Privacy notice: the client portal

Nupik Wenpach LLC. Privacy notice, version 6. Effective October 9, 2026.

The short version

The client portal is where Nupik Wenpach LLC ("the studio") sends offers, takes signatures and payments, talks with its clients and looks after them. It keeps what each step needs, and says so where the step happens. It runs no analytics, no advertising and no tracking. Its pages load nothing from anyone else's servers, except Stripe's payment form on the payment step. Nothing about you is sold.

1. Who this is

Nupik Wenpach LLC is an independent software studio in Carlsbad, New Mexico, run by Noah William-Paul Combs. Write to noah@nupikwenpach.com about anything in this notice.

This notice covers the client portal at portal.nupikwenpach.com, and the short links at nupwen.com that lead to it. The studio's website, www.nupikwenpach.com, has its own privacy policy.

2. What the portal keeps, and whose

What the portal keeps depends on what you do in it.

If you only load a page: the portal keeps nothing of its own. If a page breaks, it keeps an error report that holds the page's pattern, what went wrong, the kind of device and the browser's name, but not your IP address. The portal's host, Railway, logs every request: the IP address, the browser, the page and the time.

If the studio pitches you: the business's name, website and details, and your name, email address, phone number if the studio has it, and role. These come from the business's public website and listings, from someone who referred you, or from your own inquiry. The portal also keeps Noah's notes, and the offer itself: Noah's words, screenshots of your public website, and measurements Noah took of it.

If you open an offer: a random cookie, and what that browser did with the offer (section 3).

If you ask a question, or ask for a fresh offer: your words, and your email address if you give it.

If you answer an offer's price, by countering it or making an offer of your own, where the offer allows it: the amount, the price and the options it answered, your note if you write one, the browser it came from for as long as that browser's session is kept, and the studio's answer.

If you decline: the reason, if you give one. Your email address and your business go on the studio's do-not-contact list, for every channel. On a pitch to an existing client, only that pitch ends.

If you sign: the name, email address and business you give, your business's address, where you say the work will first be used, and your confirmation that you can sign for the business; the agreement exactly as you read it, and its SHA-256 fingerprint; when the code was sent to you and when you entered it, but never the code; your consent to sign electronically, and the version of the disclosure you agreed to; and your typed name, the time, your IP address and your browser. Your business's address and where the work will first be used decide whether New Mexico gross receipts tax applies, and at what rate.

If you pay by card: the amount, whether it went through, the card's brand and last four digits, and the wallet if you used Apple Pay or Google Pay. The card number itself only ever reaches Stripe.

If you save a card: a Stripe customer record and, for each card, its brand, its last four digits and the month and year it expires, which Stripe tells the portal. The portal also keeps the words you agreed to and when, the name of the person who saved the card, the address and browser it was saved from, what the card is for (later payments, the care plan, or both), and, if it is removed, when, how and by whom. A business may save several cards. For each change to your cards, the portal emails a six-digit code to the person making it, and keeps when the code was sent and used, but never the code. The portal emails the person who saved a card 14 days and again 3 days before a card it would charge expires, naming the card's last four digits and nothing else.

If a saved card is charged: the notice emailed to you beforehand, which card was named, and what Stripe answered. A charge is taken no sooner than 72 hours after its notice, and you may pay another way, choose another saved card, or withdraw before then.

If you have a care plan: the plan you chose, its price, the day of the month it is paid, each payment and the card or other way it was paid by. A plan paid for a year at once, by bank transfer or check, is kept as an invoice for the year, with what arrived and when, as Noah records it.

If you pay by bank transfer or check: the invoice, with the name, business and email address it is billed to, the way you chose to pay, and what arrived, on which day, with its reference, such as a check number, as Noah records it.

If an invoice is unpaid: the portal emails the contacts who handle money, once each, 3 days before the invoice is due, on the day it is due, and 7 days after, and stops when it is paid. For a deposit, which is billed before you have an account, the reminders go to the address the invoice was billed to. The portal keeps which reminder it sent and when, and Noah may also send one by hand. No reminder adds a fee, and the studio charges no interest or late fee.

If the studio corrects an invoice or refunds a payment: a credit note, numbered, with the invoice it corrects, the amount before tax, its share of the tax and the reason; a refund, with its amount, reason and date; and, if a credit is left on your business's account to come off its next invoice, that balance and what it was applied to.

If you become a client: your account (your name and email address), each sign-in session with the IP address and browser it started from, your documents, where your work stands as the studio records it, and when you last looked at your workspace's Home.

