Privacy policy

This policy applies to quesiono.com and to the work we do for clients. Quesiono is the data controller for anything collected through this site. If you're a client, the projects we build for you may collect data from your customers — that's covered by your own privacy policy, not this one, though we'll help you write it.

We've written it in plain sentences instead of defined terms in capital letters. Where a legal right has a specific name, we've used the name and then explained what it means.

Three situations, and nothing outside them.

You fill in a form

Name, email, company, phone if you give it, plus the service, budget band, timeline and message. All of it optional except name, email and message.

You visit a page

Aggregate page views and referrers via Vercel Analytics, which doesn't set cookies or build a profile of you. If Google Tag Manager is enabled we may also load Google Analytics — see the cookie policy for what that adds.

You become a client

Contract details, billing information, and whatever credentials the build needs. Credentials live in a shared vault, never in email or a spreadsheet.

We don't buy contact lists, we don't scrape LinkedIn, and we don't run tracking pixels for advertising networks on this site.

Each thing we collect has one reason, and the reason is the limit on what we do with it.

• Form submissions — so we can reply to you. That's a legitimate interest: you asked us a question and expect an answer.
• Project files and credentials — so we can do the work you contracted us for.
• Invoices and contracts — because tax law in the US requires us to keep them.
• Aggregate analytics — so we know which pages are worth improving. We can't identify you from it.

We only email you about something other than your enquiry if you asked us to. There's no newsletter you get added to for filling in a contact form.

Enquiries that go nowhere

Deleted after 24 months. If you'd rather it went sooner, ask and it goes.

Client project files

Kept for three years after the last invoice, then deleted.

Credentials

Removed from our vault within 14 days of a project closing.

Invoices and contracts

Seven years, because we have to.

Analytics

Aggregate only, retained by the provider on their own schedule.

A short list of vendors, each doing one job. We don't sell data to anyone, and none of these are advertising networks.

Vercel

Hosting and analytics for this site. US-based.

Resend

Delivers the email your contact form generates.

Google

Search Console for indexing data, and Analytics via Tag Manager where enabled. Search Console shows us queries, never who searched.

Our accountant

Sees invoices. Nothing else.

The five people who work here can see client data relevant to their own projects. Nobody outside the studio gets access, and we don't use client data to train anything.

Depending on where you live, GDPR or the CCPA gives you a set of rights over your data. We apply all of them to everybody, because running two standards is how mistakes happen.

• Ask what we hold about you, and get a copy.
• Correct anything wrong.
• Have it deleted, unless tax law makes us keep it.
• Object to us processing it, or ask us to restrict how we do.
• Take it elsewhere in a portable format.
• Complain to a regulator without asking us first.

To use any of them, email hello@quesiono.com with what you want. No form, no ID upload unless we genuinely can't tell it's you. We'll act within 30 days and usually inside a week.

• HTTPS everywhere on this site, with HSTS.
• Two-factor authentication on every account that offers it.
• Credentials in a password manager with per-project sharing, never in email.
• Laptops with full-disk encryption and automatic locking.
• Access removed the day someone stops working on a project.

No system is perfect. If we ever have a breach that puts your data at risk, we'll tell you and the relevant regulator within 72 hours of finding out, with what happened and what we're doing about it.

This site isn't aimed at anyone under 16 and we don't knowingly collect their data. If you think we have some, email us and it'll be deleted the same day.

When we change something that affects what we collect or who sees it, we update the date at the top of this page. If the change is significant and we hold your email because you're a client, we'll tell you directly rather than hoping you re-read the page.