification delivery 90 days after final outcome; security/access logs 90 days unless preservation is required; and first-party analytics 90 days only if separately activated. Billing/tax records and agreement/evidence records follow applicable requirements. A legal hold or other preservation duty always overrides review eligibility.
Unknown status and missing or invalid dates are not expired. Application deletion cannot promise immediate removal from provider systems, mail copies, exports, immutable or rotation-based backups, or encrypted recovery checkpoints. The production recovery design must define lawful expiry, holds, restore controls, and post-restore handling.
The prepared analytics migration does not invent a retention period. Intake remains closed until an owner-approved value from 1 through 365 days is configured. The database rejects longer periods and provides a service-only purge function, but no purge schedule is activated.
The prepared portal schema includes an unscheduled historical function with 90-day terminal notification/invitation and 730-day audit defaults. It does not match every approved preference, is not the approved policy source, and remains inactive pending a separately reviewed replacement or retirement with authorization, legal-hold, dry-run, audit, and verification controls. Business records are not automatically deleted.
- administrator login rate-limit keys: generally 15 minutes unless configuration changes;
- planned inquiry rate-limit keys: generally 15 minutes;
- planned pending inquiry reservations: generally 10 minutes; and
- planned accepted-submission duplicate keys: generally 24 hours.
Security
Reviewed safeguards include input validation, request-size limits, same-origin checks, fail-closed production security configuration, rate limiting, duplicate controls, server-only credentials, password-based administrator authentication, role checks, row-level database protections, private storage, controlled errors, protection for generated and Preview deployment URLs, and audit logging.
No safeguard makes a system risk-free, and M. Etienne Web Designs LLC does not guarantee that unauthorized access, loss, interruption, or misuse cannot occur.
Third-party links
The website links to client websites, Apple App Store pages, Google Play pages, and other third-party destinations. Following a link transfers the visitor to a service controlled by another party. Their terms, privacy notices, cookies, accessibility, availability, and security practices apply independently.
Privacy requests and rights
Visitors may contact info@metiennewebdesigns.com with a privacy question or a potential access, correction, deletion, export, or consent-withdrawal request. Requests are handled case by case with appropriate identity or authorized-agent verification, a system-by-system search, preservation review, provider-specific action, and completion records.
Rights and response periods vary by location and circumstances. This policy does not promise that every listed right applies in every location or that information can be removed immediately from provider systems or immutable backups.
- identity-verification and authorized-agent procedures;
- intake, logging, search, correction, deletion, restriction, objection, portability, appeal, and opt-out workflows where applicable;
- legally required response periods and exceptions;
- recordkeeping for completed requests; and
- jurisdiction-specific notices and escalation procedures.
Children's information
The services are designed for business and organizational inquiries and are not directed to children. The application does not intentionally request a child's age or knowingly solicit information from children.
If the business learns that information was submitted by a child in circumstances requiring removal or parental authorization, it will review the submission, preserve only what law requires, and take appropriate action. A parent or guardian may contact info@metiennewebdesigns.com.
Changes and contact
This policy is effective October 29, 2026. Material changes to hosting, forms, persistence, analytics, advertising, payments, scheduling, newsletters, or account features trigger a data-flow and policy review. The updated policy, effective date, and version will be posted here, with additional notice when appropriate or legally required.
Questions may be directed to info@metiennewebdesigns.com.