Privacy Policy

1. Introduction

This Privacy Policy explains how CAD Guardian LLC ("we," "us," "our") collects, uses, discloses, and otherwise processes personal information on the gvosmith.com website (the "Platform").

Listening and collections are free and do not require an account. The public listening experience has no payment checkout.

2. Data We Collect

Information you provide directly:

• Existing newsletter subscriptions: email address and subscription preferences if you previously subscribed.
• Business inquiries: your email address, name, message, and any material you choose to include when emailing us. The collaboration links open your email application.
• Admin access: email and password (stored securely by Supabase Auth, not by us).

Information collected automatically:

• Analytics: page views, device type, browser information, and referrer via Vercel Web Analytics. It produces aggregate usage statistics without third-party cookies.
• Authentication: Supabase session cookies for admin access.
• Listening preferences: the last selected track is saved in your browser so it can be selected on your next visit.
• Listening counts and reactions: a random browser identifier is stored locally for up to 180 days and sent with page visits, plays after at least 30 seconds of listening, and positive or negative reactions. If storage is blocked, the identifier lasts only for the current page session. Our engagement store keeps keyed hashes for deduplication and reactions, not the raw browser identifier or IP address. Separate hosting and abuse prevention systems process request metadata, including IP address and browser information.

3. Legal Basis and Purpose

We collect and process personal information for legitimate business purposes:

• Newsletter: deliver updates and promotional content (with user consent).
• Email inquiries: evaluate business opportunities, respond to inquiries, maintain records.
• Analytics: understand Platform usage, improve user experience, count visits and qualifying plays, and let you add, change, or remove a reaction without an account. Public counters show aggregate totals, not browser identifiers.
• Admin access: secure operator authentication.

4. Data Processors and Third-Party Sharing

The following services support current operations or retain existing administrative, inquiry, or subscriber records:

• Supabase (Auth + Database): administrator authentication, session management, and existing inquiry records. Review their privacy policy.
• MailerLite: existing newsletter subscriber records and consented email campaigns. Review their privacy policy.
• Sanity CMS: content store, editorial management. Review their privacy policy.
• Google (Gmail): email correspondence when you send a business or privacy inquiry. Review their privacy policy.
• Vercel: website and audio hosting, private engagement storage, usage analytics, and performance monitoring. Review their privacy policy.

We do not sell or rent personal information to third parties. We do not share data with advertisers or data brokers.

5. Data Retention

We retain personal information only as long as necessary to fulfill the purpose for which it was collected:

• Engagement records: deduplication keys expire after 30 minutes. Reaction records expire after 180 days, with expired private keys removed when later count or reaction updates are processed. Reaction totals cover this rolling period. Aggregate visit and play totals are cumulative. The public service returns aggregate counts and the requesting browser’s own selected reactions.
• Browser preferences: the last selected track remains locally until you clear site data. The engagement browser identifier expires after 180 days and is replaced on a later visit.
• Newsletter subscribers: retained until unsubscribed or after 730 days of inactivity.
• Business inquiries: retained for 730 days for evaluation and follow-up, then deleted.
• Admin logs: retained for 90 days.
• Error/system logs: retained for 30 days.

You may request deletion of your information at any time using the contact information below.

6. Cookies and Tracking

The Platform uses cookies and similar technologies:

• Authentication cookies (Supabase): necessary to maintain secure admin sessions.
• Browser storage: the last selected track and random engagement identifier described above.
• Vercel Web Analytics: aggregate traffic measurement without third-party cookies. See Vercel’s analytics privacy documentation.

You can clear or block site storage through your browser settings. Listening remains available when local storage is blocked. See our Cookie Policy for details.

7. Your Privacy Rights

Depending on your location, you may have the right to:

• Access: request a copy of personal information held about you.
• Correction: request correction of inaccurate data.
• Deletion: request deletion of personal data (subject to legal retention obligations).
• Portability: request data in a structured, machine-readable format.
• Opt-out: opt out of marketing communications or analytics.

8. How to Exercise Your Rights

To request access, correction, deletion, portability, or to unsubscribe from newsletters:

We will respond to privacy requests within 30 days.

9. Security

We implement technical and organizational measures to protect personal information, including:

• encryption of data in transit (TLS/SSL),
• secure authentication (Supabase Auth),
• access controls and role-based permissions,
• regular security audits.

However, no security measure is 100% foolproof. We encourage strong passwords and do not store unnecessary sensitive data.

10. Children's Privacy

The Platform is not intended for individuals under 13 years old. We do not knowingly collect information from children. If we become aware of such collection, we will promptly delete the data.

11. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices or applicable law. Updated versions are effective upon posting. Material changes will be communicated via email to newsletter subscribers.

12. Contact Us

For privacy questions, requests, or concerns, contact: