Privacy Policy

1 Introduction and Identity of the Controller

DrexStack is a brand name operated by Crimson Stone LLC, a Texas limited liability company (“Crimson Stone,” “DrexStack,” “we,” “us,” or “our”). Our principal place of business is in Dallas, Texas. We are responsible for the personal information we collect, use, and disclose in connection with our website and services.

This Privacy Policy explains how DrexStack collects, uses, stores, shares, and protects your personal information when you visit our website at drexstack.com, submit a form, communicate with us via SMS or email, or otherwise engage with our services. It also describes your rights with respect to your personal information and how you can exercise those rights.

If you have questions about this Privacy Policy or our data practices, you may contact us at:

2 Information We Collect

2.1 Information You Provide Directly

We collect personal information that you voluntarily provide to us when you interact with our website or services, including:

• Contact information: first name, last name, email address, and phone number.
• Business information: business name, industry type, and description of services needed.
• Communication preferences: your consent to receive transactional and marketing SMS messages.
• Inquiry information: the nature of your interest, urgency of your need, and any details you provide in forms or communications.
• Payment information: if you engage our paid services, billing name, address, and payment card details processed through our third-party payment processor. We do not store payment card numbers on our servers.

2.2 Information Collected Automatically

When you visit our website, we automatically collect certain technical information, including:

• Device information: IP address, browser type and version, operating system, and device identifiers.
• Usage data: pages visited, time spent on pages, links clicked, referring URLs, and navigation paths.
• Cookie data: session cookies, persistent cookies, and similar tracking technologies as described in Section 7.
• Log files: server logs that record requests made to our web servers, including timestamps and error codes.

2.3 Information from Third Parties

We may receive information about you from analytics providers, advertising platforms, CRM tools, and payment processors as part of operating our business.

2.4 Sensitive Information

3 How We Use Your Information

3.1 Providing and Managing Services

• To respond to your inquiries and schedule strategy calls.
• To assess your business needs and propose appropriate service solutions.
• To deliver, configure, and manage the CRM, automation, and AI systems we build for you.
• To send service-related communications including appointment confirmations, project updates, and billing notices.
• To process payments and maintain financial records.

3.2 SMS and Electronic Communications

With your prior express written consent obtained through our opt-in process, we may send you transactional SMS messages (appointment reminders, project updates, follow-up communications) and, if separately consented to, marketing SMS messages. All SMS communications are governed by Section 6 of this Privacy Policy.

3.3 Business Operations

• To analyze usage patterns and improve our website and services.
• To comply with legal obligations and protect our legal rights.
• To detect, prevent, and address fraud, security incidents, and other harmful activity.
• To maintain records required for tax, accounting, and legal compliance.

4 How We Share Your Information

4.1 We Do Not Sell Your Personal Information

4.2 Service Providers

We share personal information with trusted third-party service providers, including:

• GoHighLevel: CRM and automation platform used to manage client pipelines and communications.
• Zapier / Make: Integration platforms used to connect business tools and automate data transfers.
• Twilio / LeadConnector (LC Phone): SMS and voice communication infrastructure.
• Google Analytics: Web analytics service used to understand website traffic.
• Payment processors: Third-party payment platforms used to process transactions securely.
• Cloud hosting providers: Infrastructure providers hosting our website and business systems.

All service providers are contractually required to use your personal information only as necessary to perform services on our behalf.

4.3 Legal Requirements and Safety

We may disclose your personal information if required to comply with applicable law, enforce our Terms of Service, protect the rights or safety of DrexStack or the public, or detect fraud or security vulnerabilities.

4.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, your personal information may be transferred. We will provide notice before your information becomes subject to a different privacy policy.

5 Data Retention

We retain personal information for as long as necessary to fulfill the purposes for which it was collected, comply with legal obligations, resolve disputes, and enforce agreements:

• Active client records: duration of the engagement plus seven (7) years.
• Prospective client inquiry records: three (3) years from the date of initial contact.
• SMS consent records: minimum of five (5) years from date of consent per TCPA and A2P 10DLC carrier requirements.
• Financial and payment records: seven (7) years per IRS requirements.
• Website analytics data: twenty-six (26) months as configured in Google Analytics.
• Marketing email opt-out records: retained indefinitely to honor opt-out requests.

6 A2P SMS Messaging Policy

6.1 Overview

DrexStack sends SMS messages through Application-to-Person (A2P) messaging channels, which are regulated by the Telephone Consumer Protection Act (TCPA), the CAN-SPAM Act, and the rules of mobile carriers and The Campaign Registry (TCR). All SMS campaigns operated by Crimson Stone LLC are registered with TCR under the A2P 10DLC framework as required by U.S. mobile carriers.

