1. Information We Collect

This is a static marketing and documentation website with a contact form and a hosted demo verification endpoint. There are no user accounts. We collect only:

Contact-form submissions: the name, email, organization, and message you send us, processed by Formspree.
Aggregate page-view analytics: cookieless, non-identifying usage counts via Vercel Web Analytics (see Section 7).
Demo-endpoint requests: if you use the hosted demo verification endpoint, the request reaches our demo gateway (hosted on Cloudflare Workers), which receives your IP address as part of normal request handling.

What We Do NOT Collect

Accounts: there is no account to create and no login; we hold no account records.
Your file contents: the web verifier runs in your browser; the bundles or files you check are processed locally and are not sent to us.
Private keys or biometric data: never collected. Cryptographic keys stay on your device.

2. Lawful Basis for Processing

Under the General Data Protection Regulation (GDPR), we process personal data on the following lawful bases:

Data Type	Lawful Basis	GDPR Reference
Strictly necessary hosting cookies	Legitimate interest	Art. 6(1)(f)
Aggregate, cookieless analytics	Legitimate interest	Art. 6(1)(f)
Contact-form submissions	Consent / Legitimate interest	Art. 6(1)(a), (f)

3. How We Use Information

We use collected information to:

Respond to inquiries and access requests you send through the contact form
Understand aggregate usage of the site so we can improve it
Operate and protect the demo verification endpoint
Comply with legal obligations

4. Data Security

The site is served over HTTPS only (HSTS enabled). Contact-form data is transmitted to Formspree over TLS. The verification design keeps sensitive material off our servers by construction: the web verifier runs in your browser, and evidence bundles are checked against Ed25519 signatures and SHA-256 hashes without sending the underlying artifacts to us.

5. Data Retention

We retain data only as long as necessary to provide our services and comply with legal obligations. Specific retention periods are as follows:

Data Type	Retention Period
Contact-form submissions	24 months or until the request is resolved
Aggregate analytics counts	Per Vercel Web Analytics (non-identifying)
Hosting server logs (Vercel)	Per Vercel retention policy
Demo-endpoint evidence bundles	Retained indefinitely as a public demo corpus; synthetic, containing no visitor data

6. Cookies

Cookies are small text files stored on your device by websites you visit. We do not use third-party advertising or behavioral tracking cookies. As of the date of this policy, our site does not set any non-essential cookies.

Our hosting provider (Vercel) may set technical cookies required for content delivery. These are strictly necessary for the website to function. Our page-view analytics (Vercel Web Analytics, described in Section 7) is cookieless. If we add cookie-based analytics or other non-essential cookies in the future, this section will be updated and a cookie consent mechanism will be implemented.

You can control cookies through your browser settings. Here are links to cookie management instructions for common browsers:

7. Third-Party Services & Tracking

We use third-party services for hosting and email delivery. These services are selected for their security and privacy practices.

Vercel Inc. (United States): Website hosting and deployment
Vercel Web Analytics (United States): cookieless, aggregate page-view analytics. It sets no cookies, does not track you across sites, and does not collect personally identifying information.
Formspree (United States): contact-form processing and delivery.
Cloudflare, Inc. (United States): hosts the demo verification endpoint; receives the requester IP when you use it.

No cross-site behavioral trackers: We do not use Google Analytics, Facebook Pixel, or other cross-site behavioral tracking services. The only analytics we run is the cookieless, aggregate Vercel Web Analytics described above.

8. Data Processors and International Transfers

We use the following third-party service providers who may process your data:

Vercel Inc. (United States): Website hosting and deployment. Vercel Privacy Policy
Formspree (United States): Contact-form processing (receives the name, email, company, and message you submit). Formspree Privacy Policy
Cloudflare, Inc. (United States): hosts the demo verification endpoint and receives the requester IP when it is used. Cloudflare Privacy Policy

Data collected through our websites may be transferred to and processed in the United States. For users in the European Economic Area (EEA), these transfers are conducted pursuant to Standard Contractual Clauses (SCCs) as adopted by the European Commission, or other appropriate safeguards under GDPR Article 46.

9. Your Rights

9a. Rights for EEA/UK Residents (GDPR)

If you are located in the European Economic Area or the United Kingdom, you have the following rights under the GDPR:

Right of access (Art. 15)
Right to rectification (Art. 16)
Right to erasure (Art. 17)
Right to restriction of processing (Art. 18)
Right to data portability (Art. 20)
Right to object (Art. 21)
Right to withdraw consent at any time (Art. 7(3))
Right to lodge a complaint with a supervisory authority

To exercise these rights, contact us at admin@attestedintelligence.com. We will respond within 30 days.

9b. Rights for California Residents (CCPA/CPRA)

If you are a California resident, you have the following rights:

Right to know what personal information is collected
Right to delete personal information
Right to opt-out of sale of personal information
Right to non-discrimination for exercising privacy rights

We do not sell personal information.

10. Automated Decision-Making

We do not use automated decision-making or profiling that produces legal or similarly significant effects on individuals.

11. Children's Privacy

Our services are not directed to individuals under the age of 16. We do not knowingly collect personal data from children. If we learn we have collected data from a child under 16, we will delete it promptly.

12. Contact Us

For privacy-related inquiries, contact us at admin@attestedintelligence.com

Privacy Policy