Privacy Policy

1. Information We Collect

This is a static marketing and documentation website with a contact form and a hosted demo verification endpoint. There are no user accounts. We collect only:

• Contact-form submissions: the name, email, company, and message you send us, processed by Formspree.
• Aggregate page-view analytics: page-view measurements through Vercel Web Analytics, subject to the provider's documented collection and privacy practices (see Section 7).
• Hosting request logs: the IP address, user agent and requested URL of each request, kept by our host, Vercel, under its retention policy.
• Demo-endpoint requests: if you use the hosted demo verification endpoint, the request reaches our demo gateway (hosted on Cloudflare Workers), which receives your IP address as part of normal request handling.

2. Lawful Basis for Processing

Where the General Data Protection Regulation (GDPR) applies, our stated bases for processing are:

Hosting request logs

Legitimate interest GDPR Art. 6(1)(f)

Aggregate, cookieless analytics

Legitimate interest GDPR Art. 6(1)(f)

Contact-form submissions

Steps you ask us to take / Legitimate interest GDPR Art. 6(1)(b), (f)

3. How We Use Information

We use collected information to:

• Respond to inquiries and access requests you send through the contact form
• Understand aggregate usage of the site so we can improve it
• Operate and protect the demo verification endpoint
• Comply with legal obligations

4. Data Security

The site is served over HTTPS only (HSTS enabled). Contact-form data is transmitted to Formspree over TLS. The verification design keeps sensitive material off our servers by construction: the web verifier runs in your browser, and evidence bundles are checked against Ed25519 signatures and SHA-256 hashes without sending the underlying artifacts to us.

5. Data Retention

We retain data only as long as necessary to provide our services and comply with legal obligations. Retention criteria are as follows:

Contact-form submissions

We keep inquiry information only while needed to respond to your request, carry out follow-up you ask for, or meet a legal obligation. When it is no longer needed for those purposes, we delete it from the contact-form records, receiving mailbox, and exported copies we control. You can request deletion using the contact details below.

Aggregate analytics counts

Vercel says its request-derived visitor hash expires after 24 hours. The reporting window for analytics records depends on the Vercel plan; see the provider documentation in Section 7.

Hosting server logs (Vercel)

Per Vercel retention policy

Demo-gateway receipts and evidence bundles

Public and retained indefinitely. The chain holds the two receipts we seeded. Since September 26, 2026, the gateway's /mcp endpoint seals a call only for a caller presenting a demo token, and none is set, so it seals no call; a receipt added after a token is set would record what its caller sent, such as the tool name and request id. Do not send personal data there.

6. Cookies

Cookies are small text files stored on your device by websites you visit. We do not use third-party advertising or behavioral tracking cookies. As of the date of this policy, our site does not set any non-essential cookies.

Our hosting provider (Vercel) may set technical cookies required for content delivery. These are strictly necessary for the website to function. Our page-view analytics (Vercel Web Analytics, described in Section 7) is cookieless. If we add cookie-based analytics or other non-essential cookies in the future, this section will be updated and a cookie consent mechanism will be implemented.

You can control cookies through your browser settings. Here are links to cookie management instructions for common browsers:

• Google Chrome
• Mozilla Firefox
• Apple Safari
• Microsoft Edge

7. Third-Party Services & Tracking

We use third-party services for hosting and email delivery. These services are selected for their security and privacy practices.

• Vercel Inc. (United States): Website hosting and deployment
• Vercel Web Analytics (United States): we use it for automatic page-view measurements and do not send custom analytics events. Vercel says the service uses no cookies and does not use identifiers to track people across websites. Its documentation describes a request-derived visitor hash that expires after 24 hours and says analytics data may include the page URL, referrer, approximate location, operating system, browser, and device type. See Vercel's Web Analytics privacy and compliance documentation.
• Formspree (United States): contact-form processing and delivery.
• Cloudflare, Inc. (United States): hosts the demo verification endpoint; receives the requester IP when you use it.
• ImprovMX (email forwarding): forwards mail sent to our @attestedintelligence.com addresses.
• Microsoft (Outlook.com, United States): the mailbox that forwarded mail is delivered to.
• Resend (Resend, Inc., United States, delivering through Amazon SES): sends email from our sending subdomain; today it carries only our own operational notices, never mail to visitors.

No cross-site behavioral trackers: We do not use Google Analytics, Facebook Pixel, or other cross-site behavioral tracking services. The only analytics we run is the cookieless, aggregate Vercel Web Analytics described above.

8. Data Processors and International Transfers

We use the following third-party service providers who may process your data:

• Vercel Inc. (United States): Website hosting and deployment. Vercel Privacy Policy
• Formspree (United States): Contact-form processing (receives the name, email, company, and message you submit). Formspree Privacy Policy
• Cloudflare, Inc. (United States): hosts the demo verification endpoint and receives the requester IP when it is used. Cloudflare Privacy Policy
• ImprovMX (email forwarding): forwards mail sent to our @attestedintelligence.com addresses to our inbox. ImprovMX Privacy Policy
• Microsoft (Outlook.com, Microsoft Corporation, United States): the mailbox that mail forwarded from our @attestedintelligence.com addresses is delivered to. Microsoft Privacy Statement
• Resend (Resend, Inc., United States, delivering through Amazon SES): sends email from our sending subdomain; today it carries only our own operational notices, never mail to visitors. Resend Privacy Policy

Data collected through our websites may be transferred to and processed in the United States and other countries where these providers operate. Their privacy notices are linked above. Contact us for information about the safeguards applicable to your information.

9. Your Rights

9a. Rights for EEA/UK Residents (GDPR)

Where EEA or UK data-protection law applies to our processing, your rights include the following, subject to the conditions and exceptions in that law:

• Right of access (Art. 15)
• Right to rectification (Art. 16)
• Right to erasure (Art. 17)
• Right to restriction of processing (Art. 18)
• Right to data portability (Art. 20)
• Right to object (Art. 21)
• Right to withdraw consent at any time (Art. 7(3))
• Right to lodge a complaint with a supervisory authority

To exercise these rights, contact us at admin@attestedintelligence.com. We respond without undue delay and within the period required by applicable law. For GDPR requests, this is normally one month. If a permitted extension is needed, we will explain the reason within that initial period.

9b. Rights for California Residents (CCPA/CPRA)

Where the CCPA/CPRA applies, California residents have rights including:

• Right to know what personal information is collected
• Right to delete personal information, subject to legal exceptions
• Right to correct inaccurate personal information
• Right to opt out of the sale or sharing of personal information
• Right to non-discrimination for exercising privacy rights

We do not sell personal information.

10. Automated Decision-Making

We do not use automated decision-making or profiling that produces legal or similarly significant effects on individuals.

11. Children's Privacy

Our services are not directed to individuals under the age of 16. We do not knowingly collect personal data from children. If we learn we have collected data from a child under 16, we will delete it promptly.