Privacy Policy

1. Who we are

Smoky Mountain Sand & Gravel is a concrete and asphalt drop-off yard in Maryville, Tennessee. When this policy says “we,” “us,” or “SMSG,” that's who we mean.

Address: 245 Brookdale Rd, Maryville, TN 37801
Phone: (865) 999-0857

2. Information we collect

We only collect what we actually need to run the yard and answer your questions. Here's every place we gather information:

Website visits

When you browse the site, Google Analytics 4 records anonymous traffic data like pages visited, rough geographic region, device type, and how you got to the site. This data is not tied to your name. Our Google Analytics measurement ID is G-MCTV29G7G5.

Contact form

If you use our contact form, we collect your name, email, phone number, and whatever message you type. We use Formspree to deliver those messages to our inbox.

Contractor account application

If you apply for a business account on our accounts page, we collect information in two tiers depending on what you request.

Basic account info (always): company name, billing address, primary contact name / phone / email, and an optional accounts-payable contact.

Credit application data (only if you request net terms): legal business name and Federal Tax ID (EIN), business type (LLC, corporation, sole proprietorship, etc.), years in business and years at your current address, annual revenue range, requested terms and credit limit, trade references (name, phone, and your account number with each supplier), one bank reference (bank name, officer name, and phone - no bank account numbers are ever collected), owner name, owner title, and a typed digital signature acknowledging our credit terms.

Applications submit directly to our internal system (hosted by Supabase) and appear in our staff dashboard for review. A short notification email (containing your company name and requested terms - no PII) is sent to the office to prompt the review. We do not use Formspree for account applications. If you decline credit and choose cash or COD, we skip the EIN, signature, and credit-specific fields entirely.

Customer portal

Approved contractor accounts can log in to our customer portal. The portal stores your email, phone, name, company, and billing address so we can attach tickets and invoices to the right account. Login is handled through Supabase, which sets a session cookie when you're signed in.

Payment information

Payments at the yard are handled by Stripe, either through a card-present terminal or through a Stripe Payment Link we send by text or email for an open invoice. In every case, the card information is entered directly into Stripe and goes straight to Stripe's systems. SMSG never sees, stores, or logs your card number or CVV. What we do keep is a reference identifier from Stripe (so we can look up the transaction) and the payment amount.

3. How we use your information

We use the information we collect to:

• Answer your questions and follow up on inquiries.
• Review contractor account applications and set up approved accounts.
• Run the customer portal, create tickets, and process invoices and payments.
• Keep transactional records required by Tennessee and federal business law.
• Understand how the website is being used so we can improve it.

We do not use your information for SMS marketing, email newsletters, third-party advertising, or session recording. We don't run any of that.

4. How we share your information

We do not sell your personal information. We share it only with the service providers that help us run the business:

• Supabase - hosts our database (customer records, tickets, invoices, account applications) and handles portal login authentication. Data at rest is encrypted.
• Vercel - hosts the marketing site and the staff / customer web app.
• Stripe - processes card-present payments and Payment Link payments. Handles all card data directly; SMSG never receives your card number or CVV.
• QuickBooks Online (Intuit) - accounting and tax records for approved contractor accounts, including invoices and (for net-terms customers) EIN.
• Resend - delivers transactional email (receipts, portal magic links, application acknowledgements).
• Formspree - delivers contact form messages only. Account applications no longer go through Formspree.
• Google (Analytics 4) - provides the anonymous traffic analytics described above.
• Sentry - application error and performance monitoring. Personal information is automatically stripped from events before they reach Sentry.

These providers act as processors on our behalf. They are not permitted to use your information for their own marketing. We may also disclose information if required by law, court order, or valid legal process.

5. Cookies and tracking

The site uses a small number of cookies:

• Google Analytics cookies (_ga, _ga_*) - used for anonymous traffic measurement.
• Supabase session cookie - set only on portal pages once you're logged in, so you stay logged in while you use the portal.

You can decline analytics cookies through our cookie banner. You can also install Google's official opt-out browser add-on to block Google Analytics across the whole web. Most browsers also let you clear or block cookies in settings.

6. Your rights

You can ask us to show you what personal information we have about you, correct anything that's wrong, or delete it. Just call or email us and we'll take care of it. We may need to keep some records to meet our legal and tax obligations - if we can't fully delete something for that reason, we'll tell you why.

Tennessee residents

Under the Tennessee Information Protection Act (TIPA), Tennessee residents have the right to access, correct, delete, and receive a portable copy of their personal information, as well as the right to opt out of the sale of personal information, targeted advertising, and certain profiling. We do not sell personal information, we don't run targeted advertising, and we don't profile customers for significant decisions. To exercise any TIPA right, use the contact info below.

7. California residents

If you live in California, the CCPA gives you the right to know what personal information we've collected about you, request deletion, and opt out of the sale of personal information. SMSG does not sell personal information to anyone. To exercise your rights, contact us using the information at the bottom of this page.

8. Children's privacy

This website is not directed at children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has submitted information through our site, contact us and we'll delete it.

9. How long we keep information

Transactional and account records - invoices, tickets, contractor account applications (including EIN and digital signature on file), and anything else tied to a business transaction - are kept for at least seven years to meet Tennessee and federal business record-keeping requirements. Some records may be kept longer if the law requires it.

Website analytics data is kept only as long as Google Analytics retains it under our account settings (typically much shorter than seven years), and it's not linked to you personally. Contact form submissions are kept as long as we reasonably need them to follow up with you.

If you close your account, we deactivate it so it stops appearing in day-to-day staff views but retain the underlying transactional records for the seven-year retention window. On written request we will permanently delete any information not required by law to be kept.

10. Security

We use industry-standard administrative and technical measures to protect your information:

• All connections use HTTPS with HSTS (browsers refuse plain HTTP for our site for two years after the first visit).
• Data at rest in our database is encrypted by our hosting provider.
• Row-level security ensures each customer's data is only accessible to that customer through their portal login, or to authorized SMSG staff with a valid employee session and the appropriate role.
• Database backups are encrypted with GPG before being stored, requiring a passphrase we hold offline.
• Employee access requires a PIN with server-side bcrypt hashing and a forced first-login password change.
• The customer portal uses magic-link email authentication - there is no reusable password to leak.
• Error and performance monitoring automatically strips personal information from events before they are stored.
• Publicly-callable endpoints (such as the account application form) are rate-limited to prevent abuse and scraping.
• Access to production systems is limited to owners and administrators, tracked, and reviewed periodically.

That said, no online system is perfectly secure. We can't guarantee absolute protection, but we work to reduce risk and to respond quickly if something goes wrong. If you believe your information has been compromised, please contact us immediately using the phone number below.

11. Changes to this policy

If we update this policy, we'll change the “Last updated” date at the top. If the changes are material - meaning they meaningfully affect how we handle your information - we'll post a notice on the site or contact active account holders directly.

12. How to contact us

Questions about this policy, or want to exercise one of the rights above? Reach out: