Privacy

Contact form

When you submit the contact form, the site stores:

• your name, email address, and message;
• your company and budget, if you fill them in;
• the page the form was sent from and the site language;
• a copy of the fields above in the form's field order, with the values exactly as you entered them, without the spam-check token or the hidden spam-trap field;
• a SHA-256 hash of your IP address combined with a secret value. Your IP address itself is not stored;
• your browser's user-agent string;
• the time of the submission.

The database also keeps an hourly count of submissions per hashed IP address. It limits each address to five messages an hour. Submissions that fill in the hidden spam-trap field are discarded and not stored.

Your message is forwarded with the values exactly as you entered them, in the form's field order. It is sent by email to the site owner's inbox, together with the submission time and the page the form was sent from. The database logs each delivery attempt with its time, status, and any error.

Spam check

The form uses Cloudflare Turnstile to check that a person sent it. Turnstile runs in your browser and is loaded from Cloudflare. The server sends the resulting token and your IP address to Cloudflare to verify it. The token is not stored. Cloudflare's own privacy practices apply to that check.

Where it is stored and who can read it

Submissions are stored in a Supabase Postgres database. The tables have row-level security, and the public keys that Supabase issues have no access to them. Only this site's server reads or writes them.

Processors

• Supabase hosts the database that stores submissions.
• Cloudflare runs the Turnstile spam check and receives your IP address for it.
• Zoho Mail delivers the notification email, so it handles your message and email address. Your IP address is not included.
• Vercel hosts the site and its server, so it handles each request, including your IP address, before the site hashes it.

How long it is kept and where

Messages are kept for up to 12 months, then deleted. Data is stored in Supabase, EU (Frankfurt, eu-central-1).

• A daily job deletes messages older than 12 months, together with their email delivery records.
• Hourly submission counts are deleted automatically after 24 hours.