Privacy Policy

[TODO: legal review] [TODO: confirm processor list against the deployed stack]

This policy explains what personal data we collect on shikinox.com, why we collect it, how long we keep it and what you can do about it. We have written it in plain English because that is how we would want to read it.

Who we are

Shikinox is a founder-led engineering studio and a registered business. [TODO: registered legal name and jurisdiction]

For anything in this policy, write to hello@shikinox.com. [TODO: confirm mailbox]

What we collect and why

We collect the minimum we need to answer you and to keep the site working. Nothing on this site is sold, rented or shared for advertising.

Project brief

When you send a project brief, we ask for your name, work email, company, your website if you want to share it, the services you are interested in, a description of the project, a budget range and a timeline choice, and we record that you accepted this policy. We use these to understand what you need, reply within 24 hours and prepare a written scope. We do not use them for any other purpose.

With each brief we also store the time it arrived, your browser's user agent string (its name and version) and a keyed hash of your IP address, never the address itself. We use these only for spam protection and rate limiting, and they are deleted with the brief.

Waitlist

When you join the waitlist for a free tool such as Roast My App, we store your email address so we can tell you when the tool is live, which page you joined from, the time, your browser's user agent string and a keyed hash of your IP address (never the address itself). We send one confirmation email when you join and will email you again when the tool launches. Every waitlist email includes an unsubscribe link and a way to reach us.

You can unsubscribe at any time with the link in any waitlist email, or with the unsubscribe button your email app shows next to our messages. When you unsubscribe, we delete everything we hold about you on the waitlist except your email address and the date you unsubscribed. We keep those two only so that we never email you again or add your address back by mistake. If you want that record deleted too, email us; you can then join again yourself.

Ask Shikinox

At launch, Ask Shikinox answers come from a curated FAQ, not from an AI model. [TODO: confirm whether Ask Shikinox questions are stored, and for how long; if they are, update the Retention and Service providers sections to match before publishing.] If we start storing questions or sending them to a third-party model, we will update this policy first. Please do not type confidential project details into Ask Shikinox; use the project brief after an NDA instead.

Server logs

Cloudflare, which hosts the site, processes the IP address, timestamp, requested page and browser type of each request in order to serve it, and keeps short-lived logs of the server code that handles forms. We use these logs for spam protection and to diagnose errors. Logs are kept for a shorter period than other data, as described under Retention.

Each form accepts at most 5 submissions per IP address per hour. We count them from the submissions we have already stored, by the keyed hash of the IP address saved with each one, so no separate record of your address is kept for this.

What we do not collect

We do not use advertising cookies, tracking pixels or cross-site identifiers. We do not buy data about you from anyone.

Analytics

We use Umami, a cookieless analytics service, to count page views and a few actions, such as sending a brief or joining the waitlist, so we can understand which pages are useful. Umami sets no cookies, does not track you across sites and anonymizes what it collects; it never receives what you type into a form.

We also use Cloudflare Web Analytics to measure how fast pages load for real visitors. It uses no cookies or other browser storage and does not fingerprint visitors.

Because neither service uses cookies or identifies you, there is no consent banner to click.

Spam protection

Forms on this site use Cloudflare Turnstile to tell people from bots. Turnstile loads only when you start using a form. It processes technical signals from your browser, such as request headers and a browser challenge result, to decide whether a submission is likely automated. It does not require you to solve a puzzle in most cases. Cloudflare's own privacy policy governs what it does with those signals.

Service providers who process data for us

We use a small number of providers to run the site. Each one processes data only on our instructions and only for the purpose listed.

Cloudflare hosts the site and runs the server code that handles forms, provides Turnstile for spam protection, and provides Web Analytics as described above. Data location: [TODO: confirm regions]
Neon provides the hosted Postgres database where briefs and waitlist entries are stored. Data location: [TODO: confirm regions]
Resend sends the emails we trigger, including waitlist confirmations and the copy of your brief that goes to us.
Umami provides cookieless analytics as described above.
Sentry receives a report when something on the site breaks, and timing data for about one in ten requests our server handles. A report can include the page address, your browser type and the technical details of the error. We configure it not to collect your IP address, cookies or what you type into forms; your browser contacts Sentry only on a page where an error happened.

We do not share your data with anyone else unless the law requires it.

When you send a brief or join the waitlist, you consent to us using that data for the purpose stated on the form. We rely on that consent, and on our legitimate interest in replying to a business enquiry, as the basis for processing.

Server logs and spam protection are processed on the basis of our legitimate interest in keeping the site secure and available.

You can withdraw consent at any time by emailing us or by using the unsubscribe link in any waitlist email. Withdrawing consent does not affect processing that happened before you withdrew it.

Retention

Project briefs and waitlist entries, with the hashed IP address and browser details stored with them: 24 months from the date you submitted them, then deleted. If a brief becomes a client engagement, the engagement agreement governs retention from that point.
If you unsubscribe from the waitlist: everything but your email address and the date you unsubscribed is deleted at once, and those two are deleted 24 months after you unsubscribed.
Server logs: a shorter period, typically no more than 90 days, after which they are deleted or anonymised. [TODO: confirm log retention period with hosting provider]

We delete sooner if you ask. See How to request access or deletion below.

Your rights under Canada's PIPEDA

If you are in Canada, the Personal Information Protection and Electronic Documents Act gives you the right to:

ask what personal information we hold about you and how it has been used
ask us to correct information that is inaccurate or incomplete
withdraw your consent to our use of your information, subject to legal or contractual restrictions
complain to us, and if you are not satisfied, to the Office of the Privacy Commissioner of Canada

We will respond to a request within 30 days.

Your rights under India's DPDP Act 2023

If you are in India, the Digital Personal Data Protection Act 2023 gives you the right to:

access a summary of the personal data we process about you and how it is used
have inaccurate, misleading or incomplete data corrected and updated
have your personal data erased when it is no longer needed for the purpose you gave it
grievance redressal, meaning a way to raise a concern with us and have it answered
nominate another person to exercise these rights on your behalf if you are unable to
withdraw consent at any time, as easily as you gave it

Grievances should be sent to the email address below. We will respond within 30 days. [TODO: confirm mailbox]

How to request access or deletion

Email hello@shikinox.com from the address you used on the site, or tell us which address you used. [TODO: confirm mailbox] Say whether you want a copy of your data, a correction or deletion. We will confirm receipt and complete the request within 30 days. We may ask for enough detail to confirm that the request comes from you. There is no charge.

International transfers

Shikinox serves companies in North America and our providers run infrastructure in more than one country. Your data may be stored or processed outside the country where you live. [TODO: confirm regions] Each provider is bound by a written agreement to protect data to a standard at least as strict as this policy.

Children

This site is directed at businesses and is not intended for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has submitted data to us, email us and we will delete it.

Security

Secrets are held only in our hosting provider's environment variables. All form input is validated on the server, forms are protected by Turnstile and a honeypot, and submissions are rate limited. The site is served over HTTPS with security headers enabled. No system is perfectly secure, so we also keep the amount of data we collect small.

Changes to this policy

We will update this policy when our practices or the law change. The effective date at the top tells you when the current version took effect. If a change materially affects how we use data you have already given us, we will email you before it takes effect.

Contact

Shikinox hello@shikinox.com [TODO: confirm mailbox] [TODO: registered legal name and jurisdiction]