What we collect
When you submit the form at /contact, we collect the fields you fill in: your name, email address, an optional company or project name, the shape of engagement you're considering, and the message you write. None of these fields are pre-filled and none are mandatory beyond the ones marked required on the form.
We also log technical metadata with each submission: the IP address the request came from and the user-agent string your browser sends. We use these to defend the form against spam and abuse, not to profile visitors.
We use Google Analytics 4 to measure aggregate site usage: which pages are visited, how long visitors stay, and which links get clicked. GA4 is configured with anonymize_ip on and advertising-personalisation signals off, so the data is measurement-only and not used for ad targeting. We do not run any other third-party tracking. If we add another tool, this page changes before it turns on.
How we use it
We use what you send us to reply to your inquiry, scope the engagement, and maintain an internal record of the conversation. We do not sell or rent your information. We do not share it with any third party except the infrastructure providers listed below, which are necessary to operate the form.
Where it lives
Contact submissions are stored in our Supabase project (US-East), inside a dedicated marketing schema with row-level security enabled. Notification emails are sent via Resend (US-East). This site itself is hosted on Vercel, which terminates requests at edge regions around the world but routes form submissions to US-East compute.
Data is encrypted in transit (HTTPS / TLS) and at rest on the provider side. Access to the Supabase project is restricted to DOT and a small number of contractors under signed confidentiality.
How long we keep it
Contact submissions are kept for as long as our conversation remains active, and afterwards as part of our project record. If you ask us to delete your record, we will, and we will confirm by email when the row is removed.
Spam-protection logs (IP and user-agent) are kept for 30 days and then aged out.
Your rights
You can ask us at any time to:
- Send you a copy of what we have on file
- Correct anything that is wrong
- Delete your record entirely
- Stop contacting you
Email david@dotxlabs.com with the request. We respond within seven business days and we do not require a reason.
Cookies
Beyond the strictly-necessary cookies the site needs to function, Google Analytics 4 sets first-party measurement cookies (typically named _ga and _ga_*) that distinguish individual sessions. These are first-party, not shared with advertisers, and used only to compute aggregate site metrics. If we add any other cookies, this page changes before they are set.
Children
The site is not directed at people under thirteen, and we do not knowingly collect information from anyone under thirteen. If you believe we have, email us and we will delete the record.
Changes to this policy
If we change anything material, we update the date at the top of this page and post a notice on /contact for the next thirty days. Routine wording changes do not get their own notice but do update the date.
Questions
Email david@dotxlabs.com. DOT handles privacy questions personally.