Privacy Policy & Data Boundary

1. Interactive Tools: Local-Only Evaluation Boundary

When you use our public self-assessment tools—specifically the AI Agent Risk & Control Probe (/risk-probe/) and the 50-Item Production Readiness Checklist (/checklists/production-readiness/):

• Zero Server Transmission: All answer options, checked boxes, and calculation results remain strictly inside your local browser. Nothing is transmitted to external servers.
• No Prompts, Secrets, or Architecture Text Requested: Our tools never ask for, collect, or store your model prompts, source code, API keys, database credentials, internal system names, or architecture details.
• Local Progress Retention & Cleanup: To prevent losing progress if you refresh or navigate away, the tools automatically save question identifiers, selected option keys, and checklist item codes locally in your browser's localStorage. No free-form text, prompts, source code, or credentials are stored. Assessment progress has a 7-day validity window and renews upon saving or resuming; expired records are purged the next time you open the tool, or you can clear them manually at any time by clicking "Clear local progress" on the tool page.

2. Cookies, Storage & Tracking Policy

We maintain a strict cookie-less and tracker-free architecture:

• No Tracking Cookies: We do not set third-party tracking, advertising, or cross-site behavioral cookies.
• No Third-Party Analytics: We do not load Google Analytics, Meta Pixel, Hotjar, or similar tracking scripts that profile individual user visits.
• Local Storage Usage: We utilize your browser's standard localStorage solely for functional client-side features: (1) persisting your chosen visual theme (Dark Mode, Light Mode, or System Preference); (2) maintaining a client-side 24-hour timestamp cooldown for blog view counts (blog-viewed:<slug>) to prevent accidental view-count inflation upon page reloads; and (3) preserving assessment progress (question identifiers and option keys only; no free-form text, prompts, or credentials) with a 7-day validity window that renews upon activity and purges expired records on subsequent tool visits (bartsai:risk-probe:v1 and bartsai:production-readiness:v1). No personally identifiable information (PII) or user tracking profiles are stored.

3. Direct Correspondence & Inquiries

If you contact us directly via email (e.g. at hello@bartsaiconsulting.com) or initiate an inquiry for a Launch Gate Review:

• We collect your contact information (name, work email, company name, and message content) solely for the purpose of communicating with you regarding your inquiry.
• We never sell, rent, or lease your contact information or project details to third-party data brokers or marketing platforms.
• You may request complete deletion of your communication records at any time by emailing us.

4. Paid Consulting & Launch Gate Engagements

For formal client engagements (including Launch Gate Reviews and custom engineering assurance):

• All technical audits are governed by comprehensive, legally binding mutual Non-Disclosure Agreements (NDAs).
• All testing and scenario evaluations are executed within customer-owned cloud environments, customer-controlled repositories, or dedicated single-tenant ephemeral testing runners.
• Client source code, tool schemas, and test logs are never used to train or fine-tune public artificial intelligence models.

5. Hosting & Infrastructure

Our website is hosted on Cloudflare Workers and Static Assets. Cloudflare processes transient network connection metadata (including incoming IP addresses and HTTP headers) strictly for edge routing, DDoS mitigation, and edge rate-limiting enforcement (specifically, our Worker evaluates client IPs in volatile runtime memory to enforce a 30 req/min sliding-window rate limit on /api/blog-views to prevent denial-of-wallet abuse). Client IP addresses are never logged to persistent databases or used for user identification.

6. Your Rights (GDPR, CCPA & Singapore PDPA)

Depending on your jurisdiction, you have statutory rights concerning your personal data:

• Right of Access: Request confirmation of whether we hold any personal data about you.
• Right to Rectification: Request correction of inaccurate personal data.
• Right to Erasure ("Right to be Forgotten"): Request immediate deletion of your correspondence records.