Important: do not send secrets
Do not send passwords, payment card details, or unnecessary sensitive information through the inquiry form or email.
Information we use
Project inquiries may include name, email, project description, service interest, type of help, and timeline; company, phone, and website are optional. Visitors may voluntarily include project or budget context in their description. If an inquiry becomes a customer relationship, we also keep the accepted order and customer records, billing and payment-related records, service inputs, approved assets and work, reports, handoffs, and support communications needed to deliver and account for the work. Please do not send passwords, payment card details, or unnecessary sensitive information through the inquiry form.
Read the Terms of Service for order and payment terms.
How information is used
We use inquiry details to assess fit and respond; customer records to scope, deliver, support, bill, reconcile, and document authorized services; and limited operational records to secure and troubleshoot those workflows. The optional customer-question summary uses available authorized sources only under an eligible service and appears in its shared report, with no separate fee. Publishing is a separate Cinderbrook business line and is not implied by a content order. Services that use third-party systems are not active while their setup and qualification are incomplete.
Optional Google Calendar booking connection
Customer calendar connections are optional and are not active until the account owner authorizes the connection and the service setup and qualification are complete. Each connection is tied to the agreed customer workspace, calendar and booking rules. A connection does not give permission to send marketing messages.
For an authorized booking connection, we request your verified Google account identity, read-only access to your calendar list to verify the selected calendar, access to availability information, and access to events on calendars you own. Google's owned-event permission includes creating, changing and deleting events. Our current booking adapter permits creation and verification of one confirmed appointment; it does not implement event update or deletion operations. It does not request Gmail or Google Drive access.
We use the account and selected-calendar identifiers, calendar time zone, free/busy windows, appointment details and provider receipts to check availability, create the appointment you confirm, verify the result and prevent duplicate or uncertain bookings. We retain limited operational evidence under the customer-record, security and backup retention rules on this page. Access tokens and refresh tokens are encrypted in the booking credential vault; provider response evidence is restricted to authorized service and security access. We do not promise immediate deletion from existing backups.
Google data is used for the disclosed booking feature. It is not sold, used for advertising or credit decisions, or used to train generalized AI models. Human access is limited to the authorized service, your specific agreement, security troubleshooting or legal requirements. Cinderbrook's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
You can disable a booking destination through the authorized portal operator or ask operations@cinderbrookgroup.com to stop the connection. You can also revoke the app's access in your Google Account. Disabling a destination stops new booking actions; it does not delete existing calendar events, service records or backups. For access, correction or deletion requests, use the verified-request process below. Automatic texting is a separate control and is not enabled by connecting a calendar.
Website Assistant
Answers
The Website Assistant is an AI-assisted service that generates answers from Cinderbrook-approved business information. Ordinary chat does not require contact information. Questions and limited session context are processed server-side and may be sent to Cinderbrook’s AI service provider under the provider’s data-handling terms.
Sensitive information
Do not submit passwords, payment card details, government-identification numbers, or other sensitive or confidential information. High-confidence sensitive values are scrubbed before provider transmission; especially sensitive or credential-like inputs are blocked.
Retention
Cinderbrook retains only limited sanitized session and question information for assistant operation, abuse prevention, and understanding common customer questions: local assistant customer-question analysis and provider-error records are retained for up to 30 days, while in-memory conversation state expires after 30 minutes of inactivity.
Contact requests
Contact information is collected only when a visitor explicitly submits a separate contact request, used for Cinderbrook follow-up, and stored separately from ordinary chat and customer-question analysis data. Unconverted Website Assistant contact requests and internal notification copies are retained for 90 days. If a contact becomes an active customer/project, relevant information transitions into the normal customer-record lifecycle. Approved legal, security, or operational holds may suspend deletion for their duration and scope.
Backups
Backups follow the normal Cinderbrook backup lifecycle, so live-record deletion does not promise immediate deletion from existing backups.
Operational records and copies
Our inquiry system records a reference number, request reference, receipt and update times, source page, submission and spam-check status, and notification status, timing, and a limited error code where relevant. The current system does not populate IP-address hashes, rate-limit-key hashes, or browser-identification fields and does not store raw IP addresses. Accepted inquiries are stored in a private database. If internal email notifications are enabled, a copy is sent to the operations mailbox through Gmail after the inquiry is saved. No automatic customer reply is sent. Email copies, authorized exports, and backups may retain information outside the live database.
Access and service providers
Authorized Cinderbrook personnel may access records for the stated work. Applicable hosting and infrastructure, email, backup, and authorized payment providers or processors may handle information needed for their roles; the actual providers and settings depend on the authorized service and payment route. Payment processing, if offered, follows the authorized payment route and accepted order; no payment information is collected on this policy page. Services that require third-party setup are not activated until the required checks are complete.
Retention
Unconverted inquiries are retained for 12 months after receipt. Active customer records are kept while needed for the service, then only as needed for legitimate business, accounting, dispute, security, or legal requirements. Email notifications and backups may have different retention periods and controls; deleting a live record does not immediately remove an existing backup copy. We do not promise immediate backup deletion.
Your requests
For access, correction, or deletion requests, email operations@cinderbrookgroup.com. We verify the requester’s identity or authority, make a reasonable search of relevant systems and copies, and correct or delete information where appropriate, subject to legitimate or legal retention. We may ask for an inquiry reference or approximate date to locate a record; please avoid sending sensitive details. There is no public self-service deletion tool.
Policy status
This policy describes Cinderbrook's current operational practices for the customer and service relationship. Service-specific records and provider handling depend on the accepted order and authorized route.
