What we do with your data, in plain language
This page exists because trust pages are usually written to be legally sufficient rather than readable. Here is the short version, followed by the detail.
Privacy — the short version
- We do not run Google Analytics, Facebook pixels, or any third-party advertising tracker.
- Site analytics are self-hosted (Umami): aggregate page views only, no cookies, no cross-site profiling.
- The only personal data we collect is what you type into a form, or what you send us by email.
- We do not sell data, and we do not share it with anyone not listed below.
- You can ask us to delete everything we hold about you, and we will confirm when it is done.
What we collect and why
- Enquiry form submissions
- Name, work email, company, and whatever you write in the message. Used to reply to you and, if you become a customer, to manage the engagement. Retained for 24 months from last contact, then deleted.
- Checklist downloads
- Name, email, company. Used to send the file and to follow up once. If you do not reply, we stop. Retained for 12 months, then deleted.
- Aggregate site analytics
- Page views, referrer, country, device class. No IP addresses stored, no cookies set, no individual visitor identification. Retained for 12 months.
- Server logs
- Access logs with IP addresses, kept for 14 days for security and abuse investigation, then rotated out.
- Customer engagement data
- Architecture documents, runbooks and access credentials created during an engagement are governed by the contract, not by this page. Contracts specify retention and deletion; credentials are handed back or destroyed at offboarding.
Subprocessors
Anyone who touches data on our behalf is listed here. If this list changes in a way that affects you, customers are notified before the change takes effect.
| Provider | Role | Data exposed | Region |
|---|---|---|---|
| Cloudflare | DNS, CDN, WAF, bot mitigation | Request metadata, IP addresses | Global edge |
| Self-hosted analytics (Umami) | Traffic measurement | Aggregated page views, no cookies, no personal identifiers | Our servers, US |
| Transactional email provider | Delivering replies to your enquiry | Name, email, message content | US |
| Object storage provider | Encrypted backup of enquiry database | Encrypted blobs only | US |
Your rights
If you are in California or the EU, you have the right to access, correct, export or delete the personal data we hold about you, and to object to processing. Email botonwa@gmail.com and we will respond within 30 days — in practice, much sooner.
How we handle security
- Site is served over TLS 1.2+ with HSTS, and certificates renew automatically.
- Access to production systems is by SSH key only, with no password authentication.
- Customer infrastructure access is granted per-engagement, logged, and revoked at handover.
- The enquiry database is backed up daily, encrypted, and stored separately from the application.
Compliance status
Stated honestly rather than aspirationally — see the about page for the current status of each framework.
Terms of service
Placeholder. Master services agreement and terms of service are drafted with counsel and published here before launch. Scope, SLA definitions, liability limits and termination terms live in that document, not on this page.