Privacy Policy

1. Executive Privacy Pledge & Commitment to Law Firm Confidentiality

Cardinal Sites ("Company," "we," "us," or "our") engineers specialized web architecture, custom front-end development, and AI Visibility Optimization (AVO) exclusively for professional legal practices, specifically boutique family law firms and independent domestic litigation practices. We understand that attorneys, managing partners, and legal administrators operate within a strictly governed regulatory environment requiring uncompromising discretion, client privilege preservation, and elevated data security standards.

This Privacy Policy sets forth our strict operational policies regarding the collection, use, protection, disclosure, and retention of personal and professional information when you visit https://cardinalsites.com (the "Site"), schedule a phone discovery consultation, submit onboarding materials, or communicate with our engineering team. We are committed to operating with complete transparency: we do not sell or monetize personal data, we do not deploy invasive third-party cross-site advertising trackers, and we restrict data processing strictly to the legitimate technical requirements of evaluating, engineering, and launching law firm websites.

2. Scope & Applicability of this Policy

This Privacy Policy applies to personal and professional information collected through:

• The Site and its interactive elements, including our discovery consultation scheduling interface.
• Direct electronic communications between your law firm and our engineering team (including emails, discovery questionnaires, and onboarding forms).
• Technical assets, project materials, and credential links submitted to Cardinal Sites in connection with our website rebuild process.

This Privacy Policy does not apply to websites operated by independent third parties, even if linked from or integrated into our Site (such as external hosting providers or payment gateways). Furthermore, this Privacy Policy governs Cardinal Sites' handling of data; each client law firm remains solely responsible for establishing and maintaining its own independent privacy policy governing public visitors to its delivered website.

3. Categories of Information We Collect

We collect only the information necessary to fulfill our professional commitments, evaluate project feasibility, and engineer high-performance web presences:

4. Categories of Data We Explicitly Do NOT Collect

To protect legal ethics standards, client confidentiality, and attorney work-product integrity, Cardinal Sites enforces strict boundaries regarding excluded data categories:

• No End-Client Litigation Files or Case Records: Cardinal Sites does not solicit, process, collect, or store confidential client case files, litigation records, divorce filings, financial affidavits, child custody evaluations, or attorney work-product. All intake forms we build for law firms route client submissions directly to the firm's chosen secure endpoint (e.g., Clio or firm email); Cardinal Sites does not maintain a repository or interceptor database of prospective legal inquiries submitted to our clients' websites.
• No Raw Credit Card Data on Our Servers: Cardinal Sites does not directly process, collect, or store raw credit card numbers or bank account credentials on the Site. All transactions are handled through secure, PCI-compliant third-party merchant processors.
• No Sensitive Consumer Identifiers: We do not collect government-issued identification numbers (Social Security numbers, driver's license numbers), biometric data, or consumer health records.

5. Purposes & Legal Bases for Data Processing

Cardinal Sites processes collected information strictly for the following legitimate commercial and contractual purposes:

• Discovery Consultations: To schedule, confirm, and execute the 15-minute phone discovery call, understand your current website configuration, and assess mutual project fit.
• Service Execution & Development: To design, code, verify, and deliver your custom Next.js website, map structured Schema.org entities, and format attorney profiles accurately.
• Lead Routing Configuration: To engineer functional backend pipelines connecting contact and intake forms directly to your firm's designated destination (CRM, table, or email).
• Launch & Setup Support: To assist with domain pointing, Google Search Console sitemap submission, and execution of day-of and 7-day post-launch polish requests.
• Administrative & Accounting Communications: To issue invoices, confirm payments, and deliver GitHub repository transfers.
• Security & Infrastructure Protection: To detect, prevent, and mitigate unauthorized access, cybersecurity threats, or abuse of our digital infrastructure.

We process this data based on legitimate business interests, the necessity of performing our contractual commitments to you, and compliance with applicable legal obligations.

6. Absolute Prohibition on Selling, Renting, or Monetizing Data

Furthermore, we do not share personal information with third parties for cross-context behavioral advertising. Any data shared with infrastructure service providers is transferred strictly to facilitate operational infrastructure, subject to stringent contractual confidentiality and data processing covenants.

7. Third-Party Infrastructure, Subprocessors & Integrations

To maintain modern web infrastructure and execute project handoffs, Cardinal Sites engages select third-party service providers ("Subprocessors") who process limited data on our behalf:

• Calendly LLC: We utilize an embedded Calendly widget on /book to allow managing partners to schedule discovery calls. When you interact with the booking widget, Calendly collects your scheduling details and telephone number under its own privacy policy and data security standards.
• GitHub Inc. (Microsoft Corporation): For active client projects, codebase deliverables are handed off via GitHub repository transfers. The client's GitHub username or organization identifier is utilized solely to effectuate code transfer.
• Cloud Edge Hosting Infrastructure: The Site is hosted on modern cloud edge infrastructure (such as Vercel or Netlify) that serves statically pre-rendered Next.js assets, distributes content globally, and maintains edge security firewalls and access logs.
• Client-Designated Endpoints: When building your website's contact forms, Cardinal Sites connects workflows to the specific endpoints you instruct us to use (such as Clio, Google Sheets, Airtable, or your email host). Once deployed, client inquiry data flows directly to your designated vendor, governed by your direct relationship with that provider.

