This policy covers the Altus Labs website. It does not cover data we process on behalf of clients under a contract, which is governed by that agreement and by a data processing addendum.
We have written this in plain language because a privacy policy nobody can read is not consent.
What we collect
When you send a project brief. Your name, work email, and optionally your company, role, budget range and timeline, plus whatever you write in the message field. We collect this because you chose to send it to us.
When you visit any page. Aggregate analytics through Vercel Analytics and Vercel Speed Insights. These are cookieless and do not build a profile of you across sites. We see page views, referrers, country level location and performance timings. We do not see who you are.
In our server logs. IP address and request metadata, retained for a short period for security and abuse prevention. We use the IP address to rate limit form submissions, which is the only automated decision we make about a request.
We do not use advertising trackers, we do not run session recording, and we do not sell or share your data with anyone for their own purposes.
Why we can process it
For form submissions, our lawful basis is your consent, which you give by submitting the form and can withdraw at any time.
For server logs and abuse prevention, our lawful basis is legitimate interest in keeping the service available and free of automated abuse.
Who processes it with us
We use a small number of vendors, each under a data processing agreement:
- Vercel, for hosting, analytics and edge delivery
- Resend, for sending and receiving transactional email
- Google Fonts, self hosted at build time, so no request is made to Google from your browser
Nobody else receives your data. We do not use a customer relationship management platform for website enquiries.
How long we keep it
Project briefs are retained for twenty four months from the last contact, then deleted. If the enquiry becomes a client relationship, retention moves to the terms of that contract.
Server logs are retained for thirty days.
Your rights
If you are in the United Kingdom, the European Economic Area, or another jurisdiction with equivalent protections, you have the right to access your data, correct it, have it deleted, restrict or object to processing, and receive a portable copy.
Write to info@altuslabshq.com and we will respond within thirty days. We will not ask you to justify the request.
You also have the right to complain to your data protection authority. In the United Kingdom that is the Information Commissioner's Office.
International transfers
Our team is in Nepal and our infrastructure is hosted in the European Union and the United States depending on the service. Where data leaves the European Economic Area, we rely on standard contractual clauses with the relevant processor.
Cookies
This site sets one item of local storage, altus-theme, which records whether you chose the light or dark theme. It is not a cookie, it is never sent to our server, and it contains no identifier.
We set no advertising, tracking or analytics cookies. This is why you have not seen a cookie banner.
Changes
If we change this policy in a way that materially affects you, we will update the date at the top and, where we hold your email address, tell you directly.
Contact
info@altuslabshq.com, or write to Altus Labs, Kathmandu, Nepal.