Privacy Policy

SuiteResources is a one-person NetSuite software practice. This policy covers the two websites it runs — suiteresources.com and blog.suiteresources.com — and describes what those sites collect from the people who visit them: through the contact form, through the migration sign-up, and through the analytics and advertising tags the public pages carry.

What it does not cover. Work delivered under an engagement is governed by the agreement for that work, not by this page. If I am migrating scripts in your NetSuite account, that account, its data and the credentials that reach it sit under that agreement and under your own arrangement with Oracle NetSuite. The applications described on this site are separate products with their own sign-in and their own terms.

An earlier version of this policy described the SuiteQL application previously served at this address. That application is being retired, and this replaces it.

The contact form

Your name, your email address, and your message. All three are written to our own database first and emailed to us second — in that order deliberately, because a message that is stored cannot be lost to a mail outage.

We also record the IP address a submission came from, which is enough to recognize a flood of spam. We do not store your browser's user-agent string: it identifies you better than it helps us.

The migration sign-up

Requesting a place on a SuiteScript migration engagement asks for the tier you want, your name, your email address, and — optionally — your company and any notes you care to add. The IP address is recorded, as above. There is no field for an amount; what a tier costs is decided on our side, not submitted from the form.

A sign-up is a request until it is approved, and nothing is charged when you submit one. We review it and email you where it stands — approved, declined or waitlisted, with a note where a decision needs explaining. An approval carries a private link to your own checkout: a long random address rather than an account you have to create, for the same reason invoices work that way. Anyone holding that link can see that sign-up, so treat it as private to you.

Payment is processed by Stripe. The card and bank fields on the checkout are Stripe's own — rendered by Stripe's code, submitted directly to Stripe. Card numbers and bank account numbers never pass through this site and are never stored by us.

What is kept against your sign-up is the record of the transaction, not the instrument:

• an identifier for the payment
• its status
• the amount and currency, captured at the moment the payment is created
• whether it was a card or a bank debit
• when it was paid

The amount is stored rather than looked up afterwards, so the record says what you were actually charged even if that tier is repriced later.

Stripe handles payment data under its own privacy policy and its own obligations as a payment processor.

Server logs

Standard web-server and application logs: which pages were requested, when, from which IP address, and any errors. They exist to keep the site working and to investigate abuse.

Cookies this site sets itself

A session cookie and a matching form token, so a submission can be shown to have come from the page it appears on. They carry nothing about you and are not used to track anything.

Analytics and advertising

Public pages load Google Analytics 4 and Google AdSense. Both set their own cookies and identifiers in your browser and send data to Google — page views and approximate location for analytics; ad requests and Google's own invalid-traffic checks for advertising. For what those tags collect, Google is the party in control, under its own privacy policy, and it may use that data across the sites in its networks.

We see analytics as aggregate numbers about pages, never as a named person, and we do not join it to anything you sent us through a form.

If you would rather not carry it: browser settings can block cookies and third-party scripts for this site, Google's Ads Settings control ad personalization, and Google publishes an opt-out add-on for Analytics. Nothing on this site needs those tags in order to work, so blocking them costs you nothing here.

One other outside request

The image lightbox used on some pages is served from a public CDN (jsDelivr). Requesting a file reveals your IP address to the service serving it, as every web request does. Nothing else about you is sent with it.

Information you send through this site is used to reply to you, to decide on and run a sign-up, to take and reconcile payment, to send the transactional email a sign-up needs, to keep the site working and free of abuse, and to understand at a coarse level which pages people read.

That is the whole list. In particular:

• Nothing is sold, rented or traded. There is no arrangement under which it could be.
• Neither form is a mailing list. Sending an enquiry or a sign-up subscribes you to nothing. If a newsletter ever exists, it will ask first.
• No profiling, and no automated decisions about you. Whether a sign-up is approved is a person's judgment, and a declined or waitlisted one comes back with a reason.
• No sharing beyond the services named on this page, except where the law requires it.

Retention

• Enquiries are kept as the record of who asked what and whether an answer went out. Ask for yours to be deleted and it will be.
• Sign-ups and their payment records are kept as long as the engagement and the accounting behind it require. A paid transaction is a financial record, and deleting the money trail is not something either of us gets to choose.
• Server logs are short-lived, and exist for operations and abuse.
• Analytics and advertising data is retained by Google under Google's retention settings, not ours.

Security

Everything is served over HTTPS. The database is not reachable from the public internet, and the records of enquiries and sign-ups are only reachable through an authenticated administrative interface. A sign-up's checkout link is an unguessable random token rather than a sequential address, so knowing one tells you nothing about any other.

No website can promise absolute security and this one will not. What it can tell you is what it has chosen not to hold: no card or bank numbers, no passwords for visitors, no browser fingerprint on an enquiry.

Your rights

Depending on where you live you may have the right to ask for a copy of what is held about you, to have it corrected, to have it deleted, to object to how it is used, or to withdraw consent where consent is what permits it. You are welcome to ask wherever you live — the answer does not depend on which law compels it.

In practice: an enquiry or a sign-up request will be deleted if you ask; analytics and advertising data held by Google has to be reached through Google's own controls, because we cannot reach into it; and you will get an answer within 30 days.

Children

This is a site about NetSuite development. It is not directed at children, and nothing here knowingly collects information from anyone under 16.

Changes to this policy

If what the site collects changes, this page changes with it and the date at the top moves. A material change in how already-collected information is used will be sent by email to the people it affects, where we have an address for them.

Who to ask

Questions, requests and complaints all go to the same place — the contact form on this site. It is a one-person practice; you will be talking to Dave Weiss.