Trust & Security

Who we are

Designofox Creative LLC is a Wyoming limited liability company. We operate remotely. The public mailing address for notices, privacy requests, and correspondence is 513 Coulter Ave, Kirkwood, MO 63122, USA.

Website security

The public website is served over HTTPS with a minimum of TLS 1.2, HTTP Strict Transport Security (HSTS) with a one-year max-age covering subdomains, and DNSSEC-signed DNS with the DS record published at the domain registrar so resolvers can validate responses.

Responses carry a restrictive Content Security Policy, frame protection, content-type sniffing protection, a limited referrer policy, and a permissions policy that disables camera, microphone, geolocation, and payment APIs.

Payment safety

Listed packages are paid on a Stripe Payment Link for the published USD amount. Custom work is still quoted first. Designofox does not collect raw card data in a first-party payment form. The merchant's applicable PCI validation will be confirmed against this Payment Link architecture.

The long statement descriptor is DESIGNOFOX CREATIVE. The shortened descriptor/card prefix is DESIGNOFOX*; the [PRODUCT] place is filled with a short label for that payment, not the complete line every bank will print. Some banks recapitalize, squeeze spaces, or drop characters, so the printed statement may not match this page exactly.

Stripe states that it is assessed annually as a PCI Level 1 service provider. That provider status does not certify Designofox. A hosted processor can reduce the systems that handle card data, but it does not remove the merchant's PCI responsibilities. The correct SAQ, attestation, and any scanning duties will be confirmed against the real account and production architecture and completed before live card acceptance.

Listed package amounts are bound to Stripe Products, Prices, and Payment Links in the live Stripe account. The site only redirects to those verified HTTPS Stripe URLs. A return page is informational. Fulfillment status changes from studio confirmation after Stripe records the payment, not from the browser redirect.

The current contact endpoint rejects likely card-number, bank-account, and routing data before persistence or delivery. Do not send full card numbers, security codes, PINs, passwords, or bank credentials by form, email, phone message, chat, SMS, or social media.

Access controls

Access to client information is limited to people and vendors who need it to provide services, operate the business, support customers, maintain records, or meet legal obligations.

Data minimization

We collect project and billing information that is reasonably needed to respond to inquiries, provide quotes, complete approved work, process payments, and maintain records.

Consent and privacy controls

The website uses Termly as its consent manager. Termly loads before optional third-party scripts, provides accept, decline, and category choices where applicable, and keeps the tawk.to live-chat widget blocked until Performance and Functionality consent permits it.

Vendor review

We choose service providers based on business need, reliability, and security posture. Vendors that process personal information are expected to protect that information and use it only for authorized purposes. Named categories of vendors appear in the Privacy Policy.

Incident response

If we become aware of a security incident affecting personal information, we will investigate, take reasonable steps to contain it, and provide notices required by applicable law.

Where GDPR applies and the incident is a personal-data breach that must be reported, we will notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, and we will notify affected people when the law requires.

Customer responsibilities

Please do not send payment card numbers, bank-account or routing details, security codes, passwords, government IDs, medical information, or unnecessary confidential data through the contact form. Payment instructions, when applicable to an accepted engagement, are provided separately.

Contact