If you write to the studio in your business's messages: what you write, with its time and the page you sent it from; the photos and PDFs you send, which the portal checks for viruses on its own server; anything you point out with "Point it out", as where it was on the page and a small picture of that part of it; the reactions you leave on a message; and when you last read the thread, so that it can show a message as read. Before your business is a client, the person an offer was sent to writes after entering a code emailed to that address: the portal keeps when the code was sent and used, but never the code. While you have the thread open, the studio sees that you are there, and on what kind of device, and you may see when the studio is there. That signal, and the sign that someone is typing, are held in memory and never stored.

If you order an extra from the menu: the line, the quantity and the price you chose, and the offer the portal makes from them. Signing and paying are kept as above. The job that follows is kept like any work: its status and target date, the previews and files the studio shares, your approval, and a refund if you ask for one before work starts. If you ask for a line the studio confirms first, the few words you write to ask.

If you ask for care: your request (what kind it is, your words, the photo or PDF you attach, which the portal checks for viruses on its own server, and whether you marked it urgent), when the portal received it and by which way, the date the studio promised and how it was worked out from your plan's reply time, when the clock paused and ran again, when the studio first replied, whether that was by the date, and the line the studio wrote when it finished or priced the request as new work. A request you emailed is logged by Noah with the time it arrived. The studio also counts, for itself alone, how many requests each plan had answered by their dates.

If your work is handed off: the checklist for the work, with what each side says about each item (the studio's date and line, and your "I have it", "Not needed" or "Something's wrong", with who pressed it and when); the handoff document, which is a file the studio shares with you; and the ownership confirmation, signed by both sides, with the record section 4 describes. The portal checks nothing outside itself: it does not look at a registrar, a host or a code repository, so the checklist is what each of us says.

If the studio hands over secrets: Only Noah types the keys and passwords the studio holds for you into the portal, one at a time. Each has a label and a note, which are words and not secrets, and a value, which is kept encrypted, under a key that depends on a phrase. Noah tells the person who may open it that phrase by voice or by another way Noah chooses. The portal never emails it, never shows it again, and keeps nothing it could check it against. What the portal keeps about a handover is who may open it, when it ends, how many items it has, each label and note, when it was prepared, offered, shown, expired, withdrawn or destroyed, whether wrong tries were made, and the address and browser it was shown to. It never keeps a value in the clear or the phrase, or a length or fingerprint of either, and it keeps an emailed code only as a hash. The email that tells the person a handover waits holds no label and no value. A value is shown once, on the page the portal draws when the person asks for it, and the page asks the browser not to keep it. It is deleted from the portal's database when it is shown, when it ends unopened (within days of Noah making it), when Noah withdraws it, when the person says they do not need it, after too many wrong tries, or if the person is erased. The six-hourly backup leaves out the table that holds a handover's values, so no backup the studio makes holds a value. Railway, which hosts the portal, keeps point-in-time recovery copies of the whole database that reach back about four weeks, and a value deleted today can remain in those copies, still encrypted, until they age out. Opening one takes the studio's key, which is not in the database, and the phrase, which the portal does not keep; that is hard to do, and not impossible for someone with access to Railway and the phrase. Once a handover has been shown, the portal asks Noah to confirm that the copies the studio itself made of those values are deleted, and keeps that answer with the time.

If the studio asks for a few words, or to show the work: the studio emails the people who sign or decide for the business once, and once more 14 days later, and then no more. If you write a few words, the portal keeps them exactly as you wrote them, with the name and role you chose to have shown, or none, and the private line to Noah that is never shown. For each way of showing the work that you check (to quote your words, name your business, show its logo, link to its website, show screenshots of the work, or write a case study you see first), the portal keeps the exact words of that box and the version they were in, the time, who checked it, the name they typed, and the address and browser it came from. A box left unchecked is not agreed. If you say "Not now" or "No thanks", the portal keeps that and sends no more requests; you can still answer later on the same page. If you take a use back, the portal keeps when, and who, and asks no reason. If you are erased, your agreed uses are treated as taken back, and Noah is told which to take down. Noah keeps a list of where each agreed use is shown, so that it can be taken down. The portal publishes nothing: Noah copies what you agreed to the studio's website or pitches by hand.

If you send the inquiry form on the studio's website: what you typed, and a code made from your IP address with a secret key, used only to stop the form being flooded. If you checked the box to be texted, the record of that consent: the time, your IP address, your browser, the page and the exact words you agreed to.