6.2 Consent Requirements

Consent to receive SMS messages is never required as a condition of purchasing services. You may opt in to transactional messages only without opting in to marketing messages.

6.3 Types of SMS Messages

Transactional Messages — Appointment reminders and confirmations, project status updates, system launch notifications, onboarding instructions, billing alerts, and other messages directly related to services you have requested. Transactional messages are sent as needed and do not follow a fixed frequency.

Marketing Messages — Promotional content about DrexStack services, new service announcements, case studies, industry tips, and special offers. Marketing messages are sent only to contacts who have separately opted in to marketing communications.

6.4 Message Frequency

Transactional message frequency varies based on your engagement. Marketing message frequency will not exceed four (4) messages per month unless separately consented to. Message frequency will be stated in our opt-in disclosures.

6.5 Message and Data Rates

Standard message and data rates may apply. These rates are set by your mobile carrier and are not controlled by DrexStack.

6.6 How to Opt Out

6.7 How to Get Help

Reply HELP to any SMS message from us or contact us at legal@drexstack.com. We will respond within two (2) business days.

6.8 No Sharing of SMS Opt-In Data

Phone numbers obtained through our SMS opt-in process are not shared with third parties for their own marketing purposes. Your phone number may be shared with service providers such as Twilio or GoHighLevel solely for the purpose of delivering SMS messages on our behalf.

6.9 Supported Carriers

SMS services are available to users of all major U.S. mobile carriers including AT&T, Verizon, T-Mobile, Sprint, Boost Mobile, Metro PCS, Cricket Wireless, US Cellular, and other domestic carriers.

6.10 A2P 10DLC Registration

DrexStack's SMS campaigns are registered under the A2P 10DLC framework with The Campaign Registry (TCR). Our registered business entity is Crimson Stone LLC, Dallas, Texas. Cross-brand SMS messaging does not occur without separate opt-in consent.

7 Cookies and Tracking Technologies

We use the following types of cookies:

• Strictly necessary cookies: Required for the website to function. These cannot be disabled.
• Performance and analytics cookies: Anonymous data about how visitors use our website, including Google Analytics cookies (_ga, _gid, _gat).
• Functionality cookies: Remember your preferences for a more personalized experience.
• Marketing cookies: Track visitors to display relevant advertising, if applicable.

You can control cookies through your browser settings. You can opt out of Google Analytics via the Google Analytics Opt-out Browser Add-on.

8 Data Security

We implement commercially reasonable technical, administrative, and physical safeguards including:

• Encryption of data in transit using Transport Layer Security (TLS) protocols.
• Access controls limiting personal data access to authorized personnel on a need-to-know basis.
• Regular review of data collection, storage, and processing practices.
• Vendor security assessments for third-party service providers handling personal data.

No method of data transmission or storage is completely secure. We cannot guarantee absolute security. In the event of a data breach affecting your personal information, we will notify you as required by applicable law.

9 Your Privacy Rights

9.1 General Rights

Depending on your jurisdiction, you may have the right to access, correct, delete, restrict, or port your personal information, and to object to or withdraw consent for certain processing.

9.2 California Residents (CCPA/CPRA)

California residents have the right to know what personal information is collected, the right to opt out of the sale of personal information (we do not sell personal information), the right to non-discrimination for exercising privacy rights, and the right to correct inaccurate personal information. To exercise these rights, contact us at legal@drexstack.com with the subject line “California Privacy Request.”

9.3 Texas Residents (TDPSA)

Texas residents have rights to access, correct, delete, and obtain a copy of their personal data, as well as the right to opt out of the processing of personal data for targeted advertising. Contact us at legal@drexstack.com with the subject line “Texas Privacy Request.”

9.4 How to Exercise Your Rights

Submit a request to legal@drexstack.com. We will respond within 30 days. We may need to verify your identity before processing your request. We will not discriminate against you for exercising your privacy rights.

10 Children's Privacy

Our website and services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children under 18. If you believe we may have collected information from a minor, please contact us immediately at legal@drexstack.com.

11 Third-Party Links

Our website may contain links to third-party websites. We are not responsible for the privacy practices of those websites. We encourage you to review their privacy policies before providing any personal information.

12 Changes to This Privacy Policy

We may update this Privacy Policy periodically. We will post the updated policy on our website with a new effective date. For material changes, we will provide additional notice by email or prominent website banner. Your continued use of our website or services after any changes constitutes your acceptance of the updated policy.

13 Contact Information

For questions, complaints, or requests related to this Privacy Policy: