Only what you send us on purpose.
The contact form asks for seven things: your name, your email address, your phone number, the date of your event (or that it is not set yet), roughly how many people, the venue or city, and what you need. Three of those are required — name, email and what you need — because they are the minimum required to write back.
The form also carries two hidden fields that you never see and never fill in. One is a decoy that only automated submissions complete; the other records how long the form was open, because a submission completed in under three seconds was not completed by a person. Both exist to keep spam out and neither tells us anything about you.
That is the entire list. We do not ask for a company, a budget, or how you heard about us, and there is no account to create.
It becomes an email and nothing else.
When you send the form, its contents are delivered as an email to our sales inbox and the request ends. Nothing is written to a database, nothing is saved to a file, and nothing is kept on the server that serves this website — there is no store for it to be kept in.
The email itself then lives in our email system like any other message from a client, and is kept as long as it is useful, the same way correspondence about a job is kept. If you would like a message deleted, ask and we will delete it.
Mail is delivered through a third-party email provider, which necessarily processes the message in transit in order to deliver it. That is the only outside party that ever sees the contents of a form submission.
Two things are recorded. Neither one is you.
This site counts how many people read each page, using Cloudflare Web Analytics. It sets no cookie, it gives you no identifier, and it builds no profile: what it records is which page was loaded, roughly which country the request came from, and how quickly the page rendered. There is no way to work backwards from any of that to a person.
The second thing is the network. Every request that reaches any website carries the name of the network that carried it, and we keep that name along with the page that was asked for, the rough location and the time. For most visitors it is a broadband or mobile company — Comcast, AT&T, Verizon — which tells us nothing at all about them, and we discard it. When it is instead a business that runs its own network, we keep it, and we would rather state the purpose plainly than dress it up: it tells us which companies are reading about what we do, so that we know who to follow up with.
What is kept is the organisation, never the person. Your IP address is not stored. Your browser and device are not stored. Nothing in that record distinguishes you from anyone else who works at the same place — there is no identifier that could tell two of you apart, and that is a constraint built into the database rather than a policy we are asking you to take on trust. No cookie is set, no script runs in your browser for it, nothing is sent to a data broker or an identity-matching service, and nothing about you is bought from one. The records are deleted after ninety days.
Most of what reaches a website is not a person at all, and we keep those records too: requests from hosting companies, datacentres, scanners and the like, from anywhere in the world, so that we can tell them apart from the real ones and check our own filtering. There is nobody behind those to describe. A request from a home or mobile connection is in neither group — it is discarded as it arrives and no record of it is written anywhere.
Nothing else runs. No tag manager, no advertising pixel, no session recording, no testing script. Nothing here is shared with an advertising network and nothing follows you to another site. Neither of the two things above needs a script in your browser. The next section describes one more thing this site notices, and it only happens if you arrived from one of our ads.
That counting script is the only file on this site loaded from anywhere else, and it comes from the company already delivering every page here. The fonts and the photographs are still served from this domain rather than from a font service or a media network — a deliberate engineering decision, checked automatically every time the site is built.
There is still no consent banner, because there is still no cookie and no identifier to consent to. If that ever changes, this page changes in the same commit.
We keep the number Google gave us about you.
When somebody clicks one of our Google ads, Google adds an identifier to the address of the page they land on — you can see it yourself, sitting in the browser's address bar after the question mark. It identifies the click, not the person. It arrives on this site whether we do anything with it or not.
We keep it, for one browser tab, in order to answer one question: did that ad produce an enquiry. If you then send the contact form, that number goes to Google with it, so the advertising account can count the enquiry against the click that led to it. If you do not send the form, nothing is reported and the number is thrown away when you close the tab.
It is held in session storage, which is not a cookie: it is never attached to a request, no other site can read it, and the browser discards it when the tab closes. It is the smallest thing that survives the walk from the page you landed on to the contact page.
The report to Google is sent from our own server, after your message has already been delivered to us, and it contains that identifier and the time — not your name, your email, your phone number or anything you wrote. No Google code runs on this website to make that happen, which is the whole reason it is arranged this way.
If you did not come from an ad, none of this applies to you and nothing is stored.
The ordinary record of a page being served.
This site is hosted on a commercial hosting platform, which keeps the routine operational records any web host keeps — the fact that a page was requested, roughly when, and technical information such as an IP address and browser type. Those records exist to keep the service running and secure. They belong to the host rather than to us and we do not go through them looking for visitors. The organisation record described in section 03 is not built out of them: it is made as the page is served, from the name of the network rather than from the address, and the address itself is never written into anything we keep.
This site is not directed at children.
It is a business-to-business site for people booking event production. We do not knowingly collect information from anyone under 13. If you believe a child has sent us something through this site, tell us and we will delete it.
A person answers. Not a ticket system.
To ask what we hold about you, to have something corrected, or to have a message deleted, write to [email protected] or call 561-750-4070.
All On Stage Productions
,
If this policy changes, the date at the top of the page changes with it. It is updated in the same commit as whatever changed on the site, so it cannot describe a version of the form that no longer exists.