CONSIDERED BY DESIGN

Privacy Policy

Draft for review · September 27, 2026. Operator: Mihail Potasnii, trading as Maven. Philadelphia, Pennsylvania, United States. [Business mailing address pending]. [Public business/privacy email pending]. Customer locations and retention schedule need confirmation before public launch. This document describes the inspected website code and distinguishes planned services from active preview features.

Who is responsible and how to reach us

Mihail Potasnii operates Maven as an independent website builder. These pages do not identify Maven as an LLC. For privacy questions, access, correction, or deletion requests, call 267-376-3859. Please do not put sensitive details in voicemail. [Public privacy email and business mailing address pending].

Information we collect and why

When you inquire, we collect your name, email, project details, and optional company name directly from you. The system records the submission time, a unique reference, and the notice version. We use these details to assess and respond to your project request, discuss services, and keep related correspondence. Please send only what we need to understand your project, without passwords, payment details, health information, or other sensitive data. An inquiry does not subscribe you to marketing.

We process technical information to serve and protect the website. The local preview temporarily holds connection IP addresses in memory for a 15-minute submission limit. The Cloudflare implementation stores a keyed IP hash for each 15-minute window in a separate rate-limit table, not a raw IP in the lead record. The scheduled worker removes expired rate records on its next run, configured every five minutes; that worker is deployed. Hosting providers may separately process connection details and operational logs.

Providers, storage, and sharing

On maven-system.com, Cloudflare Pages receives inquiries and Cloudflare D1 stores them in a database accessible through the operator’s authenticated account. There is no public lead list or download endpoint. A separate local development preview uses a private local database. When email alerts are enabled, Resend will send the name, email, optional company, message, time, and reference to the operator’s Gmail inbox; Google will store that email copy. The submitted email is used as Reply-To. Email alerts are prepared in code but are not yet enabled on this website.

These providers process information for hosting, storage, delivery, and account operations. Their production settings, processing locations, contractual roles, subprocessors, log retention, and any international-transfer safeguards remain to be confirmed. See Cloudflare, Resend, and Google for their own notices. Information may also be disclosed if required by law, with requests assessed under applicable law.

The inspected site has no analytics, advertising pixels, social embeds, payment, booking, or marketing-subscription integration. No sale-of-leads or cross-context advertising integration was found. This is a statement about the inspected implementation, not a verified claim about every future business activity or third-party account setting. Ordinary Instagram links send you to Instagram only when followed; its practices then apply.

Cookies and privacy choices

Fonts and media are served from this website. The application sets no HTTP cookies in the local preview. It stores a privacy preference in your browser when you make a choice; see the Cookie Policy and verified inventory. Optional analytics and advertising default to off. You can open Cookie Settings at any time and reject optional use. Global Privacy Control (GPC) prevents advertising consent in the site’s controls. No cross-site tracking is configured. Legacy Do Not Track does not separately change these controls; optional technologies already default to off.

Retention

[Retention schedule pending: set periods or clear criteria for unsuccessful inquiries, active client correspondence, delivery logs, inbox copies, and backups before public launch]. There is currently no automatic lead deletion. The operator can delete local database records using a private administration tool or production records through the authenticated D1 console. Database deletion does not remove inbox copies, provider logs, or backups; each must be addressed separately. Rate-limit records follow the shorter schedule described above. Browser preferences expire after 180 days and are removed when the site next reads an expired preference.

Security

The form validates input on the server, limits repeated requests, uses parameterized database statements, and checks the request origin. Private database files and credentials are excluded from public build files. These measures do not guarantee security or encrypt the local lead database. The public website uses HTTPS. Account access, multifactor authentication, backups, provider settings, and incident procedures still need ongoing operational review.

Your requests and applicable rights

Depending on your location and which laws apply, you may have rights to access, correct, delete, or obtain a copy of personal information, restrict or object to processing, withdraw consent, opt out of certain uses, appeal a decision, or complain to a regulator. This draft does not promise that every listed statutory right applies everywhere or limit rights you do have. Call the number above to submit a request; we may ask for proportionate information to verify identity or an authorized agent’s authority. Do not send identity documents unless a suitable process has been arranged. [Jurisdiction-specific rights, response deadlines, appeal channel, and regulator details pending review].

Audience and future changes

Services have been intended for US businesses; [current customer locations pending confirmation]. This site is not directed to children under 13. Please contact us if you believe a child submitted information so we can review and remove it as appropriate. If a future LLC assumes responsibility, this notice must identify it and the transfer must be reviewed, with notice or consent where required. It does not create permission for unrelated marketing. Changes will be posted with a revised date; material changes require appropriate notice before changed practices begin.