Privacy Notice
What we collect, why, where it goes, how long we keep it, and how to have it removed.
The short version. We collect what you type into a form, plus the technical information any web server receives. We run no analytics, no advertising, and no tracking of any kind. We do not sell, share, or broker your information. If you want your data deleted, email privacy@sigmaticlabs.io and we will do it.
This notice describes how Sigmatic Labs Consulting, LLC ("we", "us") handles personal information collected through sigmaticlabs.io. It reflects how the site is actually built rather than a template — the subprocessors listed below are the complete set.
1. What we collect
Information you provide. When you submit the contact form, the assessment request, or the AI maturity self-assessment, we receive:
- Name and work email address
- Organization, role, and industry
- The topic you selected and any details you wrote
- For the maturity self-assessment: your twelve answers and resulting score
Information collected automatically. Like any web server, our hosting records technical request data — IP address, user agent, requested URL, timestamp. Google reCAPTCHA additionally collects device and interaction signals to distinguish humans from automated submissions.
We do not run analytics. There is no Google Analytics, no tag manager, no advertising pixel, no heatmap tool, and no session recording on this site. We do not know which pages you visited or how long you stayed.
2. Why we process it
| Purpose | Basis |
|---|---|
| Responding to your enquiry | Your request — you submitted the form in order to hear from us |
| Sending your assessment breakdown | Your request, and the stated purpose of the exchange |
| Preventing spam and abuse | Legitimate interest in keeping the form usable |
| Security and availability logging | Legitimate interest in operating the service securely |
We do not add you to a mailing list. Submitting a form does not subscribe you to anything. If we introduce a newsletter it will require a separate, explicit opt-in — consent given for one purpose is not consent for another.
3. Who processes it
This is the complete list of third parties that touch data from this site.
| Provider | Role | What it sees |
|---|---|---|
| Google Firebase Hosting | Serves the website | Request logs including IP address |
| Google Cloud Firestore | Stores form submissions | Everything you submit |
| Google Cloud Functions | Processes form submissions | Everything you submit, in transit |
| Google reCAPTCHA | Bot prevention | IP address, device and interaction signals |
| Google Fonts | Serves typefaces | IP address when fonts are fetched |
| Resend | Delivers our notification email | The contents of your submission |
| Google Workspace | Our email inbox | The contents of your submission |
All are US-based. Data is processed in the United States. We have no other subprocessors, and we do not use your information to train AI models.
4. Cookies
We set no cookies of our own. The site stores nothing in your browser — no cookies, no local storage, no session storage.
Google reCAPTCHA sets its own cookies on the pages that carry a form, which is how it distinguishes humans from bots. That is the only cookie you will receive from this site, which is why there is no consent banner — there is nothing optional to consent to.
5. How long we keep it
| Data | Retention |
|---|---|
| Form submissions | 24 months from submission, then deleted |
| Email correspondence | Retained while there is an active or prospective relationship |
| Server request logs | Per Google Cloud's default retention |
If you become a client, records relating to the engagement are kept for as long as our contract and applicable record-keeping obligations require.
6. Your rights
Wherever you are, you can ask us to:
- Tell you what we hold about you
- Correct it if it is wrong
- Delete it — we will, unless we are legally required to keep it
- Provide a copy in a portable format
- Stop processing it where you object to a legitimate-interest basis
Email privacy@sigmaticlabs.io. We aim to respond within 30 days and we will not ask you to justify the request.
If you are in the EU or UK, you also have the right to complain to your supervisory authority. If you are a California resident, we confirm that we do not sell or share personal information as those terms are defined under the CCPA, and we will not discriminate against you for exercising any right above.
7. Security
The site is served over HTTPS only. Form submissions are transmitted over TLS and stored in Google Cloud Firestore under Google's encryption at rest. Access to submissions is restricted to Sigmatic Labs personnel who need it.
To report a security issue, email security@sigmaticlabs.io. We will acknowledge and work with you on disclosure.
8. Children
This site is directed at businesses and is not intended for anyone under 16. We do not knowingly collect information from children. If you believe we have, contact us and we will delete it.
9. Changes
If this notice changes materially we will update the effective date above. We do not maintain a mailing list, so we cannot notify you directly — the date at the top is the authoritative indicator.