Skip to content

Privacy Policy

Last updated: September 12, 2026

Paper Moon LLC (“Paper Moon,” “we,” “us”) is a Michigan limited liability company. This policy explains what we collect when you visit paper-moon.co or get in touch with us, why we collect it, and what you can ask us to do about it.

Short version: we collect very little, we don't sell anything, and we don't track you across the internet.

What we collect

When you use the contact form or email us

We collect the name, email address, and message you choose to give us. That's it. There are no hidden fields and nothing is required beyond what's on the form.

We use this only to respond to you and, if we end up working together, to manage the engagement.

Automatically, when you visit the site

Our site is served through Cloudflare, which processes limited technical data on our behalf: IP address, browser and device type, referring page, and request timestamps. This is standard web infrastructure logging, used to serve the site, block abuse, and keep things running. We don't use it to build a profile of you.

We use Cloudflare Web Analytics to understand how the site is used — page views, referrers, and general performance, reported in aggregate. It does not use cookies, does not fingerprint your device, and does not track you across other sites. We cannot identify individual visitors from it.

We also record anonymous engagement counts on our own infrastructure — which page was viewed, which links were clicked, and how long a page was open. These are stored as aggregate counts with no cookies and no identifiers, and cannot be tied back to you.

Cookies

We do not use advertising cookies, tracking pixels, or cross-site trackers. Cloudflare may set a strictly necessary cookie for security and bot protection.

Client data during engagements

If we work together, we will often have access to your systems, codebases, and the data inside them. That access is governed by the contract between us — our MSA, statement of work, and any data processing agreement or BAA we sign — not by this policy.

In those engagements we act as a processor on your behalf. We access the minimum necessary to do the work, and we return or delete client data at the end of an engagement on request.

Why we process this information

  • To respond to inquiries. Legitimate interest, and your voluntary submission.
  • To deliver services under a contract. Performance of a contract.
  • To keep the site secure and available. Legitimate interest.
  • To meet legal, tax, and accounting obligations. Legal obligation.

How long we keep it

We keep inquiries and related correspondence for up to 24 months, then delete them, unless the inquiry became a client relationship. Records tied to an engagement are kept as long as the contract and our tax and accounting obligations require.

You can ask us to delete your inquiry sooner, and we will.

Who we share it with

We do not sell personal information, and we do not share it for advertising. We use a small number of service providers who process data on our behalf:

  • Cloudflare — hosting, CDN, security, and web analytics
  • Web3Forms — contact form delivery
  • Google Workspace — email and document storage

We may also disclose information where we're legally required to, or to protect our rights or the safety of others.

Where your data goes

Paper Moon operates from the United States, and our service providers store data on US-based infrastructure. If you're contacting us from outside the US, your information will be transferred to and processed in the US. Where required, we rely on Standard Contractual Clauses with our providers.

Your rights

Depending on where you live, you may have the right to:

  • Ask what personal information we hold about you
  • Ask us to correct it
  • Ask us to delete it
  • Ask for a copy in a portable format
  • Object to or restrict how we use it
  • Withdraw consent at any time

If you're in the EU or UK: these rights come from the GDPR, and you also have the right to lodge a complaint with your local supervisory authority.

If you're in California: the CCPA and CPRA give you rights of access, deletion, correction, and the right to opt out of sale or sharing. We do not sell or share personal information as those terms are defined, and we will never discriminate against you for exercising these rights.

To exercise any of these, email hello@paper-moon.co. We'll respond within 30 days. We may need to verify your identity first, which usually means replying from the email address in question.

Security

We use encrypted connections (TLS) across the site, multi-factor authentication on our accounts, least-privilege access to client systems, and encrypted storage for company devices and files. No system is perfectly secure, but we take this seriously — it's the same standard we hold our clients' systems to.

Children

This site is intended for business use. We don't knowingly collect information from anyone under 16. If you believe a child has given us information, email us and we'll delete it.

Do Not Track

We don't track you across sites, so there's nothing for a Do Not Track signal to turn off. We honor Global Privacy Control signals where they apply.

Changes to this policy

If we change this policy, we'll update the date at the top. For anything significant, we'll note the change on this page rather than quietly swapping the text.

Contact

Paper Moon LLC
Email: hello@paper-moon.co

Questions about this policy, or about how we handle data in a specific engagement, are welcome — we'd rather answer them up front.