Privacy
What we collect, and what we don't.
Short version: only what you type into a form, used only to reply to you, never sold or shared. This site sets no cookies, runs no analytics, and loads nothing from a third party — which is why you have not been shown a consent banner.
Last updated · Vandana Labs LLC
01
What we collect
Only what you type into a form. There is no tracking, no profiling, and nothing collected in the background.
- Contact and estimator forms
- Your name, company, work email, and optionally a phone number, budget, preferred start date, the service you are interested in, and your description of the project. If you send a brief from the estimator, the configuration you chose is included — the service, the band, the number of integrations, urgency, and the resulting price range.
- Your IP address
- Used in memory to rate-limit form submissions so the endpoint cannot be abused. It is never written to the database and does not survive a server restart.
- Server logs
- Our host records standard request logs. We do not analyse them, and they are not linked to anything you submit.
- What we do not collect
- No cookies, no analytics, no advertising or tracking pixels, no session recording, no fingerprinting, and no third-party embeds. Nothing on this site follows you anywhere else. This is why you have not been shown a cookie banner — there is nothing to consent to.
02
Why we hold it, and on what basis
- Purpose
- To reply to your enquiry and, if it goes further, to scope and quote the work. That is the only thing it is used for.
- Legal basis (UK/EU GDPR)
- Legitimate interest in responding to a business enquiry you initiated. You gave us the details specifically so we would reply.
- Marketing
- There is no mailing list and no drip sequence. We will not add you to one, and we will not send you anything unrelated to the enquiry you made.
- Selling or sharing
- We do not sell, rent, or share your information with anyone for their own purposes. Under the CCPA, we do not sell or share personal information as those terms are defined.
03
Where it goes
Three places, and no further.
- Our database
- Enquiries are stored in a PostgreSQL database hosted on Fly.io in the United States, accessible only to us.
- Our email
- A copy is emailed to us through Resend, an email delivery provider, so an enquiry is not lost if the database is unavailable.
- Our hosting
- The site itself runs on Fly.io. Standard server logs are generated as a consequence of serving the page.
- International transfer
- We are a US company and the data is stored in the United States. If you are in the UK or EU, submitting the form transfers your details to the US on that basis.
04
How long we keep it
- Retention
- Enquiries that do not become projects are deleted within 24 months. Where an enquiry becomes an engagement, records are kept for the life of the relationship and for as long as tax and contractual obligations require afterwards.
- Deleting sooner
- Ask, and we will delete it. No conditions and no retention argument — see below.
05
Your rights
If you are in the UK or EU you have these under GDPR. If you are in California you have comparable rights under the CCPA. In practice we apply them to everyone, because operating two standards is more work than operating one.
- What you can ask for
- A copy of what we hold about you, correction of anything wrong, deletion, a machine-readable export, or an objection to us holding it at all.
- How to ask
- Email us. Say what you want and we will do it — we will not require a form, an account, or a justification. We aim to respond within a few working days and within 30 days at the outside.
- Complaints
- If you are unhappy with how we have handled your data, tell us first and we will try to fix it. You also have the right to complain to your local data protection authority — in the UK, the Information Commissioner's Office.
06
Security
- In transit and at rest
- The site is served over HTTPS only, with HSTS. The database is not exposed to the public internet and is reachable only from our application.
- Access
- Only we can read enquiry data. There is no third-party CRM, no shared inbox tool, and no analytics vendor with a copy of it.
- If something goes wrong
- If a breach affected your information and posed a risk to you, we would tell you and the relevant regulator within the timeframes the law requires, rather than deciding for ourselves whether you needed to know.
Exercising a right, or asking a question
Email us and say what you want. We will not ask you to fill in a form, create an account, or explain why.
hello@jobrush.aiCommercial, IP, and security terms are separate — see trust & terms.