Privacy Policy

Crawford Designs, LLC is an Arizona limited liability company. We build websites, logos, and software for small organizations, including Consort™. We are the party responsible for the information described in this policy.

This policy applies to:

• this website, including the contact form
• the client dashboard where our customers manage their account and billing
• the administrative side of Consort that we operate for our customers

It does not cover a third-party site you reach by following a link from here. It also does not cover how one of our customers handles the information of their own members — read that section next, because the distinction matters.

We handle information in two quite different capacities, and your rights differ by which:

• Our own information. When you contact us, buy from us, or hold an account with us, we decide what to collect and why. This policy governs it, and you can exercise the rights below directly with us.
• Information we hold for a customer. When a chorus or quartet runs on our platform, the member records, music, photos, and financial records inside it belong to that organization. They decide what goes in and how it is used; we store and process it on their behalf under our Terms of Service. If you are a member of one of those groups and want your information changed or removed, ask your organization first — they control it. If you cannot reach them, ask us and we will pass it on.

When you use the contact form: your name, email address, the organization you name if you choose to give one, which service you are asking about, and your message. All of it is what you type; none of it is inferred.

When you hold an account with us: your name, email address, and any profile details you add, such as a phone number, a photograph, or a biography. Passwords are stored only as a cryptographic hash — nobody at Crawford Designs can read your password.

When you pay us: the invoice, what it was for, the amount, any sales tax charged on it, and whether it was paid. Card numbers go directly to our payment processor and never pass through our systems, so we cannot see or store them. At checkout our payment processor also collects your billing address, which it uses to work out the sales tax owed for your location.

When you contact support: the ticket, its messages, and anything you attach to it.

Automatically: ordinary server and security logs kept by our hosting provider, which include IP addresses and request details. Our forms are protected by a bot check that receives your IP address and a signal about the browser session in order to decide whether you are a person; it is not used to profile you or to follow you elsewhere.

• to answer your inquiry and to have the conversation you started
• to create and run your account, and to give you access to what you paid for
• to bill you, take payment, and keep the financial records the law requires
• to provide support and to fix faults
• to send you service messages such as password resets, invoices, renewal notices, and material changes to our terms
• to keep the service secure, to prevent abuse, and to meet our legal obligations

We do not send marketing email to people who have not asked for it, and there is no mailing list attached to the contact form.

This site sets no advertising cookies and runs no analytics or tracking product. There is nothing here that follows you to another website.

The cookies that do exist are the ones the site cannot work without:

• a session cookie that keeps you logged in to your dashboard, and expires when your session ends
• a short-lived cookie set by the bot check on our forms

Your preferences, such as dark mode, are stored against your account rather than tracked across sites.

We share information with the service providers we need to run the business, and only what each one needs to do its job:

Beyond that, we will disclose information where the law requires it, where it is necessary to establish or defend a legal claim, or to a successor if the business is ever sold — in which case this policy continues to apply to information already collected.

• we do not sell your personal information, and we never have
• we do not share it with advertisers or data brokers
• we do not use your content, or your members’ content, to train machine learning models
• we do not read customer files except where you ask us to in order to solve a problem

• Contact inquiries — kept while we are in conversation and for a reasonable period afterwards. Ask and we will delete an inquiry sooner.
• Account information — kept for as long as your account is open.
• Billing and tax records — kept for as long as tax and accounting law requires, which is longer than the account itself. This is an obligation we cannot waive on request.
• Uploaded files — kept while your account is open, and for 30 days after it closes so you can request an export. Deleted after that.
• Automated backups — kept on a rolling schedule of 30 days by default and then deleted automatically. A deletion you request takes effect in live systems immediately, and works its way out of backups as that window passes.
• Server and security logs — kept for a short period by our hosting provider under their own retention schedule.

• everything travels over encrypted connections, and stored data is encrypted at rest by our providers
• the database enforces access rules row by row, so an account can only reach the records it is entitled to
• private files are never publicly addressable — access is checked against a record that says you may have them, and granted through short-lived links
• administrative access is limited to the people who need it, and protected by individual accounts rather than a shared login
• backups run automatically so that data can be recovered

No system is perfectly secure, and we will not claim otherwise. If a breach ever affects your information, we will tell you promptly and tell you what actually happened.

Whatever jurisdiction you are in, you can ask us to:

• tell you what information we hold about you
• correct anything that is wrong — much of it you can edit yourself in your profile
• delete information we no longer need to keep
• give you a copy of your data in a portable form
• stop sending you a particular kind of message

Ask through the contact form and we will respond within 30 days. We may need to confirm your identity first, and we will say so if a legal retention obligation prevents us from deleting something.

Depending on where you live, you may have additional rights under laws such as the California Consumer Privacy Act or the General Data Protection Regulation. We honor these requests for everyone rather than checking your address first, so simply ask.

Our systems and our providers are based in the United States, so information is stored and processed there.

This website and our client dashboard are meant for adults, and we do not knowingly collect personal information from children under 13 through them.

Ensembles are a different matter — a chorus may well have young singers, and the platform holds whatever member records the organization enters. Those records belong to the organization, which is responsible for obtaining any parental consent required and for deciding what is appropriate to record about a minor. We hold that information on their behalf, and a parent or guardian should contact the organization directly. If you contact us instead, we will pass the request on.

We will update this page when what we do changes — a new provider, a new feature that collects something new. The date at the top always reflects the current version, and we will give notice by email or in your dashboard before a material change takes effect.

Privacy questions, requests, and complaints all go to the same place: the contact form, which reaches us directly. A real person reads it.

For formal legal correspondence, our registered agent and address of record are on file with the Arizona Corporation Commission's public business registry.