Privacy Policy

Uptown Creative, Inc. operating as Austin Robbins Agency ("Austin Robbins Agency," "we," "us," or "our") respects your privacy. This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information in connection with:

• austinrobbins.com;
• austinrobbins.agency;
• decklock.app and its subdomains, including metrics.decklock.app and client-specific subdomains such as clientname.decklock.app;
• our communications, client relationships, creative and marketing services; and
• Decklock (including the services formerly offered as Decklock Metrics), including reports, presentations, guides, flipbooks, and other hosted deliverables prepared for or shared on behalf of a client.

Together, these are referred to as the "Services."

1. Information We Collect

We may collect the following categories of personal information.

Information you provide

This includes your name, business name, job title, email address, telephone number, mailing address, messages, project instructions, billing information, and other information you provide through a website form, email, telephone call, meeting, proposal, agreement, or project-management system.

Client and project information

When providing services, we may receive content, documents, photographs, account information, property information, marketing materials, contact information, approvals, feedback, and other data supplied or authorized by a client.

Decklock information

For Decklock, we may process listing information, property addresses, campaign and advertising metrics, website activity, email engagement, social media performance, portal activity, showing information, recipient information, and related data supplied by a client or obtained from sources the client authorizes us to access. Decklock also hosts presentations, guides, and other deliverables that a client may share with a recipient by a personalized link.

When a presentation is viewed through a personalized reader link created by a client, a view can be recorded after at least three seconds of active viewing. We record the date and time of the opening and last activity, active viewing time, the furthest page reached, time spent on each page, and whether the device is a phone, tablet, or computer. Active viewing time counts while the presentation is visible and the viewer has recently interacted with it or a supported video is playing, up to two hours per view. We also record whether the page was reloaded and assign a random identifier to each page load; this identifier is held in page memory only and is not reused across views or links. This reporting applies only to personalized reader links. Opening a presentation's main address does not create these view records. The system filters out detected bots, automated browsers, and client previews. Each such presentation says that viewing activity is visible to the sender, on its contents or closing screen, with a link to this Policy. Readers in Quebec are asked first, and no viewing activity is recorded unless they allow it. To know whom to ask, we use the country and region our hosting provider attaches to each request; we don't keep them.

The client gives each link a label, usually the intended recipient's name. Readers never see that label. The client and we can, and it appears in the opening emails described below, which Resend, our email provider, delivers. We show the client each link's visits, viewing time, progress, time per page, and device category, along with totals for their links and presentations. If the client enables opening notifications for a link, we try to email them on its first recorded opening and at most once every twelve hours for return visits. These emails include the link label, presentation title, device category, and opening time. Links can be forwarded, so these records describe activity on a link; they do not establish who viewed it or that someone read or understood its content.

This reporting does not use cookies, local storage, or other persistent storage on the viewer's device. We do not record location for this reporting or store IP addresses, browser type, user-agent strings, or referring pages with view records. We determine the device category from the browser's user-agent without retaining that string. We do not link individual viewers across links, across clients, or with other websites, or use fingerprinting. Our hosting provider separately keeps request logs, as described below. We do not use information collected through Decklock to advertise to you.

Decklock client accounts

For clients who use the Decklock portal, we store their email address, name, role, time zone, opening-notification preference, sign-in times, and last portal visit time. We use this information to manage access, provide the service, and deliver requested notifications. Clients sign in through an emailed one-time link. The portal uses a necessary session cookie, described in Section 10, and does not run analytics.

Information collected automatically

When you use our websites, our systems and service providers may automatically collect IP address, browser and device information, operating system, requested pages, referring pages, dates and times, approximate location derived from IP address, security events, and similar technical information. We may use cookies or comparable technologies where necessary for website operation, security, preferences, and measurement. The Decklock reader-link reporting described above is separate from these general website practices and has the collection limits stated above.

Security and abuse prevention

To protect private links from being guessed, the servers that host Decklock client presentations may keep a short-lived record, in server memory only, of the IP address of any visitor who requests an address that does not exist. The record counts those requests and is used only to limit further requests from that address for up to ten minutes. It is normally removed when that period ends; removal can be delayed while a server is paused, and can happen sooner if the server's capacity is reached or the server shuts down. The record is not combined with client or recipient information and is not used to identify you. Our hosting provider separately keeps standard request logs, including IP address, for operation and security, under its own retention periods; the ten-minute period does not apply to those logs.

