Privacy policy

What we collect

Four things, and only the first is something you choose to send:

• What you send us — If you use the contact form: your name, email, and whatever you put in the optional title, company, and message fields. Submitting is the only way this data exists — nothing you type reaches us unless you press send.
• Hosting logs — The site is served by Cloudflare, which keeps standard server logs (IP address, browser type, pages requested) to run and protect the service, as almost every website's host does.
• Font requests — The site's typefaces load from Google Fonts, so your browser requests those files from Google's servers. Google sees the request (including your IP address) but sets no cookies through it.
• Measurement — Not who you are, and not your IP address — that is never stored. Each page tells our own server which page it was, where you arrived from (including any campaign tag on the link), your language and time zone, a rough screen size and pixel density, display preferences such as dark mode and reduced motion, your connection type, whether the browser is being driven by automation and, when you leave, how long you stayed, how far you scrolled, and how fast the page ran. Four clicks are counted as well: a link out to another site (we keep where it pointed, never the query string on it), the RSS feed, and opening the contact or the booking panel. Our server adds what the request already reveals to Cloudflare — country, region, city, network operator, and which Cloudflare datacenter served the page — and folds your browser's identification string down to a browser, operating system, and device family, keeping those and discarding the string itself. The section below explains how that is counted without identifying you.

What we deliberately do not do

• No third-party analytics and no advertising trackers. Nothing on this site reports to Google Analytics, an ad network, or a data broker — the measurement above runs on our own infrastructure and stays there.
• No tracking across days. Each day our counting starts from zero — we cannot recognize you tomorrow, and we cannot join today's visit to last week's.
• No advertising pixels, and no sale or sharing of personal data for marketing — ours or anyone else's.
• No cookies of our own, and nothing of ours kept on your device — no cookie, no local storage, no identifier that outlives the page. The two third-party widgets on the contact panel, Cloudflare's bot check and Calendly, load only if you open it, and what they store is governed by their own policies. The site works without asking you to accept anything.
• No accounts, no logins, no profiles.

How we count visits

To know which pages get read and what brings people here, we have to tell one visit from another without knowing whose it is. So we store nothing that points back to you. When a page reports in, our server takes your IP address and the identification string your browser sends, adds today's date and a secret key only we hold, and runs the lot through a one-way hash — a fixed-length string of characters. The hash is what gets stored, and it is the only stand-in for a visitor anywhere in the system. The IP address is discarded in the same instant and never written down.

Two things follow from that. Nobody can work backwards from the hash to you, because the calculation runs one way and needs the secret. And because the date goes into it, tomorrow the same visitor produces a different, unconnected hash — the counting resets every day. That is the cost of not tracking you, and we think it is the right trade.

The result is stored in our own database at Cloudflare, held in Western Europe, and the code that writes it runs on Cloudflare's network at whichever of its datacenters is closest to you. No analytics company sees any of it, because there is no analytics company. If you send the contact form, we also record that a submission happened — the fact of it, which of our forms it came from, and nothing you wrote.

Separately, Cloudflare's own traffic statistics for the site — the request counts already described under hosting logs — are summarized once a day into the same database: how many requests each page and country accounted for, how much of that was crawlers, and how much data was served. Those are totals, with nothing about an individual visit in them.

Where a form submission goes

A submission is checked by Cloudflare Turnstile (its bot check runs in your browser and sees your IP address), passed through our form endpoint on Cloudflare, and delivered as an email via Resend, our email provider, to our inbox. Processing happens in the United States.

To stop the form being used as a spam relay, that endpoint also counts recent submissions against your IP address, for an hour at a time. The count is a number and nothing else — no message, no name, and nothing that joins it to the measurement described above.

Your message is never written to a database. It exists as the email it becomes, and we keep it the way correspondence is kept — for as long as the conversation and our legal obligations require, then it is deleted. The only other trace of it is the counted event described above, which says a submission happened and nothing about what it said.

If you book a call instead, the scheduler is Calendly. Its software loads only if you open the booking tab, and what you enter there is governed by Calendly's own privacy policy.

The legal footing

Where the GDPR or UK GDPR applies: we process what you send us because you asked us to respond (performance of steps you initiated), and we run bot protection, hosting logs, and our own visit counting on legitimate interests — keeping the site working, keeping abuse out, and understanding which pages are read. The counting is designed so that it holds no identifier we could tie back to you, which is why it needs no consent banner. Where data moves outside the EEA or UK — correspondence is processed in the United States, while the measurement database is held in Western Europe — we rely on recognized safeguards such as Standard Contractual Clauses.

Your rights

Depending on where you live, you can ask us to:

• Access — tell you what personal data we hold about you, and give you a copy.
• Correct — fix data that is wrong or incomplete.
• Delete — erase your data, subject to narrow legal exceptions.
• Restrict or object — limit or stop certain processing.
• Complain — raise it with your local data protection authority (EEA/UK), or exercise the equivalent rights your law provides — California's CCPA/CPRA, Brazil's LGPD, Canada's PIPEDA, and others. We do not sell or share personal information as those laws define it.

Write to inquiries@virtuosity.io. We may need to verify you are you before acting, and we will never treat you worse for asking.

Security

The site is static, and the measurement database behind it holds counts rather than people — no names, no messages, no IP addresses, nothing that would identify a visitor on its own. The form path is protected end to end: bot verification before anything is processed, a strict allowlist on what the endpoint accepts, and secrets held in Cloudflare's infrastructure, not in code. No system is perfectly secure, and we will not pretend otherwise; we keep the attack surface as small as the architecture allows.

Children

The site is written for a professional audience and not directed at children under 13. We do not knowingly collect children's data; if you believe a child has sent us some, tell us and we will delete it.

Changes

When this policy changes, the change appears on this page with a new date at the top. If a change is material and the law requires more notice than that, we will give it.

Who we are

Virtuosity, LLC · virtuosity.io · inquiries@virtuosity.io