Privacy

Project briefs and direct questions

The forms collect only the fields they display. Accepted submissions are stored in the account-owned Cloudflare D1 database. Turnstile helps verify human submissions. Queue receives only a brief reference—not the full form—to validate the stored record for human review.

Retention

Unqualified inquiries and direct questions are automatically deleted after 90 days. During human review, a record can be placed on retention hold if it becomes an active opportunity or a contracted engagement; held records are governed by the resulting project agreement and standard accounting obligations rather than the 90-day default. Deletion requests outside that schedule can be made through the contact form, referencing the original submission. The retention sweep runs daily; its last completion time and how many expired records it removed are visible on the system status page—no record contents are shown, only the run outcome and a count. A draft saved locally in a project-brief form is stored only in that browser and can be cleared at any time; it is never part of this automatic deletion because it never leaves the visitor's device.

Signal Strategist

The strategist sends the selected organization type, objective, and optional non-sensitive constraint to Cloudflare Workers AI. A public 12-module Vectorize index grounds retrieval. AI Gateway caching is enabled but prompt logging is disabled; the application also requests no per-call log collection. D1 stores daily counters and a one-way hash of the request IP, combined with the calendar date, for the three-per-visitor daily cap—so the stored value changes every day and one day's record cannot be matched to another day's for the same visitor. Counter rows are deleted automatically after 30 days. KV may cache the approved response under a one-way input hash for up to 24 hours. Do not enter personal or confidential information.

Operational measurement and evidence

Workers KV supports short-lived rate-limit, duplicate, and response-cache state. The Analytics Engine adapter is configured to receive only aggregate module, objective, and outcome labels; it does not receive form contents, names, email addresses, free-text constraints, or raw IP addresses. The daily SiteSentinel process stores its latest timestamp, origin, route count, pass count, and overall status in one private R2 object. That stable object is overwritten on the next run instead of creating an accumulating archive.

What is not active

This release does not include advertising trackers, behavioral profiles, an email-delivery provider, a customer portal, or public file uploads. Provider secrets are never sent to the browser. R2 is active only for the latest non-sensitive SiteSentinel evidence record; ProofVault remains an honest control preview rather than a live client upload or delivery portal.

Sensitive information

Forms reject or warn against passwords, payment-card data, government identifiers, medical records, confidential legal files, and unnecessary personal information. Do not submit those categories.

Client work

Deployments created for clients receive project-specific data categories, retention rules, deletion procedures, subprocessors, access controls, and incident contacts before live collection begins.

Privacy contact

Privacy questions, corrections, or deletion requests outside the standard schedule can be sent to [email protected].