PRIVACY, IN PLAIN LANGUAGE

Your Page Privacy Policy

Updated October 11, 2026.

Who we are

Your Page, operated by RDJ Sacramento. Privacy questions can be sent by mail to 8880 Elder Creek Rd, Suite 195, Sacramento, CA 95828, or discussed by phone at (916) 533-6375.

Your account and customer workspace

When you create an account, we use your name and email address to keep your website brief with the correct customer profile. Your password is stored as a salted, one-way hash, not as readable text. We use a secure session cookie to keep you signed in and let you return to saved work. Your password is never included in your brief or sent to HubSpot.

Account emails

When automatic account email is enabled, Resend processes the email address and delivery details needed to send confirmation, password reset, and welcome messages. Confirmation links expire after 24 hours. Password reset links expire after 30 minutes. Both can be used only once. Your Page stores protected token hashes rather than usable copies of those links. We also store whether the current welcome package was opened or emailed so we can give you a consistent onboarding experience without sending duplicates.

Engineer collaboration and optional AI writing help

Invited engineers can access only their assigned workspace. We store project notes, change requests, decisions and revision history so the team can review work and resolve conflicting edits. Owner review is required before a change request is approved. An email alert contains a private review link, not the request text. If a carrier-email alert copy is configured, the carrier processes that same notification.

Engineers may upload permitted project images and save their placement, descriptions and layout in private drafts. Cloudflare object storage holds the images, and our database holds their project references and revision history. Access requires current project membership. Embedded camera and location metadata is removed, but visible private information in a photograph is not automatically detected. Images are not sent to the AI helper, analytics, CRM or email. Uploading or saving a preview does not publish it. Images remain in the project library until an authorized removal is arranged, including a review of saved references and history.

When the optional AI helper is connected and you confirm its use, OpenAI receives the title and request text you choose to send, plus writing instructions. It is not given account credentials, CRM records, invoices or automatic access to project documents. Do not include customer records, personal contact details or secrets. Checks for common sensitive patterns are not a complete redaction service. You review a suggestion before choosing to use it, and can send a request without AI.

The helper requests no stored API response, but that does not mean zero provider retention. OpenAI may retain abuse-monitoring records under its service controls. We have not verified a Zero Data Retention arrangement. See OpenAI’s API data controls.

Website briefs and customer records

Your Page stores saved brief answers so you can return to them. Drafts stay in your customer workspace and are not sent to HubSpot. When you submit the finished brief, we send your basic contact details and project answers to HubSpot, our customer relationship system, so we can organize the request and follow up. We do not send your account password or password hash to HubSpot. Do not include passwords, card details, health information, or other sensitive information in a brief.

We keep customer records for as long as reasonably needed to discuss the project, provide requested services, maintain business records, or meet legal obligations. You can ask us to correct or delete your information by using the contact details below.

Email and phone calls

If you contact us, we use the information you provide to answer your request, prepare an estimate, or provide a service you ask us to perform. Your phone carrier, email provider, and ours may process that communication.

Appointments and payments

Scheduling loads Cal.com only when you choose to open it. Your name, email, time zone, meeting details and any optional notes you enter are processed by Cal.com and the connected calendar to arrange the call and send confirmations. Do not enter passwords, payment details or sensitive personal information. Our booking page does not load YourPage analytics or advertising tags, and we do not automatically copy booking answers into HubSpot.

Cal.com keeps booking records while the account is active under its privacy policy and service terms. Calendar and email copies have their own provider retention. Contact us below for access, correction or deletion requests. Canceling a call does not automatically delete every copy.

Approved project deposits and balances are handled by Stripe through a customer-specific invoice. Your Page does not collect or store your complete card number on this website. When connected, the signed-in portal displays your invoice amounts and payment status from Stripe. Selecting an invoice opens Stripe’s payment page, where you review and authorize payment. Creating a portal account does not authorize a charge.

Site operation

Our hosting provider may process IP address, device, security, and request-log information needed to deliver and protect this website. Your Page uses optional analytics and advertising tracking only with your permission, as described below.

Data protection and security

This website uses HTTPS. Account changes are checked on the server, and customer records are scoped to the signed-in account. Engineer access is checked against assigned project membership and role. Authentication cookies expire and are not readable by page scripts. Server credentials are not included in public code. We avoid logging request text, passwords and payment details in application error logs. Project revision history can still contain the notes and identity needed to show who changed work.

Our development standard requires minimal collection, least-privilege access, client separation, appropriate encryption, reviewed providers and documented retention rules before a new data-handling feature launches. This is not a claim that every provider’s storage, backups or security certification has been independently verified. No online service can promise absolute security. Do not upload identity documents, health records or regulated customer records unless a separate approved workflow has been agreed in writing.

Business-card attribution

When someone scans a Your Page business-card QR code, we set a secure, first-party cookie for up to 60 days. It lets us count the redirect, confirm the landing, and connect a later brief account or submitted brief to that card campaign. This record does not store the visitor’s IP address, full browser description, precise location, or fingerprint. Automated previews and scanners may still be counted separately from likely human visits.

Optional analytics

If you enable Analytics in Cookie settings, Google Analytics and HubSpot may use cookies and page-view information to help us understand which public pages are useful. These scripts do not load before you agree. If you choose “Reject optional,” optional analytics stay off. Your choices are saved in your browser. Submitted website briefs are still sent to HubSpot as described above so our team can follow up.

With Analytics enabled, we keep the first consented public page and latest public page, their timestamps, and approved campaign labels in this browser tab. We keep only the referring website’s hostname, not its page or query. This optional record is cleared when you withdraw Analytics permission and expires after 30 days. If you submit a brief, the consent-approved snapshot is saved with that inquiry and included in its HubSpot note and follow-up task. It is not proof of an earlier visit or a complete customer journey. Private portal URLs and form answers are never captured in this campaign record.

Google Analytics measures visits and selected contact-button clicks on our homepage, pricing guide and blog. We remove URL query strings and fragments, use only the referring website’s origin, and do not send names, email addresses, phone numbers, brief answers, account details or payment information to Google Analytics. It does not load on forms, sign-in, customer-workspace or demonstration pages. Google advertising personalization and Google signals are disabled. Google handles this information under its privacy policy.

Optional TikTok advertising tracking

If you enable Advertising in Cookie settings, the TikTok Pixel loads on our homepage, pricing guide, website redesign page and public blog. It shares page visits, referral and campaign information, device and browser information, IP address, and cookie identifiers with TikTok to measure our ads and support personalized advertising. TikTok advertising cookies can remain for up to 13 months after they are set or last used. TikTok handles information under its own privacy policy.

Advertising measurement can qualify as “sharing” for cross-context behavioral advertising under some privacy laws, even when no money changes hands. Consent alone does not establish that a provider’s reuse of information meets our no-data-sale policy. We are reviewing these settings and provider terms against that policy. We do not claim that this site currently has no legally defined advertising sharing. You can keep Advertising off and still use our services.

If you allow Advertising tracking, a confirmed brief submission may be reported to TikTok as a lead conversion. We do not send brief answers, account passwords, email addresses, or payment details with that event. The Pixel itself does not load on sign-in, account, password-reset, customer-workspace, or demonstration pages. A previous approval for analytics alone does not enable TikTok. Your browser’s Global Privacy Control keeps advertising tracking off.

Use Cookie settings at the bottom of any page to review or withdraw your choices. Withdrawing permission stops future optional tracking on this site; it does not erase information a provider has already received. You can also clear cookies in your browser. Rejecting optional tracking does not prevent you from submitting a brief or using your account.

Your choices, retention and requests

Ask us to access, correct or delete your information, or ask which providers receive it, using the contact details below. We verify that a request comes from the person entitled to the information before releasing records or changing an account. Do not send identification documents with an initial request. We will explain any records that must be kept for an active service, security, payment dispute or legal obligation, and any limits on deleting provider backups.

Record retention is assessed by purpose and obligation, not one universal deadline. Expired sessions and email links do not by themselves delete underlying business records. There is no automatic customer-record deletion feature on this site. Provider-held records may require a separate request. Applicable rights and response periods depend on the law and your circumstances. We do not claim certified regulatory compliance.

We update this page when our practices change and show the date above. A policy update does not grant new permission for optional tracking. The website brief and accounts are for business owners and authorized collaborators, not directed at children under 13.

Contact