Privacy Policy

This Privacy Policy explains how HEB 11:1 LLC DBA Pistevo (“Pistevo,” “we,” “us,” or “our”) collects, uses, and protects personal information when you visit our website, contact us, or use our client dashboard and services. By using our website or services, you agree to the practices described here.

1. Information We Collect

We collect the following categories of personal information:

• Contact and inquiry data. When you submit our contact form we collect your name, email address, phone number, the type of help you’re interested in, and any message you provide. If you agree to be contacted, we also record that consent, including the exact wording you were shown, the date, and your IP address, so we can honor your choice and demonstrate it if asked.
• Account data. If you are a client, we hold the account credentials and profile information needed to give you access to your dashboard, including a hashed password and session identifiers.
• Service data. Information generated while we deliver services to you, such as site and uptime metrics, support tickets, invoices, subscriptions, and service logs.
• Technical data. Limited information collected automatically, such as IP address and basic request metadata, used for security, rate limiting, and aggregate analytics.

2. How We Use Information

• To respond to inquiries and provide quotes.
• To contact you about your inquiry by email, text message, or phone call, where you have agreed to it.
• To deliver, maintain, and support the services you engage us for.
• To authenticate users, secure accounts, and prevent abuse.
• To send service-related communications, invoices, and reports.
• To comply with legal obligations and enforce our agreements.

When you submit our contact form we ask for your agreement before contacting you, and you can change your mind at any time. You can unsubscribe from email using the link in any message, reply STOP to opt out of text messages, or tell us on a call that you would rather we did not call again. Withdrawing consent does not affect contact you have already received or any service we are already providing to you.

We do not sell your personal information, and we do not use it for third-party advertising.

3. Cookies and Analytics

We use a small number of strictly necessary, first-party cookies to keep you signed in and to protect against cross-site request forgery. These are required for the dashboard to function and cannot be switched off through our site. We use privacy-focused, cookieless analytics to understand aggregate traffic; this does not track you across other websites.

4. Service Providers

We share personal information only with vendors who process it on our behalf to operate the business, under contractual confidentiality and data-protection obligations. These include providers for hosting and database services, content delivery and analytics, transactional email, and payment processing. Payment card details are handled directly by our payment processor; we do not store full card numbers.

5. Data We Process on Behalf of Clients

When we operate or monitor a client’s website, we may process analytics and operational data relating to that client’s own visitors. For this data the client is the controller and Pistevo acts as a processor, handling the data only to provide the agreed services and in accordance with our agreement with that client.

6. Google User Data (Pistevo Booking)

Pistevo Booking lets a client optionally connect their Google Calendar so that online booking never double-books them. Connecting is entirely optional, and bookings work without it. When a client connects their calendar, we request two permissions and use them only as described here:

• See your calendars (calendar.readonly). We read free/busy times only across the calendars on the connected account, so a slot the client is already occupied for is never offered for booking. We do not read event titles, descriptions, guests, attachments, or locations.
• Manage events (calendar.events). When a booking is confirmed we create the corresponding event on the connected calendar, and we remove that event if the booking is cancelled. We do not modify or delete events we did not create.

We store an encrypted Google refresh token so the connection keeps working, together with the busy times and events needed to operate booking. We do not sell, rent, or share Google user data, use it for advertising or any form of personalized advertising, use it to train generalized artificial-intelligence or machine-learning models, or transfer it to others except as needed to provide the booking feature, comply with law, or as part of a merger or acquisition with notice to affected users. Human access to Google user data is limited to what is necessary to provide support at the client’s request, to comply with law, or to address a security issue.

Pistevo’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

A client may disconnect Google Calendar at any time from their Pistevo Booking settings, or revoke access directly at myaccount.google.com/permissions. Disconnecting deletes the stored credential and revokes the token with Google. Any calendar events already created for confirmed bookings remain on the client’s own calendar, under their control.

7. Data Retention

We retain personal information for as long as needed to fulfill the purposes described in this policy, to provide ongoing services, and to meet legal, tax, and accounting requirements. Inquiry data from non-clients is kept only as long as needed to follow up.

8. Security

We use technical and organizational safeguards to protect personal information, including encrypted transport, hashed passwords, scoped access controls, account lockout, and rate limiting. No method of transmission or storage is completely secure, but we work to protect your information and to limit access to those who need it.

9. Your Rights

Depending on where you live, you may have rights to access, correct, delete, or obtain a copy of your personal information, and to object to or restrict certain processing. Residents of California and other U.S. states with privacy laws may have rights to know what information we collect and to request deletion. We do not sell or share personal information for cross-context behavioral advertising. To exercise any right, contact us using the details below; we will verify and respond as required by applicable law, and we will not discriminate against you for exercising your rights.

10. Children’s Privacy

Our website and services are intended for businesses and are not directed to children under 16. We do not knowingly collect personal information from children.

11. International Visitors

We operate in the United States, and information we collect is processed there. If you access our services from outside the United States, you understand that your information may be transferred to and processed in the United States.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above. Material changes will be communicated where appropriate.

13. Contact Us

For privacy questions or requests, contact HEB 11:1 LLC DBA Pistevo at hello@pistevo.io.