Privacy policy

The short version

If you are only reading the marketing pages, we collect nothing about you. There is no contact form, no newsletter signup, no analytics, no advertising trackers, and no third-party embeds on them. We do not set any cookie on you before you sign in, which is also why there is no cookie banner here — there would be nothing to consent to.

The only place we collect personal information is the account pages: sign in, sign up, and password reset. If you never use one, the only record of your visit is an ordinary server log.

Who we are

This site is operated by Gatehouse, a sole proprietorship based in Kentucky. We are responsible for the personal information described here, and you can reach us about anything on this page at bradleysettle87@gmail.com.

What this policy covers

This policy covers the public website: the marketing pages, the platform status page, the developer documentation, and the account pages for both staff and the customer portal.

It does not describe what happens inside the Gatehouse application, because the application is not open to the public and is not being offered to customers. When that changes, this policy will be replaced with one that describes it.

What we collect when you browse

Nothing directly from you. The marketing pages have no form and no email capture, and no button on them submits anything. They load no analytics, no tag manager, no advertising or social pixels, and no fonts, scripts, or images from anyone else's servers. We do not use an analytics product on this site at all.

Our hosting provider keeps ordinary server logs for every request, as essentially every web host does. Those logs include your IP address, your browser's user-agent string, the page requested, the time, and the response. We use them to keep the site running and secure, and for nothing else.

What we collect on the account pages

Signing in asks for your email address and your password. Creating a staff account also asks for your full name. Creating a customer portal account asks for your full name, email address, password, and an organization code, which is what links the login to a storage account your facility already has on file. Requesting a password reset asks only for an email address.

Your password is passed straight to our authentication provider to be checked or stored. Our own code never stores it and never writes it to a log.

Separately, we keep a security log of authentication events: signing in, a failed sign-in, an account lockout, creating an account, requesting or completing a password reset, sending a verification email, and second-factor activity. Each record holds the email address exactly as it was typed, the IP address the request came from, the browser's user-agent string, the type of event, and the time. A password-reset record also notes whether the reset email was actually sent.

Because the address is recorded as typed, an attempt using a mistyped, borrowed, or invented email address still creates a record containing that address and the IP address it came from — even though no account exists for it.

Submitting the sign-up or password-reset form also causes an email to be sent to whatever address was entered. We limit how often that can happen from one address or one network, but we cannot verify in advance that the address belongs to the person typing it.

Why we collect it

To let people we have authorized sign in, and to keep them signed in.

To protect the account pages from abuse. The security log is what lets us rate-limit by IP address, lock an account after repeated failures, and tell whether someone is trying to break into an account.

To keep the site working, and to fix it when it breaks.

We do not use any of it for advertising or marketing, and we do not build profiles from it. We do not sell your personal information, and we do not share it for cross-context behavioural advertising.

Cookies and browser storage

We use essential cookies only, and only once you sign in. The main one is the session cookie set by our authentication provider, which holds your sign-in token. Alongside it we set small cookies recording which organization and facility you are working in, one marking a device as trusted if you choose that when entering a second factor, and — for our own staff only — one recording which organization is being viewed for support. All of them exist to make signing in work. There is no advertising, analytics, or personalization cookie anywhere on this site.

Two things touch your browser's own storage rather than ours. The site reads a stored value called "theme" to decide whether to render light or dark. And if part of the page fails to download, a recovery script writes a counter and a timestamp to session storage so the page can reload itself once and then clear them. Neither contains anything personal, and neither is sent to us.

Do Not Track and cross-site tracking

We do not respond to browser "Do Not Track" signals, because we do not track you across websites in the first place and there is nothing for the signal to switch off.

No other party collects personal information about your activity across different websites when you use this site. There are no third-party trackers, pixels, or embeds on it.

Who else sees it

We use a small number of service providers to run this site. They handle information on our instructions and for no purpose of their own.

Vercel hosts the site and runs its servers. It handles and logs every request, including your IP address and user agent.

Supabase provides our authentication and our database. It receives your email address and password when you sign in or create an account, sends the verification and password-reset email, stores the security log described above, and keeps its own service-side logs, which include the IP address a request came from.

Sentry provides error and performance monitoring. Where it is switched on for a deployment, it may receive the error, the page or action involved, and technical context about the request, from our servers and from your browser. We have not enabled its session replay, its performance profiling, or its option to attach IP addresses and cookies to reports, and request headers and cookies whose names look sensitive are stripped before anything is sent.

We may also disclose information where the law requires it, to respond to a valid legal request, or where it is necessary to protect our rights, our users, or the security of the site.

How long we keep it

We do not currently delete security log records on a schedule. Assume that the email address, IP address, and user agent captured on a sign-in or password-reset attempt are kept indefinitely unless you ask us to remove them. If you want a record removed, write to bradleysettle87@gmail.com and we will delete it, unless we need it for an open security investigation.

Closing an account does not by itself clear those records: they are deliberately kept separate from the account so that a record of an attack survives the account it targeted. Ask us and we will remove them.

Session cookies last as long as your sign-in session and expire on their own. Server logs held by our hosting and authentication providers are kept on those providers' own schedules, which we do not control.

How we protect it

The site is served over HTTPS with a content security policy and other protective headers. Sign-in attempts are rate-limited by IP address, and an account locks after repeated failures. Accounts can use an authenticator app as a second factor. Your password is handled by our authentication provider and is never stored or logged by our own code. Security log records are protected so that a signed-in person can only ever read their own.

No website is perfectly secure, and we cannot promise these measures will always be enough.

Your choices and requests

You can read this entire website without giving us anything. If you never use an account page, we hold nothing about you beyond the server logs described above.

There is no self-service way to review or change this information, because there is so little of it. Write to bradleysettle87@gmail.com instead and we will tell you what we hold about you, correct it, or delete it. We will reply within 45 days, and we will not treat you differently for asking.

Children

Gatehouse is a business tool for people who operate self-storage facilities. This site is not directed to children under 13, and we do not knowingly collect personal information from them. If we learn that we have, we will delete it.

Changes to this policy

If we change this policy we will post the new version here and update the "last updated" date at the top of the page. If a change is material, we will say so on this page. This policy will change substantially once the product is actually available to customers, because there will be a great deal more to describe.

Contact

Privacy questions and requests: bradleysettle87@gmail.com.