1. Information I Collect

Information you give me directly

When you reach out, sign up, or work with me, I may collect:

• Your name and email address (via the contact form or newsletter sign-up)

• Your message or project inquiry details

• Login credentials for the client portal

• Billing information for purchases or subscriptions — handled securely through third-party payment processors. I don't store your payment card details myself.

Information collected for social media management clients

For clients enrolled in my social media management service, I may also collect or have access to:

• Your social media account credentials or authorization tokens (connected through Sendible, the scheduling platform I use — I don't store these directly)

• Your social media handle(s), account names, and profile information

• Content you provide or approve for posting (captions, brand assets, preferences)

• Post performance data and analytics made available through your connected accounts

• Billing information for your monthly subscription, processed through Squarespace

This information is used solely to provide the social media management service you've engaged me for. It is not used for any other purpose, and it is not shared beyond the tools necessary to deliver that service.

Information collected automatically

When you visit the site, some data is collected automatically through cookies and analytics tools. This includes:

• Your IP address and general location (country or region)

• Browser type, device type, and operating system

• Pages visited, time spent, and how you arrived at the site

• Referring URLs (what site sent you here)

2. How I Use Your Information

The short version: to run my business well and be genuinely helpful to the people I work with. More specifically:

• To respond to your inquiry or project request

• To send the newsletter you opted into — and only that. I don't send unsolicited emails.

• To provide access to the client portal and manage active projects

• To deliver social media management services, including creating, scheduling, and publishing content on your behalf

• To process one-time payments and recurring subscription billing

• To understand how people use the site so I can make it better

• To comply with legal obligations if required

I will never sell your personal information to third parties. Full stop.

3. Cookies and Tracking Technologies

My site uses cookies — small text files stored on your device that help the site function and give me insight into how it's being used. Here's what's happening:

• Essential cookies: Required for the site to work (like keeping you logged into the client portal). These can't be disabled without opting out of the site itself.

• Analytics cookies: Used by tools like Squarespace Analytics and Google Analytics to track site performance and visitor behavior in aggregate. This data is anonymized.

• Marketing cookies: If I'm running ads on Instagram or Facebook, the Meta Pixel may be active. This helps me understand whether my ads are reaching the right people.

You can manage or disable cookies through your browser settings at any time. Disabling certain cookies may affect how parts of the site function.

If you're visiting from the EU, UK, or another region with cookie consent requirements, you'll be presented with a cookie consent notice before non-essential cookies are activated.

4. Third-Party Tools and Services

Running a small business means working with a few tools I trust. Here are the third-party services that may have access to data collected through this site:

• Squarespace — website hosting, built-in analytics, and payment and subscription processing

• Google Analytics — site traffic and visitor behavior

• Mailchimp (or a similar email platform) — newsletter list management

• Meta (Facebook / Instagram) — advertising and the Pixel, when active

• Stripe — secure payment processing for project invoices

• Coinbase Commerce — cryptocurrency payment processing, where applicable

• Sendible — social media scheduling and publishing platform used to manage content on behalf of social media management clients. Sendible connects to clients' social accounts via authorized integrations and has its own privacy policy governing how that data is handled.

Each of these services has its own privacy policy. I choose tools I trust, but I'd encourage you to review their individual policies if you have questions about how they handle data.

Note: I may add new tools or integrations in the future. When I do, this policy will be updated to reflect those changes.

5. Social Media Management Service

I offer a social media management subscription to a select group of existing clients. Here's how that service works from a privacy standpoint, so there are no surprises.

What's included

Subscribers receive monthly content creation (images, captions, and sourced stock photography) and post scheduling through Sendible. Clients are also provided their own Sendible login and can access the platform directly to schedule posts or review content independently.

Billing and subscription terms

The service is billed month-to-month through Squarespace on a yearly contract basis, with the option to cancel at any time. Billing records are retained as required by applicable accounting and tax law.

Your social media accounts

To schedule and publish content, your social accounts are connected to Sendible through platform-authorized integrations (OAuth or similar). This means Sendible — not I — holds the connection to your accounts. I can access and post to those accounts through Sendible for the duration of the service. When your subscription ends, I will disconnect your accounts from Sendible. You can also revoke access directly through each social platform's settings at any time.

Stock photography

Images sourced on your behalf are pulled from licensed platforms including Getty Images, Pexels, Unsplash, Adobe Stock, and similar services. Each platform has its own licensing terms; I use only images whose licenses permit commercial use for social media content. I don't sublicense or transfer stock image rights — they're used within the scope of the applicable platform license for the purpose of creating and publishing your social content.

Client-uploaded content

You may submit your own images and files for scheduling through the content submission form on this site. By submitting files through that form, you agree to the File Submission Terms & Conditions presented at the time of upload, which include the following:

• You represent and warrant that you are the legal owner of the submitted files or have obtained all necessary rights and permissions to share them

• You acknowledge that submitted content will be published to the internet and made publicly accessible — there is no expectation of privacy regarding these submissions

• You certify that the files contain no private, sensitive, or confidential information you do not wish to be viewed by the general public

• You grant Cavazos Creative a non-exclusive, royalty-free license to use, reproduce, and distribute the submitted materials for social media and marketing purposes

Uploaded files are retained only as long as needed to fulfill the scheduled posting and are not used for any other purpose beyond what's described in those terms.

Captions and created content

Captions and other written content created for your accounts are produced on your behalf and belong to you. I don't retain or repurpose your content after the service ends.