If the portal emails you: your address, the subject, which kind of email it was, and whether it was delivered. Never the body.

If a payment is disputed: Stripe tells the portal when a card payment is disputed, and the portal keeps the dispute (the payment, the amount, the reason Stripe gives, the deadline and the outcome), any fees and funds Stripe moves because of it, and a record each time Noah builds the evidence packet, with its fingerprint. The portal does not keep the packet itself. Section 6 says what the packet holds and where it goes.

If you try a live preview in a pitch: nothing in the portal. What you type into a preview stays in that preview, and goes when it is taken down.

What the portal never collects: analytics, advertising tags or tracking pixels; fingerprints of your device, your location, how long you spend on a section, how far you scroll or where your mouse goes; card numbers, a client's bank account numbers, passwords (there are none), Social Security numbers, dates of birth or identity documents. It buys nothing about anyone, and takes nothing from social networks.

3. What an offer page records

At the foot of every offer, the page says: "This page records when it's opened, on what kind of device, which sections are read and which options are chosen, so I can follow up sensibly. Nothing else, and nothing leaves this site."

In full, for each browser that opens an offer, the portal records: when it opened the offer, first and last, and how often; whether it is a phone, a tablet or a desktop; each section of the offer the first time it comes into view; each change to the options chosen; and each act: asking a question, accepting, signing, paying or declining.

While the page is open, it tells the studio that someone is looking at it now, and on what kind of device. That signal is held in memory and never stored.

Noah sees the business, what happened, when, and on what kind of device, and whether a second browser opened the offer, as happens when a link is forwarded. The portal never records your IP address, your browser's details, a fingerprint or your location for anyone reading an offer. Link-preview services and email scanners are counted apart, and never shown as a person.

If your browser sends a Global Privacy Control signal, the page records only the opening and the acts, and nothing finer: no sections, no options and no kind of device. The portal does not track anyone across websites, so a Do Not Track signal changes nothing more.

4. Signing

When you sign, the portal records what section 2 lists, and prints it on the agreement's certificate page, which is sealed into the signed PDF. That record is the evidence that you signed, what you signed, and when. The disclosure you read before signing says more, including how to get paper copies.

5. Paying

Card payments, Apple Pay and Google Pay go through Stripe. Your card details go straight from your browser to Stripe, and never through the portal. On the payment step only, Stripe's payment form checks your browser for signs of fraud, and sets two cookies to do it (section 7). Stripe does that under its own privacy policy.

Apple Pay and Google Pay are your own wallets, under your own terms with Apple or Google.

A bank transfer or a check goes to the studio's bank, Mercury. The bank details are shown only after signing, on the payment page and on the invoice. They never change by email.

The studio's books are kept from a CSV file that Noah exports from the portal for a range of dates. It lists invoices, payments, refunds, credit notes and disputes with their amounts, tax, dates, references and the business's name, and never a card number or a bank account number. It stays with Noah and, in confidence, the studio's accountant.

6. Who else receives it

These services do a job for the studio, under their own terms, and receive only what that job needs:

Railway hosts the portal, its database and its files while they are worked on, and each pitch's live preview, in a project of its own. It logs every request's IP address, browser and page. In the United States. Logs are kept for 30 days, and database backups and point-in-time recovery copies for about four weeks. A handover's values, deleted from the database, can stay in those copies, still encrypted, until they age out (section 2).

Cloudflare runs the DNS for the portal's two domains, and the nupwen.com short links, so it sees each visit through a short link: the IP address, the browser and the link. It stores the portal's files (offer images and video, signed agreements, invoices and receipts, previews, the handoff document, and the photos, PDFs and pictures sent in messages and with care requests) and its encrypted backups, which it cannot read and which leave out a handover's values. The files are stored in its North American location, and the backups are kept for 35 days.

Stripe takes card payments. It receives your card details from your browser, each payment's amount and the portal's reference for it, a customer record and the cards on it only if you save a card, the charges made to a saved card, and, on the payment step, signals about your browser to detect fraud. Stripe is also responsible in its own right for fraud prevention and its legal duties, under its own privacy policy. The receipts are the studio's own: Stripe's receipt emails are off.

If a payment is disputed, the studio may send Stripe, and through it your card issuer, the evidence that the payment was owed. Noah builds the evidence packet in the portal as one PDF and uploads it in Stripe's Dashboard; the portal sends nothing to Stripe about a dispute on its own. The packet may hold the agreement you signed, with its certificate page; the invoices and receipts; the words you agreed to when a card was saved; each approval you gave and each file you downloaded, with the time and the address you did it from; the record of what the studio delivered; and a short statement of the facts. It never holds the studio's bank details or tax number.

Resend sends the portal's email, from mail.nupikwenpach.com: the address, subject, content and attachments of each email, and reports whether it was delivered. The email that tells someone a handover waits, and the emailed codes, are among them. They hold no handover value, label or phrase. In the United States, kept for 30 days, with open and click tracking off.

UptimeRobot checks every 5 minutes that the portal is up, and tells Noah when it is not. It receives only that answer, and Noah's own contact details.

Information also reaches:

Microsoft 365, which hosts the studio's mailbox. The portal's notices to Noah, replies to the portal's emails, and care requests emailed to noah@nupikwenpach.com with their attachments, arrive there.

The push services of Apple, Google and Mozilla, which carry notifications to Noah's devices, encrypted so that the service cannot read them. Each names only the business and what happened.

Mercury, the studio's bank. The portal sends Mercury nothing. A payment you make reaches it from your bank, as any payment would.

The studio's professional advisers, such as its accountant, who receive what Noah gives them, in confidence.

Anyone the law entitles to it, when the law requires the studio to disclose it.

What the portal does not use: Twilio or any other text-message service, since the portal sends no text messages; any analytics, advertising or tracking service; and any AI or model provider. Nothing is sold, or shared for advertising. If the studio's business ever passes to someone else, its records go with it, still under this notice.

7. Cookies and browser storage

The portal sets these, each only where it is needed:

__Host-nw_view, on portal.nupikwenpach.com: keeps your place with an offer, such as the code you entered, the options you chose and the confirmed signing code. It lasts 30 days, renewed while the link works.

__Host-nw_client, on portal.nupikwenpach.com: keeps a client signed in. It lasts 30 days, or 7 days unused.

__Host-nw_bench_pending and __Host-nw_bench, on portal.nupikwenpach.com: keep Noah signed in. They last 10 minutes and 12 hours.

A cookie on a live preview's own address, set when you open a preview in a pitch: lets you see the preview you opened, in its frame. It lasts 30 minutes unused, and 2 hours at most. A preview may set cookies of its own for the demonstration to work, and they cannot leave the preview's address.

__stripe_mid and __stripe_sid, set by Stripe on the payment step only, for fraud prevention. They last 1 year and 30 minutes.

One value in your browser's storage, light or dark, only if you press the theme switch. It stays until you clear it, and is never sent anywhere.

If you write in the portal's messages, your browser's storage also keeps a draft of what you are writing, until it is sent, and any message not yet sent, with its photos or files, until the portal has it. They go nowhere but the portal, and signing out clears them.

None of these is for analytics or advertising, so the portal asks no cookie questions.

8. How long it is kept

Signed agreements, signatures, their certificate pages and the audit trail: 7 years after the work under the agreement ends.

Invoices, payments, receipts, refunds, credit notes, disputes and the studio's exports of them, the CSV included: 10 years after the end of the year they belong to. A reminder's record goes with its invoice.

A saved card's record, with the words it was saved under: as long as the agreement to charge it may be questioned, which is the 7 years of a signed agreement. The card itself is removed from Stripe when it is removed here, when it expires, or when nothing is left to charge it for.

A care request, and the checklist for a handoff with what each side said about each item: with the business's account, until 2 years after the last work for the business ends.

The ownership confirmation, signed by both sides, with its certificate page: 7 years after the work under the agreement ends, like a signed agreement.

The record of a handover (the times it was prepared, shown or deleted, and who could open it): 7 years after the work under the agreement ends, as the evidence that the studio handed over what it held. Its labels and notes are deleted with the business's account, 2 years after the last work ends. The values themselves are deleted as section 2 says, and are never part of the record.

A few words, and the record of each use agreed to or taken back: while the words or the use are shown, and 2 years after the last use or the withdrawal, and then deleted. Words never agreed for use, an answer of "Not now" or "No thanks", and the private line to Noah: 2 years after they were written. The studio's list of where the work is shown goes with them.

The record of a consent to be texted: 5 years after it is withdrawn or last used.

An entry on the do-not-contact list: for good, holding only the address, domain or business, the reason and the date, so that a "no" is always honored.