Decklock also uses IP addresses briefly in server memory to limit abusive reporting requests. These addresses are not stored with view records. Other short-lived rate-limit and notification-throttle records, keyed to an email address, account, or link, expire within two days. A per-link marker recording that we tried to send the first opening notification is kept for as long as the link exists; it contains no personal information.

Information from third parties

We may receive information from clients, referral sources, publicly available sources, marketing and technology platforms, payment providers, or other parties where permitted by law.

2. How We Use Information

We may use personal information to:

• respond to inquiries and prepare proposals;
• provide, manage, support, and improve the Services;
• communicate about projects, approvals, deliverables, reports, billing, and support;
• prepare and distribute Decklock reports as instructed by a client;
• host and deliver Decklock presentations and other hosted deliverables, and show the client when and how their presentations are viewed through links they created;
• manage Decklock client accounts and send opening notifications clients enable;
• process transactions and maintain business and tax records;
• operate, secure, troubleshoot, and protect our websites, systems, and Services;
• prevent fraud, misuse, and security incidents;
• manage vendors, contractors, and client relationships;
• comply with law and enforce our agreements;
• carry out other purposes disclosed when information is collected or authorized by you.

We limit collection, use, and disclosure to purposes that a reasonable person would consider appropriate in the circumstances.

3. Consent

We obtain consent where required by law. Consent may be express or implied depending on the circumstances and sensitivity of the information. Where our processing relies on your consent, you may withdraw it, subject to legal restrictions and reasonable notice, by contacting us or, for information we process on a client's behalf, the client who shared the presentation with you. If you contact us about client-controlled information, we will help route your request and assist the client. Withdrawal does not affect processing that applicable law permits or requires without consent. Withdrawal may prevent us from providing some Services.

4. How We Disclose Information

We do not sell personal information.

Where permitted by applicable law, we may disclose information:

• to hosting, website-security, email, cloud-storage, communications, payment, accounting, project-management, analytics, font-delivery, and other technology providers that support our operations;
• to employees, contractors, and professional advisers who require access for legitimate business purposes and are subject to confidentiality obligations;
• to client-authorized platforms, vendors, report recipients, and collaborators;
• to a client when we process information on that client's behalf;
• where required by law, legal process, or a lawful governmental request;
• where reasonably necessary to investigate fraud, security issues, or violations of our agreements; or
• in connection with a proposed or completed financing, reorganization, sale, merger, or transfer of all or part of our business, subject to appropriate safeguards.

We use third-party providers for hosting, form and security protection, email delivery, and website measurement. Providers may change as our Services evolve.

Decklock uses Vercel for hosting, Upstash for database services, and Resend for email delivery, including sign-in links and opening notifications.

5. Client-Controlled Information

When we process personal information solely on behalf of a client, the client determines why and how that information is used. Questions or requests concerning that information should normally be directed to the client. We will assist the client as required by our agreement and applicable law.

We use business contact, account-administration, billing, security, and relationship information for our own legitimate business purposes as described in this Policy.

6. Processing Outside Canada

We and our service providers may process or store personal information in Canada, the United States, and other jurisdictions. Information processed outside your jurisdiction may be subject to the laws of that jurisdiction and may be accessible to courts, law-enforcement authorities, or governments in accordance with those laws. For individuals in Quebec, this includes processing elsewhere in Canada.

We remain responsible for personal information under our control and use contractual and other measures appropriate to the sensitivity of the information when engaging service providers.

7. Retention

We retain personal information only for as long as reasonably necessary for the purposes described in this Policy, including providing Services, maintaining business and financial records, resolving disputes, enforcing agreements, and meeting legal obligations. Retention periods vary according to the nature and sensitivity of the information, the client relationship, legal requirements, and backup cycles. We securely delete, anonymize, or dispose of information when it is no longer required.

Decklock view records are deleted thirteen months after the view, and each link keeps only its newest 500 views, so older records may be removed sooner. Link totals, including opening counts and viewing time, remain for as long as the link exists. A client can delete a link at any time. That removes its label, views, and totals, and keeps only a marker so the link stays turned off.

Decklock account closure is available on request and is completed within thirty days. On closure, we delete the account's personal information, email addresses, link labels, and view records. We retain only a disabled marker for each link so previously shared links remain turned off. If our database is briefly unreachable, a link that was turned off or deleted could open until it's back. No viewing activity is recorded while that happens.

