What this website collects, and why.

The form on the contact page is the only place this site asks you for personal information. Each field has one purpose: to understand the project and reply to you.

Alongside the fields, a submission carries technical details: your IP address, the country Cloudflare associates with it, your browser’s user-agent string, the time the form was first touched and sent, and a reference number generated for the message. These are used to prevent abuse, to debug delivery problems and to give you a reference for follow-up.

We use this information to respond to your enquiry and, where a project follows, to prepare a proposal. Where a legal basis is required, it is our legitimate interest in answering enquiries about our services and in taking steps at your request before entering into a contract.

The contact form is protected by Cloudflare Turnstile, which decides whether a submission comes from a person without asking you to solve a puzzle. Turnstile runs in your browser on the contact page, evaluates signals from the browser and the connection, and issues a token that our server verifies with Cloudflare before the message is accepted. Cloudflare processes that data as our service provider under the Cloudflare privacy policy.

Submissions are also rate limited by IP address at the edge, and the form contains a hidden field and a timing check that ordinary browsers never fill or trigger. Submissions that fail these checks are discarded. These measures exist to keep the inbox usable; they do not build a profile of you.

This site uses PostHog to understand page visits and interactions such as clicks. PostHog receives page addresses, referral information and technical details about your browser and device. We mask text and element attributes in automatically captured interactions and do not send contact-form field values to PostHog. Session replay records interactions on all eligible visits; text, images and form inputs are masked in the recordings. Recordings are kept for 30 days.

PostHog stores a randomly generated visitor identifier and related analytics state in your browser’s localStorage so visits can be connected. We do not use advertising cookies or identify visitors by name or email for analytics. We respect browser Do Not Track and Global Privacy Control signals. PostHog processes analytics data in its US cloud; see the PostHog privacy policy.

One preference is stored in your browser’s localStorage under the key palfora-theme when you choose Light or Dark instead of System in the theme control. It holds a single word, is never sent to us, and is removed when you switch back to System or clear the site’s data.

Turnstile may set cookies that are strictly necessary for verification while you are on the contact page, and Cloudflare’s network, which serves the site, may use cookies necessary for security. [Confirm the current list of Cloudflare cookies in use before publication.]

The site is served from Cloudflare’s network as pre-rendered pages, and contact submissions are handled by a small Cloudflare Worker. Requests therefore pass through Cloudflare, which processes connection data, including IP addresses, to deliver and secure the site and keeps short-lived logs for that purpose.

Contact submissions are delivered to the team as email through [email delivery provider to be confirmed: Cloudflare Email Service or Resend]. The provider processes the message and the sender’s email address in order to deliver it, and may keep delivery logs under its own policy. The Worker also writes an operational log entry with the reference number and the delivery outcome; until an email provider is connected, that entry contains the submission itself so that nothing is lost.

Enquiries are kept in the team’s email for as long as they are needed to respond and, where a project follows, for the duration of the engagement and the period afterwards that business records require. [Confirm the retention period, for example three years after the last correspondence.] Submissions that are clearly unsolicited marketing are deleted on receipt.

Cloudflare’s request and Worker logs are retained for a short period set by the plan in use and then discarded. Turnstile tokens are single-use and expire within minutes.

We do not sell personal data and do not share it with advertisers. It is processed on our behalf by the service providers named above, Cloudflare, PostHog and the email delivery provider, and may be disclosed if the law requires it or to protect our rights. Where a project proceeds, details from the enquiry may be used in a proposal or contract between you and Palfora.

Depending on where you live, you may have the right to ask what personal data we hold about you, to have it corrected or deleted, to object to or restrict its processing, to receive a copy of it, and to complain to a supervisory authority.

You can exercise these rights through the contact page; say that you are making a privacy request so it is handled separately from project enquiries. We will need to confirm that the request comes from the person the data belongs to.

[Add region-specific notices as required, for example for residents of California, the EEA or the United Kingdom.]

When this policy changes, the new version is published on this page with an updated date at the top. The date shown there is the version that applies.