What an offer page recorded, and the options chosen: 90 days after the offer closes, or 30 days for link-preview services and email scanners.

A counter or an offer made on an offer's price: with the offer.

Leads that never became clients, their notes and inquiries: 2 years after the last contact.

A client's account: until 2 years after the last work for the client ends.

Messages, with their photos, PDFs and pictures: for as long as the business is a client, and otherwise until 2 years after the last message in its thread.

Sessions, codes and sign-in links: 30 days after they end. Security records of sign-ins: 12 months. Error reports: 30 days. Delivery reports from the email and payment services: 90 days.

Offer images and video: deleted when the offer's link stops working, but for those in a signed offer, which are kept with the agreement. A pitch's live preview: taken down at once when the offer is declined or withdrawn, and 14 days after it expires.

Copies outside the database age out on their own schedules: Railway's backups and point-in-time recovery copies after about four weeks, the quarterly copy Noah keeps on an encrypted drive away from Railway and Cloudflare after about a quarter, the encrypted backups after 35 days, Railway's logs and Resend's copies of emails after 30 days. A deletion reaches those copies as they age out, and a restored backup never brings a deleted person back into use.

9. Your choices

On every offer, "Not interested" is as easy as accepting. It puts your email address and your business on the studio's do-not-contact list, and the studio will not contact you again.

You can ask for a copy of what the portal holds about you, for a correction, or for it to be deleted, by writing to noah@nupikwenpach.com. There is no form and no account to make. The studio answers within 30 days, and sends the answer only to an address it already holds for you, confirming a request from anywhere else at that address first. It never asks for an identity document.

A deletion removes everything but what the studio keeps for a reason given here, and the answer says what is kept and why: a signed agreement and its record, until its 7 years end; invoices, payments, receipts, refunds, credit notes and disputes, until their 10 years end; a saved card's record and the words it was saved under, until the 7 years end, with the card itself removed from Stripe where nothing is owed; a consent to be texted, for its 5 years, as evidence; the record that a handover was made and when it was shown, without any value, your name, address or browser, for its 7 years; the record of a leave to show the work, without your words or your name, until its 2 years end; the ownership confirmation, for its 7 years; your do-not-contact entry, because deleting it would let the studio contact you again; and a counter or an offer you made on an offer's price, as the studio's record of what it was offered, without your note or your browser. A handover that names you is destroyed at once, and what stays holds times only. Your messages are emptied, and each then reads "A message was removed at the sender's request." What others wrote in the thread stays, and the studio reviews by hand any of it that names you.

You can withdraw your consent to receiving records electronically at any time, as the signing disclosure says.

10. Security

The portal's database can be reached only over its host's private network. The studio's own dump of it is encrypted, Railway's recovery copies are held by Railway under its terms, sign-in tokens and codes are stored only as hashes, and the studio's bank details are stored encrypted. If you find a security problem, please report it to the address in portal.nupikwenpach.com/.well-known/security.txt.

If personal information the portal holds is ever exposed, the studio tells everyone affected within 45 days of finding out, saying what was exposed and what to watch for.

11. Children

The portal is for businesses. It is not directed at children, and the studio does not knowingly collect information from anyone under 13.

12. Where the information is

Railway keeps it in the United States, and Resend sends email from the United States. Cloudflare stores the files in its North American location. Stripe processes card payments under its own terms, which say where.

13. Changes

If this notice changes, the version and the date at the top change with it, and a change that matters is called out here. Earlier versions are kept, and the studio sends one on request.

Version 6 adds what the portal keeps for the work that follows launch: an extra ordered from the menu and the job it makes; a request for care, with the date the studio promised; the handoff of a finished piece of work and the ownership confirmation; a handover of secrets, how it is kept encrypted, when each value is deleted, and the recovery copies at Railway where a value can remain, encrypted, for up to about four weeks; and a few words about the work with leave to show it, and how each is kept, taken back and deleted.

Version 5 adds what the portal keeps for the billing that follows signing: several saved cards for a business, with each card's expiry and the emails that warn of it; the notice before a saved card is charged; the reminders sent to a business that has not paid an invoice, deposits included; a care plan, including one paid for a year at once; credit notes, refunds and a credit left on the account; the CSV kept for the studio's books; and disputes, with what the evidence packet holds and where it goes.

Version 4 added what the portal keeps when you counter an offer's price or make an offer of your own, and when you write in its messages, how long it keeps them, what a deletion leaves of them, and the browser storage the messages use.