Privacy Policy

Waldo7Labs (W7) is a one person web studio run by Jesse Chesnut in Iron Station, North Carolina. It also runs the W7 merch store and the W7 Club giveaway. When this page says “we” or “us”, it means Waldo7Labs. Questions or requests: [email protected].

What you give us

• Forms and quotes: your name, email, phone, business name, what you need, and any photos or files you upload.
• Bookings: the time you pick, your name, phone or email, and what the call is about.
• Client accounts: your sign in email, your project details, messages, files, signed documents and payment history.
• Merch orders: your name, email, shipping address, what you ordered and any promo or prize code.
• The merch list, Reserve it and the W7 Club wheel: your first name, email, the nickname and avatar you pick, your saved pick (size and color), your entries, any bonus boxes you tick, and who referred you.
• Referrals: the names and contact details you give for yourself and the friend you refer.

What we collect on our own

• Anti fraud and spam checks: your IP address, browser details and a random device code saved in your browser. For the giveaway we keep these only as one way codes (hashes), not the raw values, so we can stop one person from entering many times. Our forms also count requests per IP address to slow down spam.
• Analytics: we use Google Analytics to see which pages people visit, from what kind of device and roughly where (city level). We remove any name or email from the page address before it is sent.
• Bot check: some forms use Cloudflare Turnstile to check that you are a person. Cloudflare looks at your browser and connection to do that.

Public business info: if you run a business, we may note public details from your website or Google listing (business name, public email and phone, reviews) to suggest improvements or contact you about our services. Reply “stop” to any of those emails and we will not email you again.

Website chat (“Ask my AI”): it is an AI assistant, not Jesse. What you type is sent to xAI (the company behind Grok) to write the answers, or to Cloudflare Workers AI if xAI is down. We do not save chat transcripts in our own database. If you ask it to book a call or pass on a message, the details you give (like your name, contact and what you need) are saved and emailed to Jesse.

Phone line (980) 222-1163: calls are answered by an AI assistant that runs on xAI. It tells you it is an AI. When it books a callback or takes a message, we save your name, number, the message and the time, and email them to Jesse. Your call is handled by xAI and Google Voice, which may keep call logs and a transcript of the call under their own terms. Do not share card numbers, passwords or health details on the phone line or in the chat.

Please do not use the chat or phone line if you do not want your words processed by these services. You can always email [email protected] instead.

We use a small number of cookies and browser storage items. None of them are for ads.

• Needed to work: your sign in session (Supabase), your cart, a referral or share code you arrived with, the giveaway device code, and choices like filters or a closed banner.
• Analytics: Google Analytics cookies (names that start with _ga).
• Bot check: Cloudflare may set a cookie when it checks for bots.

You can clear or block cookies in your browser settings. Blocking the needed ones may stop sign in, the cart or the giveaway from working. You can block Google Analytics with Google’s opt out add on or a privacy setting in your browser.

• To answer you, build and run your website, and send you your proposal, bills and project updates.
• To make and ship merch orders, send order emails and handle problems with an order.
• To run the giveaway: count entries, draw winners, send prize codes and stop cheating.
• To track referral and website credit.
• To send the W7 merch and club emails you signed up for. Every one has an unsubscribe link.
• To keep the site safe, stop spam and fraud, and see which pages work.
• To keep the records the law asks for, like tax and payment records.

We do not sell your personal information. We do not share it for targeted ads. We only share what each service needs to do its job for us:

• Stripe: card payments, Klarna and Stripe Tax. Stripe holds your card details. We never see or store your full card number.
• Printful: makes and ships merch, so it gets your name, shipping address and order.
• Resend: sends our emails.
• Supabase: our database and sign in.
• Cloudflare: hosts the site, runs Turnstile and the backup AI model, and forwards email.
• xAI: runs the AI chat and the AI phone assistant.
• Google: Analytics, Google Voice (the phone line), Gmail and Google Calendar (booked calls go on Jesse’s calendar).
• Telegram: short alerts to Jesse’s phone when a form, payment or message comes in. These can include your name and a few words of your message.
• A giveaway round’s sponsor, if there is one: only the winner’s name and shipping address, only with the winner’s OK, only to send the sponsor’s prize.

We may also share information if the law requires it, to protect against fraud, or if the business is ever sold (the new owner would have to follow this policy).

• Client, order and payment records: as long as you are a client, then as long as tax and business record rules require.
• Merch list and giveaway entries: until you unsubscribe or ask us to delete them. If you unsubscribe, we keep your email on a do not email list so you are not added back by mistake.
• Fraud check codes and rate limit records: only as long as they are useful for stopping abuse.
• Anything else: only as long as we need it for the reason we collected it.

• See it: ask for a copy of the information we have about you.
• Fix it: ask us to correct anything that is wrong.
• Delete it: ask us to delete it. We will, except what we must keep for taxes, payments or fraud prevention.
• Stop emails: use the unsubscribe link at the bottom of any W7 list email, or reply “stop”.

Email [email protected] from the address you used with us. We may ask a question to make sure the request is really from you, and we will answer within 30 days. We honor these requests for everyone, wherever you live. Some states (like California, Virginia and Colorado) give residents extra privacy rights; we do not sell or share personal information for ads, so there is nothing to opt out of there, but you can still ask us anything above.

This site is not meant for children under 13, and we do not knowingly collect their information. The giveaway is for adults 18 and over. If you think a child has given us information, email [email protected] and we will delete it.

We use encrypted connections (https), limit who can reach the database, and keep payment details with Stripe. No system is perfectly safe. If a breach ever affects your information, we will tell you as the law requires.

If we change this policy, we update the date at the top. Big changes will be noted on this page. Related pages: Terms, Shop policies and the giveaway rules.