Privacy.
Short, because there isn't much to say. We don't set cookies, we don't track you around the internet, and the only personal information we hold is what you type into the contact form.
What we collect, and why.
When you use the contact form we collect your name, your email address, and whatever else you choose to give us — your business, a phone number, your message, and how you'd like us to reply.
If you fill in the project enquiry form — the longer one that asks about your business — we also collect what you tell us there: what the business does, who its customers are, what you want the site to achieve, and so on. Most of that is information about a business rather than about you personally. The parts that are about you are your name and how to reach you, and they are at the end of the form for that reason.
We read it to decide whether we can help and to reply. If we go ahead, it becomes the brief we build from. If we do not, we keep it only as long as the section below describes.
We use it to answer you. That's all. We don't add you to a mailing list, we don't sell it, and we don't share it with anyone for marketing.
Where it goes.
The form is handled by Formspree, a form service, which passes your message to our email at drcolvin@p3mai.com. Formspree stores submissions on its own systems, which are in the United States.
Formspree also states that it holds a SOC 2 Type 2 report from an independent auditor, and that it encrypts submissions at rest and in transit.
Formspree also publishes the list of companies it uses to run its own service — its sub-processors. That list is mostly cloud, delivery and monitoring providers such as Amazon Web Services, Cloudflare and SendGrid, and it also includes OpenAI, an AI company. We name that one because you would not expect a contact form to involve an AI provider, and we would rather you knew before you write to us. The full list is on Formspree's own site.
One thing still to confirm before this site goes live. Formspree states publicly that it relies on Standard Contractual Clauses as a data processor — the usual legal mechanism for a transfer out of the UK and EU. We have asked them for the signed agreement that actually puts those clauses in place, because a statement on a company's website is not a contract. We would rather leave this sentence in public than claim cover we have not seen.
Cookies.
None. This site sets no cookies at all, which is why you haven't been asked to accept any.
Analytics.
We count visits with Plausible Analytics, so we know whether the site is working: how many people reach the pricing page, for instance. It is an independent European service, and its data is hosted in the European Union.
What it does not do. It sets no cookies, uses no device fingerprinting, does not follow you to other websites and builds no profile of you.
What it does collect: the page address, the site that sent you here, and your browser, operating system and device type. Your IP address is used for a moment to work out your country and to tell one visit from another. It is never stored, and that daily marker is thrown away each day. We cannot identify you from any of it.
The counts sit in the same Plausible account as p3mai.com, the company behind WebSandpit. Plausible's own privacy policy is at plausible.io/privacy.
How long we keep it.
Enquiries that don't become work are deleted within twelve months. If you become a client, we keep the project record for as long as we're working together and for seven years afterwards, because business records have to be retained.
Your rights.
You can ask us what we hold about you, ask us to correct it, or ask us to delete it. Email drcolvin@p3mai.com and we'll do it — we don't require a formal process for this.
We're based in Dubai, so UAE data protection law applies. If you're in the UK or the EU, your rights under UK and EU data protection law apply too, and we honour them regardless of where you are.
Changes.
If we change how any of this works, we change this page and date it. This version: draft, not yet published.