Who is responsible

Paul Insider is the commercial name of Paul Insider LLC, 1209 Mountain Road Pl NE, Ste H, Albuquerque, NM 87110, United States, the controller of the personal information described here. Use the privacy contact link on this page to submit a rights request, find our privacy email or contact us by post. No sales enquiry or account is required.

Information and its source

We collect the information you enter: first and last name, email, project type, message, first-contact preference and any messaging number or ID. Company, website, budget and timeline are optional. The messaging identifier is required only for a messaging channel. An email is required to identify the enquiry and handle delivery issues. Without required fields the project form cannot send. Do not provide passwords, payment details or sensitive personal information.

Purposes and legal bases

We use project details to assess and answer your request and take steps at your request before a possible contract (GDPR Article 6(1)(b), where applicable). Where you act for an organisation, our legitimate interest in responding to business enquiries may apply (Article 6(1)(f)). We use security data to protect the service and visitors against abuse, on legitimate interests, and retain legally required information under Article 6(1)(c). Acknowledging this notice is not consent to advertising. We respect your first-contact channel and do not call without agreement.

Security information

The server checks request time, origin headers and a random single-use form token. Cloudflare stores tokens for up to 30 minutes and keyed hashes of network addresses with rate counters for up to one hour, without messages, names or emails in that security store. Expired entries are removed by scheduled cleanup; provider backups and security logs follow their own retention settings. These identifiers are not used for advertising. Bot traps may silently discard automated submissions; ordinary validation, rate-limit and delivery errors produce an error response. No CAPTCHA, advertising profile or decision with legal or similarly significant effects is implemented.

Recipients and international processing

Authorised studio personnel handle enquiries. Formspree processes and stores form submissions and forwards them to our Proton Mail inbox. Cloudflare is the selected public hosting/security provider; the final deployment configuration remains to be verified. Providers can process information in the United States, Switzerland and other countries where they operate. Where GDPR requires transfer safeguards, applicable adequacy decisions or appropriate contractual safeguards, including standard contractual clauses, must cover the transfer. Ask through the privacy contact about applicable safeguards or copies subject to lawful redactions.

Retention

Our policy is to review and delete enquiries that do not lead to an active relationship within 180 days after the last meaningful exchange. This requires deletion from the mailbox and the available Formspree records; it is not an automatic deletion feature of this website. Active negotiations, contracts and records needed for accounting, legal obligations or claims follow the applicable retention period. Provider backups and security logs follow their documented retention and deletion arrangements. Rights requests are retained only as needed to respond and demonstrate compliance.

No sale or unsolicited marketing

We do not sell personal information or share it for cross-context behavioural advertising. We do not rent contact lists, subscribe enquirers to newsletters or use form contents for unrelated promotional messages. A messaging preference does not authorise calls or promotional campaigns. Your chosen messaging service may process your information when a conversation begins, under its own terms.

Your rights and how to request them

Depending on applicable law, you may request access, correction, deletion, restriction or portability, object to processing based on legitimate interests and withdraw consent where processing actually relies on it. Use the separate privacy request form or its displayed email, or write to the postal address above. No budget, project brief, phone number or identity document is required to start. We may request proportionate verification if there is reasonable doubt; authorised agents may act subject to applicable verification. Rights are subject to legal exceptions.

European requests

Where GDPR applies, we normally respond within one month; if complexity or volume justifies up to two additional months, we explain the extension within the first month. Requests are normally free. You may complain to your competent data protection authority, including the authority where you live or work. Withdrawal does not affect earlier lawful processing. We do not use solely automated decisions producing legal or similarly significant effects.

United States and California

Where applicable, California residents may have rights to know/access, correct, delete and receive equal treatment for exercising rights. Categories are identifiers, professional/commercial details, network activity used for security and information voluntarily supplied; sources, purposes, recipients and retention are described above. We do not knowingly sell or share data of minors. CCPA/CPRA rights depend on the law’s scope and exceptions. For covered requests to know, correct or delete, the normal response period is 45 calendar days, extendable by 45 with timely notice where permitted. Contact methods are available through the privacy contact and by post; any additional legally required method depends on our applicable obligations.

Tracking signals and children

This application does not perform cross-site tracking, sell data or share it for targeted advertising, whether or not a Do Not Track or Global Privacy Control signal is sent. Such a signal does not disable essential security checks. This professional-services website is not directed to children under 13 and we do not knowingly collect their personal information. Contact us to request removal if a child has submitted data.

Changes

The date on this page identifies the current notice. Material changes will be communicated through an updated notice and any additional information or choice required before a new incompatible purpose or optional tracking is introduced.