Privacy policy.

The short version.

You give us your email and a paragraph about your project, we use it to email you back an estimate, we follow up once. If you tell us to stop, we stop. We don't sell your data, we don't run ad tracking, and we keep third-party services to a minimum.

Who we are.

WebCentriq Inc. A software development studio, incorporated in the United States, with offices in San Diego, California and Markham, Ontario, Canada. You can reach our privacy contact at hello@webcentriq.com.

This policy covers webcentriq.com and the AI estimator we run on it.

What we collect.

Only what you give us, plus what the server logs automatically.

From the estimator form

• Your email address
• Your country and city
• A project description you type
• Project type, optional budget and timeline signals
• How you heard about us and how urgent it is

From your browser (automatic)

• Your IP address (used only for rate limiting and security)
• Your browser user-agent string
• The page you came from (HTTP referrer), if any
• Timestamps of your visit and form submission

What we don't collect

• We don't use third-party advertising pixels, Google Analytics, Facebook Pixel, or similar ad-tracking
• We don't buy data about you from other sources
• We don't collect payment information on this site — any invoicing is handled separately, under a separate agreement
• We don't use session recording or heatmap tools

How we use it.

• Generate your estimate. Your description, project type, budget signal, and timeline preference are sent to Anthropic's Claude API. The API returns a structured estimate. We do not fine-tune or train models on your data.
• Email you the result. We send you the estimate. The email provider is Resend.
• Notify our sales team. A senior engineer at WebCentriq reviews the estimate and decides whether to follow up. Your contact details and project description go to them so they can reply usefully.
• Follow up once. Expect a human reply within 72 hours. If you don't reply, that's the end of it — we don't run follow-up drip campaigns.
• Prevent abuse. Your IP address is used only for rate-limiting the API so no one can submit thousands of estimates in an afternoon.

Why we're allowed to process it (GDPR).

If you're in the EU or UK, our legal bases are:

• Your consent — clicking Submit on the estimator form gives us explicit consent to process the information you typed. You can withdraw at any time (see "Your rights" below).
• Legitimate interests — for basic server-log / anti-abuse data. We've weighed our interest in running a functioning website against your privacy and think this is proportionate.

Who else sees your data.

Four parties, all processors acting on our behalf:

We don't sell your data. We never have. We never will.

International transfers.

All of our processors are based in the United States. If you're in the EU, UK, or another jurisdiction with cross-border transfer rules, your data is transferred to the U.S. under Standard Contractual Clauses (SCCs) in our contracts with these vendors.

How long we keep it.

• Active lead. As long as there's an open conversation with you about a project, plus 12 months after the last reply.
• Closed lead. 24 months after the last contact.
• Server logs. 30 days, then deleted automatically by Vercel.
• Estimate email. Resend retains transactional emails for 30 days then purges.

You can ask us to delete earlier. See below.

Your rights.

Depending on where you live, you have some combination of:

• The right to see what we have. Ask us, we'll send you a copy.
• The right to correct it. If something's wrong, we'll fix it.
• The right to delete it. We'll wipe the record and confirm when done.
• The right to restrict processing. You can tell us to keep your data but not use it.
• The right to port it. We'll export your data in a machine-readable format.
• The right to opt out of "sale". We don't sell data — so there's nothing to opt out of, but you have the right anyway (California CCPA).
• The right to withdraw consent. Email us and we stop processing.

To exercise any of these: email hello@webcentriq.com. We'll respond within 30 days (usually much faster).

If we get it wrong, you can complain to your local data protection authority. In the EU that's your national DPA; in the UK it's the ICO; in California it's the CPPA.

California residents — CCPA / CPRA.

If you live in California, you have specific rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA). Here's the plain-English version.

What we collect (Notice at Collection).

When you submit the estimator, the information we collect falls into these California-defined categories:

We do not collect sensitive personal information as defined by CPRA: no Social Security numbers, driver's license, financial account numbers, precise geolocation, race, religion, union status, contents of your mail / email / text messages, genetic data, biometric information, health data, or information about your sex life.

