Privacy policy

Last updated November 9, 2026

This policy covers ribboninteractive.com, run by Ribbon Interactive, an independent web design studio in the Kansas City area. It describes what the website actually does today. Questions go to hello@ribboninteractive.com.

Contact form

When you send the contact form we collect your name, business name, email address, message, and (if you add them) your phone number and current website. The form is emailed to hello@ribboninteractive.com so we can reply. It is not saved in a database on this site. To limit repeat submissions, the server keeps a small temporary file, named with a one-way hash of your IP address, that allows one message every 30 seconds. We use what you send only to respond to you and work on your project. We do not sell it or share it for marketing.

Client portal

Clients sign in at /portal/ with their email address only. There is no password. We email a single-use sign-in link that expires after 20 minutes. Only an email address linked to a client billing account can sign in. The portal stores the following in our own database at our web host:

• Sign-in links: a one-way hash of the link (never the link itself), your email address, your billing customer ID, the IP address the request came from, and when it was created, expired and used. These records are deleted automatically about a day after they expire.
• Session: while you are signed in we keep a session record with your billing customer ID, email address, sign-in time and a security token used to protect forms. It is deleted when you sign out or after 30 days without activity.
• Abuse limits: to stop repeated sign-in or plan requests we store a one-way hash of your email address, IP address or customer ID with a timestamp. These records are deleted after 24 hours.
• Billing status cache: when our payment processor notifies us of a change, we store the event ID and type, plus your subscription ID, customer ID, plan, subscription status, current period end date and whether the latest invoice was paid. The dashboard itself always reads your current details from the payment processor. We currently keep these records while we provide services to you, and we will delete them on request.

The dashboard shows your name, email address, plan, status, next billing date and amount, and your recent invoices.

Payments

Payments, invoices and subscriptions are handled by Stripe. Card details are entered only in fields provided by Stripe: the secure payment form on our invoice payment page (Stripe.js), Stripe Checkout and Stripe’s billing portal. Card numbers never pass through or get stored on our servers. If you choose to save a card, Stripe stores it for future payments. Stripe holds your billing record: your name, email address, business name, billing address if you add one, plans, invoices and payment history. Our server asks Stripe for this information to show your dashboard. Stripe’s use of your information is covered by its own privacy policy.

Emails

Sign-in emails and contact form messages are sent through our web host’s mail service. Like most mail systems, it keeps a log of messages sent, including the recipient address and subject. Our business mailbox is provided by our email provider, Dynadot. Our own error logs record only a one-way hash of an email address, never sign-in links.

Cookies and third parties

• Portal session cookie (ri_portal): set only on /portal/ pages. It keeps you signed in and lasts up to 30 days. It is required for the portal to work and is not used for tracking.
• Stripe: the invoice payment page loads Stripe.js, and Stripe’s own checkout and billing pages may set cookies. Stripe uses these for fraud prevention and to make payments work. See Stripe’s cookie policy.
• Google Fonts: our pages load fonts from Google Fonts, so your browser sends your IP address and browser details to Google when it fetches them. See Google’s privacy policy.

We do not use analytics, advertising or social media tracking on this site.

Hosting and security

The site and portal database are hosted by Hostinger, which keeps standard server logs (such as IP addresses, pages requested and times) for security and reliability. The site is served over HTTPS only. The portal uses single-use expiring sign-in links, secure HTTP-only cookies, protection against forged form submissions, request rate limits and parameterized database queries. Private configuration is blocked from web access. No system is perfectly secure, but we work to keep the information we hold to a minimum.

Your choices and requests

You can ask us what information we hold about you, or ask us to correct or delete it, by emailing hello@ribboninteractive.com. Some billing records may need to be kept for accounting or tax purposes. You can update your billing details or cancel a plan at any time from Manage billing in the client portal.

Changes

If the site’s handling of information changes, we will update this page and the date at the top.