OFFSCRIPT®
LEGAL & DATA GOVERNANCE

PRIVACY POLICY.

Transparent data handling, strict storage boundaries, and engineering integrity.

This policy outlines how OFFSCRIPT Studio collects, processes, and safeguards information submitted through our digital flagship and client intake pipelines.

EFFECTIVE DATE: NOVEMBER 2026
ENTITY: OFFSCRIPT STUDIO (INDEPENDENT DIGITAL ENGINEERING)

01.Information We Collect

When you initiate a project inquiry or request a discovery consultation with OFFSCRIPT Studio, we collect only the information necessary to evaluate your engineering requirements and communicate with you:

  • Contact Details: Your full name, work email address, and optional company or organization name.
  • Project Specifications: Selected engineering discipline (Web Development, AI Systems, Platform Engineering, etc.), budget framework, target delivery timeline, and technical project brief.
  • Scheduling Telemetry: Preferred dates, meeting objectives, and appointment metadata if scheduling a discovery consultation.

02.Purpose & Use of Information

We process client inquiry data strictly for legitimate business and engineering purposes:

  • Assessing architectural feasibility and timeline viability for prospective software projects.
  • Formulating tailored technical proposals, statements of work (SOW), and scope estimates.
  • Direct correspondence from our engineering team via our official email (offscript@param20h.me).
  • Coordinating and conducting 30-minute discovery calls.

We do not sell, rent, monetize, or disclose your contact details or project briefs to third-party data brokers or marketing affiliates.

03.Infrastructure & Storage Architecture

We treat incoming briefs as confidential technical documents. Our intake pipeline implements defense-in-depth storage controls:

Database Storage

Inquiries are persisted in a managed PostgreSQL database powered by Supabase. Row Level Security (RLS) is strictly enabled with zero public access. All writes execute through private server-only route handlers using cryptographic service-role tokens.

Notification Dispatch

Internal team notifications are dispatched via Resend transactional email directly to our studio inbox. All user-supplied strings are sanitized against HTML injection prior to email transmission.

04.Spam Protection & Automated Telemetry

To protect our serverless infrastructure against automated denial-of-service and bot spam, we implement privacy-preserving abuse defenses:

  • Honeypot Traps: We inject visually concealed honeypot fields inaccessible to human visitors. Automated bots that fill these fields are rejected immediately.
  • Interaction Timing Heuristics: Submissions completing in under 3.0 seconds are flagged as non-human script traffic.
  • Hashed Rate Limiting: Inbound requests are rate-limited to 3 submissions per 15 minutes. To respect user privacy, IP addresses are immediately hashed using one-way SHA-256 cryptographic algorithms. Raw IP addresses are never recorded in our database.
  • Server Infrastructure Logs: Vercel edge networks record standard ephemeral HTTP request logs (browser user-agent, request status, latency) for diagnostic and security purposes.

05.Analytics, Cookieless Telemetry & Conversion Measurement

To understand visitor engagement and measure inquiry conversion without compromising user privacy, OFFSCRIPT Studio integrates privacy-preserving, first-party telemetry powered by Vercel Analytics:

  • Strictly Cookieless: Vercel Analytics operates without persistent tracking cookies, local storage tracking identifiers, or cross-site fingerprinting. Visitors are not identified or tracked across distinct websites or devices.
  • Conversion Events Tracked: We measure discrete structural interaction events: project case-study views (project_viewed), discovery call modal openings (discovery_call_clicked), direct studio email clicks (email_contact_clicked), inquiry form initialization (contact_form_started), inquiry dispatch (contact_form_submitted), persistence status (contact_form_persisted), and error states (contact_form_failed).
  • Explicit Exclusion of Personally Identifiable Information (PII): Event payloads record only high-level categorical parameters (e.g. engineering discipline, currency, error category, notification accepted). We strictly exclude personal names, email addresses, company names, budget amounts, project briefs, and raw IP addresses from all telemetry streams.
  • No Advertising Trackers: We do not deploy Google Analytics, Meta/Facebook Pixels, LinkedIn Insight Tags, Google Tag Manager, or behavioral advertising tracking networks.

06.Data Retention & Owner Confirmation

Client inquiries are retained for as long as necessary to review project feasibility, negotiate engagement scope, or satisfy contractual accounting records. If an inquiry does not materialize into an active commercial project, records may be archived or deleted periodically.

Pending Owner Policy Confirmation:

Formal statutory data retention windows (e.g. 12-month inquiry purge vs. multi-year tax audit retention) are subject to final studio legal review upon commercial incorporation.

07.Your Rights & Studio Contact

You have the right to request access to the information you have submitted to us, request correction of any inaccuracies, or ask for the deletion of your inquiry record from our intake database.

To exercise these rights, or if you have questions regarding our technical security practices, contact us directly:

STUDIO CONTACT: OFFSCRIPT Studio Data Governance
OFFICIAL EMAIL: offscript@param20h.me
CANONICAL DOMAIN: https://offscript.param20h.me