Privacy Policy

1. Who we are

Green Mango Systems, Inc. (“we” or “us”) operates Iron Fountain: the website at www.ironfountain.com, the dashboard, API, and AI connections at app.ironfountain.com, the hosting service, and our email. This policy explains the personal information we handle, why, who processes it for us, how long we keep it, and your choices. Contact: complaints@ironfountain.com, Green Mango Systems, Inc., 440 N Barranca Ave, #6264, Covina, CA 91723, United States.

2. Information we collect

Account information: your name, email address, organization names, roles, and a one-way hash of your password (never the password itself). We record when you accepted the Terms and whether you chose to receive marketing email. API keys, sessions, and invitations are stored only as hashes.

Billing information: Stripe collects and stores your card. We keep Stripe customer, subscription, and invoice identifiers, the plan and price you chose, and payment status. We display your card’s brand and last four digits by asking Stripe; we do not store card numbers.

Sites and imports: the files you publish and their revision history, the addresses of websites you import, and, for each import, a consent record with the Terms version, the declaration you accepted, the time, your account or an anonymous browser identifier, and a hashed network identifier derived from your IP address that helps enforce test limits.

Form submissions: when visitors submit a form on a site we host, we store the fields and files they submit for the site’s owner. We do not record the visitor’s IP address with a submission; rate limits use short-lived hashed network identifiers.

Email: messages we send you and their delivery, bounce, and complaint status (we do not track opens or clicks), and messages you send to our addresses, stored in full with the sending server’s address.

Usage and security: bandwidth totals per site and day, without visitor IP addresses, and operational and security records needed to run and protect the service.

Business contact information: to offer hosting to businesses, we compile information about business websites from commercial website-technology directories and from the websites’ own public pages: the business name and website address, and publicly listed email addresses, phone numbers, social media profiles, and the structure of contact forms. Our crawler identifies itself as IronFountain-Leads, follows robots.txt, and does not store page contents.

3. Cookies and similar technologies

The dashboard uses strictly necessary cookies: a sign-in session cookie (14 days), an anonymous test-site cookie that ties an import to your browser (48 hours), and a short-lived cookie that carries a message between pages (2 minutes). It stores your selected organization in your browser. The card form is provided by Stripe, which may use its own cookies for fraud prevention.

We do not use analytics, advertising, or tracking cookies on our website or dashboard. Our hosting does not set cookies on the sites it serves. Sites our customers publish may include their own scripts and cookies, which are governed by those site owners’ policies.

4. How we use information

We use personal information to provide, secure, and support Iron Fountain; to verify email addresses, authenticate you, and enforce limits; to process payments and send receipts and billing notices; to send service messages; to send marketing email only when you opted in; to contact businesses about our hosting using business contact information; to prevent abuse and fraud; and to meet legal obligations and resolve disputes.

5. Who processes information for us

We share personal information with service providers that process it on our behalf: Bunny.net (content delivery, compute, and hosting), Cloudflare (file and mail storage), Turso (databases), Amazon Web Services (email delivery, DNS, backups, and monitoring), Stripe (payments), and Let’s Encrypt (certificates; hostnames appear in public certificate logs). Organization owners and editors can see their organization’s sites, form submissions, and members.

We do not sell personal information and do not share it for cross-context behavioral advertising. We may disclose information when required by law, to protect rights and safety, or as part of a merger or acquisition, subject to this policy.

6. Visitors to sites we host

Customers decide what their sites collect and are responsible for their own privacy notices. We process form submissions and site files on their behalf. If you submitted information to a site we host, contact that site’s owner to access or delete it; we will help them respond.

7. How long we keep information

Unsaved test sites and their files are deleted about one hour after an import starts. Account and site information is kept while the account is active and the site exists. Form submissions and received files are kept until the site’s owner deletes them or deletes the site. Consent, agreement, billing, email delivery, and suppression records are kept after a site or account ends where needed for legal obligations, disputes, and abuse prevention. Messages sent to our addresses are kept until we delete them. Business contact information is kept while it is useful for outreach; if you ask us not to contact you, we keep only what is needed to honor that request.

Backups hold copies of our databases and stored files for up to about a year (hourly copies for 3 days, daily for 30, weekly for about 3 months, monthly for about a year) and then expire. Monitoring records are kept for 30 to 90 days.

8. Your choices and rights

You can update your password in the dashboard and unsubscribe from marketing email using the link in any marketing message. To access, correct, or delete your personal information, close your account, or stop business outreach, email complaints@ironfountain.com. We will verify the request and respond within the time required by applicable law.

California residents have the right to know what personal information we collect, use, and disclose, to request deletion or correction, and to opt out of the sale or sharing of personal information, which we do not do. We will not discriminate against you for exercising these rights. An authorized agent may make a request for you with proof of authorization.

9. Security

We protect information with encryption in transit, hashed passwords and tokens, encrypted private keys and email contents at rest, restricted access, and independently tested backups. No service can guarantee perfect security; please tell us promptly at the address below if you suspect a problem.

10. Where information is processed

Iron Fountain is operated from the United States, and our providers store and process information in the United States. Content delivered to visitors is cached by our delivery network worldwide. By using the service from elsewhere, you understand that your information is processed in the United States.

11. Children

Iron Fountain is for people aged 18 and over and is not directed to children. We do not knowingly collect children’s personal information; contact us if you believe we have.

12. Changes and contact

We publish the date of each version of this policy and will identify material changes in the service before they take effect.

Green Mango Systems, Inc., 440 N Barranca Ave, #6264, Covina, CA 91723, United States. Privacy contact: complaints@ironfountain.com.