Privacy Policy

1. Who we are

This site is operated by Heredia Labs LLC, run by Michael Heredia. Contact: info@michaelheredia.com. This policy covers michaelheredia.com, the client portal, and the apps I build and run for client organizations (see "If you use an app I run for your organization" below). It also covers any project messages you send me directly.

2. What I collect

If you just visit the site

• Analytics: pageviews, the URL you came from, the country your IP resolves to, browser type, device type, and which buttons you click. Collected via Google Analytics 4 and Meta Pixel.
• UTM / click-id parameters: if you arrive from an ad or campaign, the utm_source / utm_medium / utm_campaign / utm_term / utm_content / fbclid / gclid query parameters are stored in your browser's localStorage for up to 30 days so I can connect a purchase back to the campaign that drove it.
• Cloudflare logs: standard web-server logs (IP address, request time, URL, user agent) for security and performance, retained per Cloudflare's default policy.

If you submit the contact form or email me

• Your name (optional), email address, and the contents of your message.
• The same UTM parameters from above, attached so I know which campaign you came from.
• This gets delivered to info@michaelheredia.com via Cloudflare's email service and routed to my personal inbox.

If you book a call via Calendly

• Your name, email, and chosen time slot are collected by Calendly directly.
• I receive that info as a calendar invite. Calendly's privacy policy applies to the data they hold on their side.

If you pay online (PayPal)

• Card and PayPal payments, including hosting subscriptions and payments in the client portal, are handled by PayPal. Your name, email, billing address and card or PayPal details are collected by PayPal directly. I receive your name, email, the amount and what you bought — never your card number or full billing details.
• PayPal's privacy statement governs the payment data on their side.

If you pay by invoice

• Invoices are sent and paid through Mercury, my business bank. Mercury receives your name, email and the payment details your bank sends with the transfer.

If you use the client portal

• I store your name, email, project plan/status, optional server IPv4, and the chat messages you send in the portal.
• Login is passwordless: I email a one-time link to the address already on file. A visitor cannot create an account from the login page.
• An httpOnly session cookie (mh_client_session) keeps you signed in. A companion mh_client_csrf cookie is used to protect form posts.
• Portal chat is the project channel. I do not treat those messages as marketing mail.

If you use an app I run for your organization

Some clients have me build and host an internal app for their team. One example is the Command Center for the Law Office of Kristopher A. Alvarez. In these apps the organization decides what goes in. I store and process it only to run the app for them.

• Staff accounts: name, work email, role, and sign-in records.
• Client records the organization enters: names, contact details, case or matter notes, documents, tasks, and call or chat records.
• Immigration case status: USCIS receipt numbers that staff type in, and the case status USCIS returns for them. The app sends USCIS only the receipt number, through the official USCIS Case Status API. It checks each receipt at most once a day.
• I don't collect location data, health or medical data, biometric data, or anyone's phone contacts in these apps.
• Data is used only to show the organization's own staff their own records and to remind them of changes. It is not used for ads or marketing.

If you are a client of that organization, its own privacy policy also applies to you. You can make any request below to the organization or to me.

3. What I don't collect or do

• I don't sell your data. Ever. No data is sold, rented, or traded for money or anything else of value.
• I don't share or disclose your data with a third party for any purpose other than running the services listed here, unless you actively consent first. This includes de-identified, anonymized, or pseudonymized data.
• I don't use it for retargeting outside of the Meta Pixel ad-attribution mentioned above, and even that is limited to ads I run for michaelheredia.com.
• I don't use your data to train AI models.
• I don't read your private deployment data once you're live — the agent runs on your server, in your accounts, with your API keys. I only see it during onboarding or if you specifically ask me to debug something together.

4. Third-party processors

The named services that touch your data on my behalf:

• Cloudflare — hosting, CDN, request logs, contact-form email delivery via their Email Service.
• PayPal — card and PayPal payment processing, including subscriptions.
• Mercury — invoices and bank transfers.
• Google Analytics 4 — pageview analytics.
• Meta Pixel — ad attribution for paid campaigns I run.
• Calendly — scheduling.
• WhatsApp Business — chat support when you tap the chat button.
• Twilio — phone calls, voicemail, and text messages on the Heredia Labs line.

For apps I run for a client organization, these also apply:

• Amazon Web Services — the app's server, file storage, encrypted backups, and email delivery.
• Cloudflare — network security and an encrypted off-site backup copy.
• USCIS — receives receipt numbers only, to return case status.
• AI model providers (xAI, OpenAI, Anthropic, Google) — process text the app's assistant is asked to handle. Their business terms bar them from training models on it.
• Twilio — the organization's calls and text messages.

Each of those has their own privacy policy that covers the data they hold. I don't share your data with anyone else. Every processor is bound by contract to use the data only to provide its service to me. They must keep to terms at least as protective as this policy.

