Comfusion
Privacy
Short version: the contact form is the only thing on this site that collects anything about you, I am the only person who reads it, and you can have it deleted by asking.
What is collected
When you submit the contact form: the name, email address, optional phone number, optional project type, optional budget band and message you typed, plus your browser's user-agent string, the page you submitted from, the referring URL if your browser sent one, and a timestamp. Your IP address is used in memory for rate limiting and is not written to the database.
What it is used for
Replying to you, and scoping the work if we go ahead. Nothing else. You are not added to a mailing list, your details are not sold, shared or synced to a CRM, and no automated decision-making is applied to your enquiry.
Where it lives, and for how long
In an EmDash database on infrastructure Comfusion operates, encrypted in transit over TLS. Enquiries that do not become projects are deleted after 24 months. Enquiries that do become projects are kept for as long as the business records require, then deleted.
No tracking
This site sets no cookies, runs no analytics, and loads no third-party scripts or trackers. There is no consent banner because there is nothing to consent to. You can verify that in your browser's network tab in about ten seconds, which is rather the point.
Your rights
Wherever you are, you can ask for a copy of what is held about you, ask for it to be corrected, or ask for it to be deleted. Email josh@comfus.io, quote your reference code if you have one, and it is done within seven days, usually the same day. If you are in the UK or EU, the lawful basis is legitimate interest in responding to an enquiry you initiated, plus the consent you gave at the form.
Security contact
Report anything you find to josh@comfus.io. The machine-readable version is at /.well-known/security.txt, and the GPG fingerprint published beside the contact form can be used to encrypt anything sensitive.