The private-link guessing records described in Section 1 are used for at most ten minutes and are normally removed when that period ends, subject to the timing described in that section. Other short-lived rate-limit and notification-throttle records, keyed to an email address, account, or link, expire within two days. A per-link marker recording that we tried to send the first opening notification is kept for as long as the link exists; it contains no personal information. Hosting-provider request logs are retained under the provider's own retention periods. Resend retains its own email logs under its retention period.

8. Security

We use administrative, technical, and physical safeguards appropriate to the sensitivity of the information. These may include access controls, confidentiality requirements, secure service providers, authentication measures, backups, and incident-response procedures. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Your Choices and Privacy Rights

Subject to applicable law, you may request access to personal information we hold about you, ask us to correct inaccurate information, or withdraw consent. You may also ask questions or make a complaint about our privacy practices.

We may need to verify your identity before completing a request. In limited circumstances, applicable law may permit or require us to refuse access, retain information, or decline a request. If so, we will explain the reason where legally permitted.

To make a request, contact our Privacy Officer using the information below.

10. Cookies and Online Tracking

Decklock reader-link reporting does not use cookies or other persistent storage on the viewer's device. Separately, the client portal at studio.decklock.app uses a secure, HTTP-only session cookie named __Host-dl_portal, lasting thirty days, that is necessary to keep clients signed in. This cookie is set only on the portal; it is not used to track presentation viewers. The portal does not run analytics.

Our websites and service providers may use technologies necessary to deliver and secure the websites and to understand basic usage. Your browser may allow you to block or delete cookies, although doing so may affect website functionality.

We may use Google Analytics to understand how visitors use our websites. Google Analytics may use cookies and similar identifiers to collect information such as pages visited, approximate location, and browser and device information. We do not use Google Analytics for personalized advertising or cross-context behavioural advertising. Where required by law, we obtain consent before enabling non-essential analytics. Information about Google's processing practices is available at policies.google.com/technologies/partner-sites, and Google provides an opt-out browser add-on at tools.google.com/dlpage/gaoptout.

Our website forms are protected by Cloudflare Turnstile, a bot-detection service. Turnstile runs silently when you interact with a form and does not normally display a challenge. To distinguish people from automated traffic, Cloudflare processes technical information such as your IP address, browser and device characteristics, and the page on which the check runs. Cloudflare states that it does not use this information to identify, profile, or target individuals. Cloudflare also uses these technical signals to improve its bot-detection service, as described in its addendum. Cloudflare's processing is described in its Turnstile Privacy Addendum at cloudflare.com/turnstile-privacy-policy.

Third-party providers, including Google and Cloudflare where used, may collect information through their technologies as described in their own policies. Except as described in this Policy, we do not knowingly permit third parties to collect personal information about your online activities over time and across unrelated websites for their own advertising purposes.

Some browsers offer a "Do Not Track" signal. Because there is no universally accepted standard for responding to that signal, our websites do not currently respond to it. At the effective date of this Policy, we do not sell personal information or use personal information for cross-context behavioural advertising. If those practices change, we will update this Policy and provide any legally required choices.

11. California Residents

California residents may contact us to request information about our collection, use, or disclosure of personal information or to request access or correction. If the California Consumer Privacy Act applies to our activities, we will provide the rights and disclosures required by that law. We will not discriminate against an individual for exercising an applicable privacy right.

12. Children

The Services are intended for businesses, professionals, and the intended recipients of client presentations, and are not directed to children under 16. We do not knowingly collect personal information from children under 16. If you believe a child has provided information to us, please contact us.

13. Third-Party Websites

Our websites and Deliverables may link to third-party websites or services. Their privacy practices are governed by their own policies, not this Policy.

14. Changes to This Policy

We may update this Policy to reflect changes in our practices, Services, or legal obligations. The revised Policy will be posted with a new effective date. We summarize changes at the top of this Policy. Where appropriate or legally required, we will also bring changes to the attention of affected individuals on the relevant Service — for example, by a notice on Decklock presentations — or by direct communication.

15. Contact and Privacy Officer

Privacy Officer: Attention: Privacy Officer, Uptown Creative, Inc. operating as Austin Robbins Agency.
Location: Ontario, Canada.
Email: agency@austinrobbins.com.
Telephone: 424.253.0009.

Written privacy, access, correction, and complaint requests may be submitted by email. A mailing address for formal correspondence is available on request.