Legal
Privacy
The only personal information this site collects is what you type into the contact form. There is no advertising and nothing on any page that reports back to a third party. The site counts a few of its own interface interactions anonymously, on its own server, without cookies or identifiers, and stops even that if your browser asks not to be tracked.
Last updated
Who this is about
This notice covers lakeholdings.com, the website published by Lake Holdings Corp LLC at PMB 176, 229 Airport Rd Ste 7, Arden, North Carolina 28704. Questions about anything here go to info@lakeholdings.com.
Reading the site
Reading a page here collects no personal information. The fonts, the images, the stylesheets and the small amount of JavaScript are all served from this domain. There is no third party analytics package, no tag manager, no advertising pixel, no social widget, no embedded video and no comment system.
Interaction counts
The site does count a small, fixed set of its own interface interactions (for example, a hover or click on a mark on the home page timeline) so the company can tell which parts of the design earn their place. Each count is a single line written to the site's own server log containing only the event name, drawn from a fixed allow list, and the name of the interface element involved. No cookie is set, no visitor identifier is created or stored, no network address is kept with the count, and nothing leaves this domain. The log lines live only as long as the server's ordinary rolling logs, are readable only by the company, and cannot be connected to you or to a contact form submission.
Opening a page does not cause your browser to contact anyone else. The server sends a content security policy that restricts the browser to this origin, which is what makes that a technical fact rather than a promise.
A Do Not Track or Global Privacy Control signal is honoured: if your browser sends either, the interaction counts above are not sent at all, and nothing else exists for the signal to switch off.
The contact form
The form asks for five things, one of which is optional:
- your name
- your email address
- your organisation, which you can leave empty
- a topic, chosen from a fixed list
- your message
When you send it, the message is written to a database on the company's own server first and emailed second. That order is deliberate: if the mail service is unavailable the enquiry is still on record rather than lost, which for a company whose website is its front door is the failure mode that matters.
Three further things are recorded alongside what you typed:
- A keyed digest of your network address. Not the address itself. The address is passed through a keyed one way hash and truncated, and only that short string is stored. It cannot be turned back into an address, and without the server's key it cannot be matched against a guess either. It exists so the form can tell how many messages have arrived from one connection in the last hour and refuse the rest.
- The first part of your browser's user agent string. The opening characters of the line every browser sends identifying itself, its version and its platform, truncated to a fixed length before it is stored. It is kept so that an abusive pattern can be recognised.
- Delivery bookkeeping. The time the message arrived, a reference number of the form LH followed by the date and a short random code, whether the notification email was accepted, and the error text if it was not.
A line is also written to the site's administrative audit log recording that an enquiry was received, its reference number, whether the email went out, and the same address digest. The audit log does not contain the text of your message.
The email that is sent
A notification is sent to info@lakeholdings.com containing the reference number, the time, the topic, your name, your email address, your organisation if you gave one, and the message itself. Where the site is configured to do so, your address is set as the reply address on that email, so replying to it replies to you. The email leaves through whichever mail service the company has configured, and that service handles the message in transit in the ordinary way any mail provider does.
Cookies
There are two, both strictly necessary, and neither is used to follow you anywhere.
| Cookie | Purpose | Life |
|---|---|---|
| __Host-lh_csrf | Carries a signed random token that the contact form must echo back. It is what stops a form on somebody else's website from posting to this one. It holds a random value and nothing about you. | 8 hours |
| __Host-lh_session | Set only after an administrator signs in to the private editing area. An ordinary visitor is never given one. | 12 hours |
Both are set with the HttpOnly flag, so no script can read them; with SameSite set to strict, so they are not sent on a request that started somewhere else; and over HTTPS only. There are no analytics cookies, no advertising cookies and no cross site identifiers, which is why this site has no cookie consent banner to click through.
Third parties
Nothing on a page here is loaded from another company. The one unavoidable exception is the network in front of the site: Cloudflare sits between your browser and the server as a network provider, so your request reaches Cloudflare before it reaches us and Cloudflare handles connection data as part of routing and protecting that traffic. That is a property of how the site is hosted rather than a choice about your data, and it is stated here because it is true.
The site is not sold, rented, syndicated or shared with advertisers, data brokers or mailing list vendors, and neither is anything you send through it.
Where it is kept, and for how long
Messages live in a single database file on hardware the company runs itself, not on a third party form service and not in a customer relationship platform. There is no automatic deletion schedule, which means an enquiry stays until somebody removes it. That is stated plainly rather than dressed up as a retention policy the software does not enforce.
The counters used for rate limiting hold only the digest described above, and they are overwritten as each hour rolls over.
Asking for a message to be deleted
Email info@lakeholdings.com and say that you want your enquiry removed. Quote the reference number if you have it, because that finds the right record immediately; if you do not, the address you wrote from is enough. The record will be deleted from the database. Copies already delivered to the company mailbox are subject to that mailbox's own housekeeping, and if you want those removed as well, say so and they will be.
The same address is the right one for asking what is held about you, or for correcting it.
How it is protected
- Everything is served over HTTPS, with the connection upgraded automatically.
- A strict content security policy prevents the browser from loading script, styles, fonts or images from anywhere but this origin.
- The contact form is protected by an origin check, a signed token bound to the cookie above, a field no human ever sees, a minimum time on page and a per connection rate limit.
- Administrator passwords are stored as scrypt derivations, never as recoverable text, and administrator sessions are bound to the address digest and browser they were issued to.
- Diagnostic messages written to the server's log when something fails carry the reference number and the technical error, not the body of your message.
No system is beyond compromise and this notice does not claim otherwise. Please do not send confidential, privileged or sensitive personal information through the form. It is a contact form, not a secure channel.
Changes
This notice describes the site as it is actually built. If the software changes in a way that changes what is collected, this page is edited to match and the date at the top moves with it.
Questions
Write to info@lakeholdings.com, or by post to Lake Holdings Corp LLC, PMB 176, 229 Airport Rd Ste 7, Arden, North Carolina 28704.