Privacy Policy

Covers: Custom Letter Boards (customletterboards.com), Custom Chalkboards (customchalkboards.com), Custom Cork Boards (customcorkboard.com), Custom Bulletin Boards (custombulletinboards.com) and Custom Board Co. (customboardco.com).

This policy explains what we collect, why, who we share it with, and the choices you have. “We” means Folk Strategy LLC, a Utah limited liability company, doing business as Custom Board Co. and its brands (Custom Letter Boards, Custom Chalkboards, Custom Cork Boards and Custom Bulletin Boards). We run all five sites.

1. What we collect

When you ask for a quote

On any of our board sites, the quote form asks for:

• Your name and email (required).
• Your phone, ZIP code and company name (optional).
• The board you designed: size, frame, surface, quantity, extra letter sets.
• What you'll use it for, what the board will say, and any notes.
• The sample design you started from, if any.

We also note how you found us: the Google ad click ID (if you came from an ad), campaign tags in the link, the first page you landed on, the site that sent you, and when that was first recorded. If your browser sends a Global Privacy Control signal, we don't keep any of this.

When you contact Custom Board Co. about a business order

The form at customboardco.com asks for your name, email, a description of the project, and the board types you're interested in.

When you pay

Payment happens in a checkout form run by Stripe on our /pay page. Stripe collects your card details. We don't receive or store your full card number. Stripe also collects your shipping address and phone number and passes them back to us with confirmation of payment.

When we make and ship your order

We record the tracking number, carrier, ship and delivery dates, and, if a board comes back, the reason.

Automatically, when you browse

• Google Analytics. If it runs (see section 4), Google Analytics records the pages you view, your browser and device type, and an approximate location that Google works out from your IP address. It also records a few events: when you open the quote form, when a quote is submitted, and when an order is paid. Those events carry the quote number, board size and material, an estimated or paid amount, and the ad click ID. We don't send your name, email or phone to Google Analytics.
• Our own cookies. See section 4.
• Server logs. Our host, Netlify, processes your IP address and basic request details to deliver the pages. We also use it to work out your approximate region, so we know whether to ask before loading Google Analytics.

2. Why we use it

• To price, quote and answer your request.
• To take payment, build your board and ship it.
• To email you about your quote and order: confirmations, the quote itself, one follow-up, payment received, shipped, delivered, and refunds.
• To alert us on our own devices when a new quote or inquiry arrives.
• To understand which pages and ads bring in customers. See “Advertising measurement” below.
• To keep the sites working and secure, and to prevent abuse.

We don't send marketing newsletters, and we don't text you. If that ever changes, we'll ask first.

Advertising measurement

Our brands that advertise on Google send Google Ads a record of each paid order. It holds the order number, the time, the value, and the ad click ID if we have one. It also holds your email and phone, scrambled with a one-way code (SHA-256 hashing) before they leave our systems. Google uses that record to match the sale to an ad click.

If your browser sent a Global Privacy Control signal when you asked for your quote, we leave your order out of this entirely. You can also ask us to leave it out by email (section 6).

3. Who receives it

We don't sell your information for money. We share it only with the services that run our business:

• Google Analytics (Google LLC)

  What they get

  Page views, device and browser, approximate location, the events in section 1, cookie IDs

  Why

  Site and ad measurement

• Google Ads (Google LLC)

  What they get

  Paid-order records with hashed email and phone (section 2)

  Why

  Matching sales to ad clicks

• Stripe

  What they get

  Card details, billing details, shipping address, phone, email, order total

  Why

  Taking payment and preventing fraud

• Supabase

  What they get

  Everything in section 1 except card details

  Why

  The database where quotes and orders are stored

• Resend

  What they get

  Your name, email and the content of each message we send you

  Why

  Delivering our emails

• Netlify

  What they get

  IP address and request details; form data in transit

  Why

  Hosting the sites and running the forms

• Google Workspace (Google LLC)

  What they get

  Copies of quote and order emails, and your replies

  Why

  Our email inbox and records

• Our manufacturing partner

  What they get

  Board specs, ship-to name, address and phone (never prices)

  Why

  Building and shipping your order

• Shipping carriers

  What they get

  Name, address, phone

  Why

  Delivery

• Browser notification services (Apple, Google, Mozilla)

  What they get

  Your name and company, inside an alert sent to our own devices

  Why

  Telling us a quote arrived

We may also share information if the law requires it, to protect our rights, or as part of selling or reorganizing the business.

When our pages change, we tell search engines through a service called IndexNow. That message lists our page addresses only. It carries nothing about you.

4. Cookies and similar tools

• _ga, _ga_<ID>

  Set by

  Google Analytics

  What it does

  Tells Google visits apart

  How long

  Up to 2 years (Google's default)

• _cbco_attribution

  Set by

  Us (plus a browser-storage copy)

  What it does

  Remembers the ad click and campaign that brought you, so we can credit it to your quote. Not set if your browser sends Global Privacy Control

  How long

  90 days

• cbco_consent

  Set by

  Us

  What it does

  Remembers whether you chose “Accept” or “Decline” on our privacy banner

  How long

  12 months

• __stripe_mid, __stripe_sid

  Set by

  Stripe, on the /pay page only

  What it does

  Fraud prevention during payment

  How long

  Set by Stripe

Your browser also keeps your email for a short while (in “session storage”) so the confirmation page can show your request. It stays on your device and clears when you close the tab.

Your choices:

• In California, Google Analytics doesn't load until you choose “Accept” on our banner. You can change your answer any time from the “Privacy choices” link at the bottom of every page.
• Everywhere, if your browser sends a Global Privacy Control (GPC) signal, Google Analytics doesn't load at all. No script, no cookies, no data.
• You can block or delete cookies in your browser settings. The quote form still works.

5. How long we keep it

• Quotes, orders and shipping records

  How long

  7 years, for tax and warranty records

• Quotes that never became orders

  How long

  2 years

• Business inquiries (customboardco.com)

  How long

  2 years

• Google Analytics data

  How long

  2 months

• Email delivery logs at Resend

  How long

  30 days

• Server and function logs at Netlify

  How long

  7 days

• Copies of emails in our inbox

  How long

  As long as needed for the order they belong to, within the periods above

• Payment records at Stripe

  How long

  Set by Stripe and its legal duties

6. Your choices and rights

You can ask us to:

• Tell you what we hold about you, and give you a copy.
• Correct something that's wrong.
• Delete your information. We may keep what we need for tax, warranty or legal reasons.
• Stop sharing it for advertising measurement (section 2).

We won't treat you differently for asking. We don't collect sensitive information like government IDs, health details or precise location.

How to ask: email privacy@customboardco.com from the address you used, or tell us that address. We'll confirm the request came from you, usually by replying to that address. Someone you authorize can ask for you if they show us your written permission. We'll answer within 45 days.

California residents. Our sites treat a GPC signal as a request to opt out of sale and sharing, as described in sections 2 and 4.

7. Do Not Track and Global Privacy Control

Our sites honor the Global Privacy Control signal as described in sections 2 and 4. Browsers' older “Do Not Track” setting has no common standard, and our sites don't change behavior when they receive it.

Google Analytics and Google Ads can collect information about your activity on our sites over time, and Google may combine it with your activity on other sites. GPC, or declining the banner in California, stops this on our sites.

8. Security

We use encrypted connections (HTTPS) on every site. Our database blocks public access. Only our own server code, using a private key, can read it. Payment and order-status links carry a random access code, and older links without one are being retired. No system is perfectly secure, so please don't email us card numbers.

9. Children

Our sites are for businesses and adults buying custom signage. They aren't meant for children under 16, and we don't knowingly collect information from them. If you think a child has sent us information, email us and we'll delete it.

10. Where we are

Our services store data in the United States. We sell to US addresses only.

11. Changes to this policy

When we change this policy, we'll post the new version here and update the date at the top. If a change affects how we use information you've already given us, we'll also email the address on any open quote or order before the change takes effect.

12. Contact

Privacy requests: privacy@customboardco.com
Everything else: hello@customboardco.com

See also our Terms of Sale and Accessibility statement.