8. Minimalist Cookie & Tracking Technology Policy

Cardinal Sites adheres to a privacy-first, minimalist technical philosophy:

• No Advertising Pixels or Retargeting Beacons: We do not deploy Meta (Facebook) Pixels, Google Ads remarketing tags, TikTok pixels, or cross-site tracking beacons.
• Essential Functional Cookies Only: The Site utilizes minimal session cookies strictly necessary to ensure page rendering, maintain security, and support the embedded Calendly scheduling widget.
• Local Assets & Self-Hosted Typography: Typography on the Site is self-hosted and pre-rendered via Next.js font optimization, eliminating third-party user tracking during page loads.
• Do Not Track & Global Privacy Control: The Site respects Global Privacy Control (GPC) signals and browser "Do Not Track" (DNT) headers. Because we do not track visitors across external websites or sell personal data, our default operating mode is inherently compliant with GPC standards.

9. Data Retention & Archival Protocol

We retain personal and project information only for the duration necessary to fulfill the purposes outlined in this Privacy Policy:

Discovery Inquiry Data: General inquiries and discovery call records are retained for historical administrative reference for up to twenty-four (24) months, after which they are archived or deleted unless an active client engagement ensues.

Active Project Code & Assets: During the active build process and the 7-day post-delivery polish window, client assets and code are maintained in secure engineering environments. Following successful GitHub transfer and client acceptance, primary ownership resides with the client. Cardinal Sites retains an encrypted backup archive of the delivered codebase for disaster recovery and verification purposes, which may be purged upon written request from the firm.

10. Technical, Administrative & Physical Data Security

We implement robust administrative, technical, and physical safeguards designed to protect personal and business information against unauthorized access, destruction, loss, alteration, or disclosure:

• Encryption in Transit: All traffic to and from the Site is strictly enforced via Hypertext Transfer Protocol Secure (HTTPS) with Transport Layer Security (TLS 1.3) encryption.
• Restricted Access Controls: Access to client onboarding assets, FAQ responses, and repository transfers is restricted strictly to authorized engineering personnel directly assigned to the build process.
• Secure Development Environments: Engineering workstations and repository branches adhere to multi-factor authentication (MFA) and least-privilege access protocols.

While we implement rigorous security measures, no electronic transmission over the Internet or digital storage facility can be guaranteed to be 100% impenetrable. We encourage clients to utilize secure transmission channels for proprietary assets.

11. State-Specific & Statutory Privacy Rights

Depending on your geographic location and jurisdiction within the United States, you may enjoy specific statutory rights regarding your personal information under state privacy enactments, including the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), the Virginia Consumer Data Protection Act (VCDPA), and the Colorado Privacy Act (CPA):

• Right to Know / Access: The right to request confirmation of whether we process your personal data and to access the specific pieces of personal information collected about you.
• Right to Deletion: The right to request the permanent deletion of personal information we have collected from you, subject to standard legal and accounting retention exceptions.
• Right to Correction: The right to request the rectification of inaccurate or outdated personal information maintained in our records.
• Right to Non-Discrimination: The right not to receive discriminatory treatment, altered pricing, or diminished service quality for exercising any of your statutory privacy rights.
• Opt-Out Rights: Because Cardinal Sites does not sell personal data or share personal data for cross-context behavioral advertising, we do not provide a "Do Not Sell or Share My Personal Information" link, as no such commercialization occurs.

To exercise any of these rights, please submit a written request to our designated privacy address: info@cardinalsites.com. We will verify your identity and respond to your request within the statutory timeframes required by applicable law.

12. Children's Online Privacy Protection Act (COPPA) Compliance

The Site and our commercial web rebuild services are strictly targeted to adult legal professionals, law firm partners, and business administrators. We do not direct our Site to children, nor do we knowingly solicit or collect personal information from individuals under eighteen (18) years of age. If we become aware that an individual under 18 has submitted personal information, we will immediately delete such data from our records.

13. Revisions & Versioning of this Privacy Policy

We reserve the right to revise, update, or modify this Privacy Policy at our discretion to reflect operational enhancements, new service features, or changes in applicable privacy legislation. Any modifications will become effective immediately upon publishing the revised policy on the Site, indicated by the "Last Revised" date at the top of this document. For active clients, material changes that significantly affect data handling will be communicated directly via email.

14. Data Controller Contact & Privacy Rights Submissions

If you have any questions, concerns, complaints, or requests regarding this Privacy Policy, our data handling standards, or your statutory rights, please contact Cardinal Sites directly: