Privacy Policy
We keep this short and honest, the way we keep everything else. Here’s exactly what we collect, why, who touches it, and how to make us delete it.
Last updated August 21, 2026
Who we are
Deadpan Labs LLC is an ecommerce growth agency based in Miami, Florida. This policy covers deadpanlabs.com. We are the data controller for the information described below. For anything privacy-related — a question, a request, a complaint — email contact@deadpanlabs.com.
What we collect and why
We only collect what you hand us. There are no tracking cookies, no ad pixels, no hidden profiling. Four things touch our systems:
| Source | Data | Why |
|---|---|---|
| Contact form | Name, email, message | To read what you sent and reply to you. |
| Project inquiry | Name, email, company, services, stage, budget, timeline, project idea | To understand the work you're describing and scope a response. |
| Newsletter | Email address | To send occasional notes about what we're building, only after you confirm. |
| Free AI visibility check | Brand name, website, category, a buyer question, email, company | To run the check on your brand and email you the scorecard. Handled like any other inquiry — marketing email only if you tick the opt-in. |
| Marketing opt-in (checkbox on our forms) | Email address, the fact that you ticked the box, and which form it was on | Only if you tick it — and even then we email you marketing only after you confirm via the same double opt-in as the newsletter. The form works fine without it. |
| Analytics | Cookieless page-view events — no IP, no user-agent, no identifier | To see which pages get read, in aggregate. Nothing ties back to a person. |
The legal basis, in plain terms
If you’re in the EU or UK, GDPR asks us to name a lawful basis for each thing we do:
- Contact & project inquiries: legitimate interest (Art. 6(1)(f)) — you reached out about working together, so we handle your message to respond.
- Newsletter & marketing email: consent (Art. 6(1)(a)) — you opt in (the marketing checkbox on our forms is never pre-ticked and never required), you confirm by email, and you can pull that consent at any time by unsubscribing.
- Analytics: legitimate interest in aggregate, cookieless measurement that can’t identify you.
Who else touches your data
We use a small set of trusted service providers to run the site. They process data only to provide their service to us, never for their own purposes:
- Supabase
- Database that stores form submissions and newsletter emails.
- Resend
- Delivers the transactional email that reaches our inbox, relayed through our own Conduit infrastructure.
- Vercel
- Hosts the site and provides cookieless, privacy-first analytics.
- Google Workspace
- Runs the contact@deadpanlabs.com inbox where messages land.
- Cloudflare
- Turnstile bot protection on our forms — privacy-preserving, no tracking cookies.
We don’t sell your data, and we don’t share it with anyone outside this list. The five above are the ones that touch deadpanlabs.com; the complete inventory across our platform — what each vendor can see and what it publishes about its own security — is at /subprocessors.
How long we keep it
We don’t hoard. Each type of data has a fixed lifespan:
- Contact & project inquiries (leads)
- 24 months, then deleted.
- Unconfirmed newsletter signups
- 30 days, then deleted.
- Confirmed newsletter subscribers
- Until you unsubscribe.
- Cookieless analytics events
- 14 months, then deleted.
Your rights
Whether GDPR or California’s CCPA/CPRA applies to you, you have the same practical rights over your data:
- Access — get a copy of what we hold about you.
- Correction — fix anything that's wrong.
- Deletion — have it erased.
- Portability — receive it in a portable format.
- Objection — tell us to stop processing it.
To exercise any of them, email contact@deadpanlabs.com and we’ll take care of it. We don’t sell or share your personal information for advertising, so there’s nothing to opt out of on that front — and we honor Global Privacy Control signals from your browser as a valid opt-out request.
Cookies & analytics
This site is essentially cookieless. Our analytics (Vercel Analytics) measures page views without cookies and without collecting your IP address, user-agent, or any identifier — so there’s no consent banner because there’s nothing to consent to. The bot protection on our forms (Cloudflare Turnstile) is privacy-preserving and doesn’t track you across the web.
How we keep it safe
The public site is capture-only: it can write your form submission into the database, but it can’t read anyone’s data back out. There’s no master key on the front end, and every write goes through a locked-down path that can only append — never browse, export, or delete. We store no IP address at all: the schema reserves a column for a salted, one-way hash and the site deliberately never fills it, so there is nothing to leak and nothing to hash back (verified in lib/supabase/capture.ts). In short: the door only opens one way, and it only opens a crack.
Changes to this policy
If we change what we collect or how we handle it, we’ll update this page and move the date at the top. Material changes get a clear heads-up.
Questions about your data?
A real person reads every message. Ask us anything, or tell us to delete what we have.
Get in touch →