Your information, in plain words

Last updated 16 October 2026

Gravel builds and runs websites for contractors. This page explains what we collect, why, who helps us run the service, and how to have your information removed. Questions? Text or call (757) 381-6172.

If you're a Gravel customer

Your account: your name, email address and password. We never store the password itself, only a one-way scrambled version (a salted hash) that can't be turned back into it. If you sign in with Google, we store your Google account's ID and email. If you turn on two-step sign-in, its secret is stored encrypted.
Your business: the business name, phone number, town and trade you give us, plus the words and photos for your website. We use them to build, run and improve your website and Google profile.
Payments: handled by Stripe. We keep your plan, its status and Stripe's reference numbers. We never see or store your card number.
Keeping your account safe: when you sign in, we record the time, your IP address, your browser type and the rough country it's in. We use these to keep you signed in, to spot sign-ins that aren't you, and to email you about new sign-ins.

If you filled in a form on a website we run

Many of our customers' websites have a contact form. When you send one, we pass what you wrote (your name, phone, email and message) to that business by email and in their dashboard, so they can get back to you. That business decides how to use it. We keep a scrambled version of your IP address (not the address itself) to stop spam. Forms that look automated are kept for the business to check for 30 days, then deleted.

Those websites count visits, phone-number taps and form sends as daily totals. They set no tracking cookies and don't follow you from site to site.

Cookies

Signing in to your Gravel dashboard sets one cookie that keeps you signed in. We don't use advertising or tracking cookies. Our sign-in pages use Cloudflare Turnstile, a privacy-friendly check that you're a person, and gravel.site counts visits with Cloudflare Web Analytics, which sets no cookies.

Who helps us run Gravel

We share information only with the companies that run parts of the service for us, and only what each needs:

Cloudflare: hosting, the database, file storage and bot protection.
Resend: delivering our emails (sign-in links, new-lead alerts).
Stripe: payments.
Google: web fonts on our pages, and sign-in if you choose "Continue with Google".

We don't sell your information or share it for advertising. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes.

How long we keep it

We keep your account and website information while you're a customer. After you cancel, text us and we'll delete it, except what we must keep for tax and accounting records. Unfinished sign-ups (where the email was never confirmed) are deleted automatically. We keep backup copies of our database to recover from mistakes; deleted information can stay in those backups for up to 35 days before they're replaced.

Your choices

You can ask to see, correct or delete the information we hold about you. Text or call (757) 381-6172 and we'll take care of it, usually within a few days. Gravel isn't meant for children under 16.

Changes

If we change this policy, we'll update it here and change the date at the top. If a change matters for how we use your information, we'll email customers before it takes effect.