Privacy Policy

We collect as little as we can and we are plain about what we do with it. This page describes what data this site gathers, where it lives, and what rights you have over it. If anything here is unclear, ask us through the contact page and we will give you a straight answer.

What we collect

We only collect information you choose to give us. There are three places that happens.

• The contact form. Your name, email address, company, and the message you write.
• The assessment download form. Your name, email address, company, and role.
• The newsletter signup. Your email address.

When you submit any of these forms, we also record some context alongside your submission: the page you submitted it from, any campaign parameters in the page address, the referring page, your browser's user-agent string, and a keyed one-way hash of your IP address. We keep this with your submission to protect the site from abuse and to understand which pages bring people to us. We do not buy or append data about you from other sources, and browsing the site without submitting a form stores nothing about you beyond the anonymized analytics described below.

What we use it for

We use your information for the purpose you gave it to us and nothing else.

• To respond to your inquiry when you write to us.
• To deliver the resource you asked for, such as the AI maturity assessment.
• To send the newsletter you signed up for. Every newsletter email includes an unsubscribe link, and unsubscribing takes effect immediately.

We do not sell your data. We do not share it with anyone beyond the service providers named below, and those providers act only on our instructions.

Where it is stored and who processes it

Running a website means relying on a small number of service providers. Here are ours.

• Google Cloud Firestore stores the form submissions described above.
• Resend sends our transactional email, such as the message that delivers a resource you requested.
• Vercel Analytics gives us anonymized, aggregate statistics about how the site is used. If we enable Google Analytics 4, it serves the same purpose under the same constraint: aggregate patterns, not individual surveillance.

IP addresses

We do not store your IP address in raw form. To protect the site from abuse, we apply a keyed one-way hash to IP addresses, which we use for rate limiting and keep alongside form submissions. The hash cannot be reversed to recover your address. We use it only to recognize repeated abuse from the same connection, never to profile you.

Cookies

Cookies on this site are limited to analytics. We do not use advertising cookies, tracking pixels from ad networks, or cross-site identifiers.

Our lawful basis

Where data protection law such as the GDPR applies, we rely on two lawful bases. We rely on your consent when you sign up for the newsletter or request a resource. We rely on legitimate interest when we respond to an inquiry you sent us and when we keep the site secure through measures like rate limiting. We do not claim any formal certification, and we will not pretend to one. What we claim is the practice described on this page.

Your rights

You can ask us what information we hold about you, and you can ask us to delete it. Contact us through the contact page or reply to any email we have sent you, and we will act on the request. We will not make you navigate a process designed to discourage you. If you are in a jurisdiction that grants you further rights over your data, we will honor those too.

How long we keep it

We keep contact and download submissions for as long as we need them to handle your inquiry or maintain our relationship with you. Newsletter addresses are kept until you unsubscribe. When data no longer serves the purpose you gave it for, we delete it.

Changes to this policy

If our practices change, this page will change with them, and the date at the top will tell you when. We will not quietly expand what we collect. A meaningful change in how we handle your data is something you deserve to see stated plainly.