Privacy policy

Cusano Ventures respects your privacy. This page explains what information we collect through this website and client portal, why we collect it, and how it is handled.

We do not sell personal information.

When you submit the contact form, we collect the details you provide, such as your name, email address, company, website, project needs, service interest, timeline, budget range, and optional message.

We use this information to respond to your inquiry, understand your project needs, and follow up with relevant next steps. Submissions are delivered through our contact API to a Google Apps Script workflow configured for lead handling. A copy may also be sent to HubSpot when that integration is enabled.

The contact form includes basic anti-spam checks, including a hidden honeypot field and a minimum time before submission.

When you are invited to the client portal, account and profile information is stored in Supabase, including authentication credentials managed by Supabase Auth and profile data linked to your organization membership.

Portal data can include organization details, project records, tickets, files, approvals, actions, notifications, and activity related to your engagement.

Access is controlled by authentication, organization membership, and row-level security policies in Supabase.

When billing is enabled for your organization, invoice and payment activity is processed through Stripe. Payment card details are handled by Stripe; Cusano Ventures does not store full card numbers on its own servers.

Billing records, invoice status, and payment reconciliation data are stored in Supabase and linked to your organization where applicable.

Files uploaded through the client or admin portal are stored in Supabase Storage in a private bucket. File metadata is stored in the portal database and access is limited by organization membership and visibility settings.

We use trusted providers to operate the website and client services, including:

• Vercel — website hosting, deployment, and application logs
• Supabase — authentication, database, storage, and portal infrastructure
• Stripe — payment processing for client billing
• Google Apps Script — contact inquiry delivery workflow
• HubSpot — optional CRM intake for contact inquiries and discovery-call booking links

The Marketing Command Center can optionally connect a Facebook Page so that content an administrator approves can be published to that Page. This integration is off by default and is only active if an administrator explicitly connects a Page.

When a Facebook Page is connected, we use the Meta (Facebook) Graph API and store encrypted provider access tokens (never in plaintext), the selected Page identity and safe connection metadata, requested permission (scope) metadata, and connection audit events. Access tokens are never shown in the interface and never included in logs.

You can disconnect at any time and request deletion of this integration data. See the Data deletion page, linked in the site footer, for how to disconnect, revoke access at Meta, and request deletion.

The public marketing site does not use third-party advertising or analytics cookies based on the current application code.

When you sign in to the client or admin portal, Supabase authentication uses session cookies or local storage tokens needed to keep you signed in and protect authenticated routes.

The public website does not currently use third-party advertising or cross-site behavioral tracking. Because the website does not engage in that type of tracking, it does not respond differently to browser Do Not Track signals.

Third-party services that you choose to visit through external links may collect information under their own privacy policies. If Cusano Ventures changes its tracking practices, this policy will be updated.

We retain inquiry information for as long as needed to respond, evaluate fit, and maintain ordinary business records.

Portal, billing, and project records are retained for the duration of the client relationship and as needed for operational, billing, and audit purposes.

Administrators may archive portal accounts or remove organization memberships according to internal account-lifecycle procedures documented in the application.

You may contact us to request access to or correction of information you submitted through the website or information associated with your client portal account. We may need to verify your identity before responding to a request.

You may also choose not to submit the public contact form. Do not submit sensitive personal information through the form unless it is necessary to describe your project needs.

We may update this policy when our services, providers, or information practices change. When material changes are made, we will update the effective date shown at the top of this page. When appropriate, we may also provide additional notice through the website, client portal, or email.