Privacy.
Short, because there isn't much to say. We don't set cookies, we don't track you around the internet, and the only personal information we hold is what you type into the contact form.
What we collect, and why.
When you use the contact form we collect your name, your email address, and whatever else you choose to give us — your business, a phone number, your message, and how you'd like us to reply.
If you fill in the project enquiry form — the longer one that asks about your business — we also collect what you tell us there: what the business does, who its customers are, what you want the site to achieve, and so on. Most of that is information about a business rather than about you personally. The parts that are about you are your name and how to reach you, and they are at the end of the form for that reason.
We read it to decide whether we can help and to reply. If we go ahead, it becomes the brief we build from. If we do not, we keep it only as long as the section below describes.
We use it to answer you. That's all. We don't add you to a mailing list, we don't sell it, and we don't share it with anyone for marketing.
Where it goes.
The form is handled by Formspree, a form service, which passes your message to our email at drcolvin@p3mai.com. Formspree stores submissions on its own systems, which are in the United States.
Formspree also states that it holds a SOC 2 Type 2 report from an independent auditor, and that it encrypts submissions at rest and in transit.
Formspree also publishes the list of companies it uses to run its own service — its sub-processors. That list is mostly cloud, delivery and monitoring providers such as Amazon Web Services, Cloudflare and SendGrid, and it also includes OpenAI, an AI company. We name that one because you would not expect a contact form to involve an AI provider, and we would rather you knew before you write to us. The full list is on Formspree's own site.
One thing still to confirm before this site goes live. Formspree states publicly that it relies on Standard Contractual Clauses as a data processor — the usual legal mechanism for a transfer out of the UK and EU. We have asked them for the signed agreement that actually puts those clauses in place, because a statement on a company's website is not a contract. We would rather leave this sentence in public than claim cover we have not seen.
Cookies.
None. This site sets no cookies at all, which is why you haven't been asked to accept any.
Analytics.
We count visits so we know whether the site is working — how many people reach the pricing page, for instance. The service we use does not set cookies and does not collect anything that identifies you personally.
Still to confirm: the name of that analytics provider, once it is bought. It will be named here before the site goes live.
How long we keep it.
Enquiries that don't become work are deleted within twelve months. If you become a client, we keep the project record for as long as we're working together and for seven years afterwards, because business records have to be retained.
Your rights.
You can ask us what we hold about you, ask us to correct it, or ask us to delete it. Email drcolvin@p3mai.com and we'll do it — we don't require a formal process for this.
We're based in Dubai, so UAE data protection law applies. If you're in the UK or the EU, your rights under UK and EU data protection law apply too, and we honour them regardless of where you are.
Changes.
If we change how any of this works, we change this page and date it. This version: draft, not yet published.