6. Data Retention

• Inquiries and contact form submissions: Retained while relevant to the conversation or project

• Newsletter subscribers: Kept until you unsubscribe — which you can do at any time via the link in any email

• Client portal and project data: Retained for the duration of the project relationship and a reasonable period after

• Subscription billing records: Retained as required by applicable tax and accounting law (typically 7 years)

• Social media management content and account data: Retained for the duration of the subscription and a reasonable period after. Social account connections are disconnected in Sendible upon cancellation.

• Client-uploaded files (content submission form): Retained only as long as needed to fulfill scheduled posting — not kept beyond the immediate purpose

• Analytics data: Governed by the retention settings of each tool (typically 14–26 months for Google Analytics)

7. Data Security

I take reasonable steps to protect your information from unauthorized access or disclosure. The site is hosted on Squarespace, which uses industry-standard security practices including SSL/TLS encryption. Payments are processed through PCI-DSS compliant processors — Squarespace Payments, Stripe, and Coinbase Commerce — meaning your financial information is handled at a security standard I couldn't replicate on my own, and wouldn't want to.

That said — no method of data transmission or storage is 100% secure. I can't guarantee absolute security, but I take it seriously.

8. Your Choices

‍ ‍

• Unsubscribe from the newsletter at any time using the link in any email

• Request access to the personal information I hold about you

• Request correction or deletion of your information by contacting me directly

• Opt out of Google Analytics via the Google Analytics Opt-Out Browser Add-On

• Manage cookie preferences through your browser settings

‍ ‍

To exercise any of these, just reach out. My contact info is at the bottom.

9. International Visitors

Cavazos Creative is based in the United States. If you're visiting from outside the US, your data may be transferred to and processed in the US, where privacy laws may differ from your own. The following section outlines additional rights that may apply to you depending on where you're located.

EU & UK — GDPR

If you're located in the European Union or the United Kingdom, the General Data Protection Regulation (GDPR) and UK GDPR give you specific rights over your personal data.

Lawful basis for processing. I process your personal data under the following legal bases:

• Contract performance: Processing necessary to fulfill a project or service you've engaged me for (client portal access, project work, subscription services)

• Consent: Newsletter sign-up, marketing cookies, and the Meta Pixel — you can withdraw consent at any time

• Legitimate interests: Site analytics and security monitoring, where those interests aren't overridden by your rights

• Legal obligation: Retaining billing records as required by law

Your rights under GDPR include:

• Right of access: Request a copy of the personal data I hold about you

• Right to rectification: Request correction of inaccurate or incomplete data

• Right to erasure: Request deletion of your personal data ("the right to be forgotten"), where applicable

• Right to restriction: Request that I limit how I use your data in certain circumstances

• Right to data portability: Request your data in a structured, commonly used, machine-readable format

• Right to object: Object to processing based on legitimate interests, including direct marketing

• Right to withdraw consent: Where processing is based on consent, withdraw it at any time — this won't affect the lawfulness of processing before withdrawal

International data transfers. Some of the third-party tools I use (including Google, Meta, Squarespace, Mailchimp, and Stripe) are US-based. When your data is transferred to the US, it is protected by standard contractual clauses (SCCs), adequacy decisions, or other approved transfer mechanisms under GDPR.

Right to lodge a complaint. If you believe your data has been handled unlawfully, you have the right to lodge a complaint with your local supervisory authority — in the EU, that's your national data protection authority; in the UK, that's the Information Commissioner's Office (ICO).

To exercise any of your GDPR rights, contact me directly using the information at the bottom of this page. I'll respond within 30 days.

California — CCPA / CPRA

If you're a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) give you the following rights:

• Right to know: Request disclosure of the categories and specific pieces of personal information I've collected about you

• Right to delete: Request deletion of your personal information, subject to certain exceptions

• Right to correct: Request correction of inaccurate personal information

• Right to opt out of sale or sharing: I do not sell or share your personal information for cross-context behavioral advertising. You do not need to opt out.

• Right to non-discrimination: I won't discriminate against you for exercising any of these rights

To make a request, contact me using the information below. I'll respond within 45 days as required by law.

Canada — CASL & PIPEDA

If you're located in Canada, I collect and use your personal information in accordance with Canada's Anti-Spam Legislation (CASL) and the Personal Information Protection and Electronic Documents Act (PIPEDA).

• I will only send you commercial electronic messages (like the newsletter) with your express or implied consent

• Every marketing email includes a clear and easy way to unsubscribe

• You have the right to access, correct, and withdraw consent for use of your personal information at any time

10. Children's Privacy

This site is not directed at children under the age of 13, and I do not knowingly collect personal information from anyone under 13. If you believe a child has submitted information through this site, please contact me and I'll take care of it promptly.

11. Changes to This Policy

If I update this policy — because I've added a new tool, changed how I work, or something in the law requires it — I'll update the effective date at the top. If it's a meaningful change, I'll note it visibly on the site. Your continued use of the site after any update means you're okay with the revised policy.

12. Contact

Questions about this policy? Just ask. I'm a real person and I'll actually read it.

‍ ‍

‍ ‍Cavazos Creative
Aubrey Cavazos
‍ ‍www.cavazoscreative.com
‍ ‍hello@cavazoscreative.com

I'm not a lawyer, and this policy is written in good faith to be honest and clear. If you have a specific legal concern, I'd encourage you to consult a legal professional.‍ ‍