Your sharing choices

You choose what you give me. If you leave something out, the only cost is that the service may not be able to do that part (for example, no texts without a mobile number). Sharing case information can also touch other people, such as family members named in an immigration petition. Please share only what the work needs.

5. Text messages (SMS)

If you give Heredia Labs LLC your mobile number and agree to receive texts (by checking the box on the texting opt-in form or the contact form, or by texting our number first), I use it only to reply to your inquiry and to text you about your project: updates, scheduling, and invoice reminders. No marketing or promotional texts.

• No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging opt-in data and consent are never shared with or sold to anyone.
• Texts are sent and received through Twilio, which only processes them to deliver them.
• Reply STOP at any time to stop texts, or HELP for help. Message frequency varies; message and data rates may apply.

6. Cookies and local storage

• Theme preference: which color theme you've chosen (dark/light) is stored in localStorage so the site remembers next time.
• UTM stash: campaign parameters from inbound links stored in localStorage for 30 days (see above).
• Analytics cookies: GA4 and Meta Pixel set their own first/third-party cookies for measurement. These load only after the page has finished painting, to keep the site fast.
• Account session: if you sign in at /account, an httpOnly cookie stores the session token. It is not used for ads.

You can clear all of these any time via your browser's site-data settings.

7. How long I keep it

• Contact form messages and email: I keep them in my inbox indefinitely unless you ask for deletion.
• Payment records: retained per PayPal's and Mercury's policies and my tax/legal obligations (typically 7 years for tax purposes).
• Analytics: GA4 default retention (14 months for event-level data unless changed).
• Cloudflare logs: standard CF retention (a few weeks).
• Calendly bookings: per Calendly's retention policy.
• Client portal and apps I run for an organization: kept while the account or service is active.
• Dormant accounts: if a portal account or an organization's app goes 12 months with no sign-in, I email the account holder. If they don't reply within 30 days, I delete the data. Payment records are kept for the tax period above.
• When a service ends: the organization gets an export of its data. I delete it from the live system within 60 days.
• Backups: backups are encrypted and locked against changes for 30 days. Deleted data leaves the backups as they roll over. Backups are only ever opened to recover from an outage.

8. Your rights

Regardless of where you live, you can ask me to:

• Tell you what data I have on you.
• Correct it if it's wrong.
• Delete it for good (subject to tax/legal record-keeping obligations for payment records).
• Close your account.
• Stop sending you any non-transactional communications.

How to delete your data or close your account: email info@michaelheredia.com with the subject "Delete my data" or "Close my account". Send it from the email on file, or tell me how to confirm it's you. Staff at a client organization can also ask their own admin. I delete the data from the live system within 30 days of confirming the request. It then leaves the encrypted backups as they roll over (see section 7). I'll email you when it's done.

I'll answer any request within 30 days, usually within 48 hours. If you're in the EU/UK, California, or another jurisdiction with specific data rights (GDPR, CCPA, etc.), those rights apply to you in addition to anything stated here.

9. Children

These services aren't aimed at anyone under 18. If I learn that someone under 18 has submitted data, I'll delete it.

10. Security

The site runs on Cloudflare with TLS encryption end-to-end. Card payments are processed by PayPal (PCI DSS Level 1). I don't store passwords or card data — PayPal and the other named processors handle that on their respective infrastructure. That said, no system is perfectly secure.

API keys and sign-in secrets for the apps I run (for example, USCIS API credentials) stay on the server. They are never sent to a browser or shown on screen.

If there is a data breach: I'll email everyone affected within 72 hours of confirming it. The email will say what happened, what data was involved, and what I'm doing about it. It will also list any steps you should take, such as watching for phishing emails. I'll also notify regulators where the law requires.

11. Changes to this policy

I may update this policy over time. The "Last updated" date at the top shows the latest version.

For a material change, I'll email account holders and client organizations at least 30 days before it takes effect. The email will include a short plain-language summary of what changed. A material change is anything that changes how your data is used or who receives it. It won't apply to data you already gave me until you actively agree, by replying or clicking "I agree". Just continuing to use the service doesn't count as agreeing. If you don't agree, you can close your account and have your data deleted. Site visitors without an account will see a notice on this page for 30 days.

12. If the business is sold or closes

If Heredia Labs LLC merges, is sold, or transfers these services to another company, I'll notify you before your data moves. The new owner must keep to this policy, or to terms at least as protective. You'll also be able to download your data or have it deleted first. If the business closes, I'll give you at least 30 days to download your data, then securely delete it.

13. Contact

Questions, deletion requests, or anything privacy-related: info@michaelheredia.com.

Written in plain English for clarity, not as legal advice. If you're in a regulated industry or jurisdiction, please consult counsel before relying on these terms.