Sources: we get this data directly from you (what you type) and automatically from your browser (IP, user-agent, referrer).

Purposes: generate your AI estimate via Claude, email it to you via Resend, notify our sales team for human follow-up, and rate-limit the endpoint to prevent abuse.

Third parties: our processors (Anthropic, Resend, Vercel, Google Fonts) as listed in the "Who else sees your data" section above. No one else.

We do not sell or share your personal information.

We do not sell personal information. We do not share personal information for cross-context behavioral advertising. Because of this, the "Do Not Sell or Share My Personal Information" mechanism required under CCPA/CPRA doesn't apply to us — there is nothing to opt out of here.

If we ever change this, we will update this policy, provide notice, and ask for your opt-in consent before any sale or sharing.

Your rights as a California resident.

• Right to know. You can ask what personal information we have about you, where we got it, what we use it for, and who we've shared it with in the last 12 months.
• Right to delete. You can request deletion of your personal information. We will comply unless we have a legal reason to retain it (rare for a lead record).
• Right to correct. You can ask us to correct inaccurate information.
• Right to portability. You can request a copy of your information in a machine-readable format.
• Right to opt out of sale or sharing. Not applicable (we don't), but the right exists.
• Right to limit use of sensitive personal information. Not applicable (we don't collect SPI).
• Right to non-discrimination. We will not charge you a different price, provide a different quality of service, or deny service because you exercised a privacy right.
• Right to appeal. If we deny a request, you can appeal by replying to our response email.

How to exercise your rights.

Send an email to hello@webcentriq.com from the address you used on the form. We'll verify your identity by matching the email to your original submission, acknowledge within 10 business days, and substantively respond within 45 calendar days. For complex requests we may extend by another 45 days with notice to you.

Authorized agents.

You may designate an authorized agent to submit requests for you. We will need signed written permission from you (or a valid power of attorney) and we may still contact you directly to confirm.

Global Privacy Control (GPC).

GPC is a browser-level signal that tells websites you want to opt out of the sale or sharing of your personal information. We respect GPC signals. Because we do not sell or share, the signal has no additional effect on our processing — but we honor it.

Shine the Light (Civil Code §1798.83).

California residents can request information about whether a business has shared their personal information with third parties for those third parties' direct-marketing purposes. We do not share personal information for that purpose.

Our scale.

We process personal information for fewer than 10 million California residents per year, so CCPA / CPRA does not require us to publish detailed processing metrics. For transparency: we receive on the order of a few hundred form submissions per month in total, a fraction of which are California residents.

Complaints.

If you believe we have mishandled your information, you can file a complaint with the California Privacy Protection Agency or the California Attorney General.

Contact methods.

As required by California law, we provide two methods for submitting privacy requests: (1) email at hello@webcentriq.com, and (2) the contact section of our website.

Cookies and storage.

We use the smallest footprint we can get away with.

That's the entire list. No tracking cookies. No ad pixels. No session cookies. No Google Analytics, no Facebook Pixel.

If you decline the cookie banner, neither Vercel Web Analytics nor Speed Insights loads — you become completely invisible to us beyond your single visit (we still see server-log data like IP and user-agent, used only for rate limiting as described above).

Children.

This site isn't directed at children under 16. We don't knowingly collect data from children. If you think a child has submitted the estimator, email us and we'll delete their record.

Security.

The estimator form runs over HTTPS. Our serverless functions enforce rate limits, honeypot checks, and input validation. Database-level data (our CRM with lead info) is encrypted at rest and access is limited to the engineers and sales people who need it. We don't promise zero breaches — no one who's honest can — but we promise to tell you quickly if something happens that affects you.

Changes to this policy.

We'll update this page when we materially change how we handle your data. The "last updated" date at the top reflects the most recent change. If we make a material change that affects you, we'll email you.

Questions.

Email hello@webcentriq.com. A human will reply.

— WebCentriq Inc.