A quiet consultancy meeting room in Boston at dusk, with laptops and a whiteboard in soft focus

Legal & data

Privacy Policy

This policy tells you what personal data thoughtbot collects through this website, why we collect it, how long we keep it, and how to ask us to change or delete it. The operator is thoughtbot, a software development consultancy based in Boston, Massachusetts, United States.

Information we collect

We only hold what you send us or what the site records while running. There are two kinds of data, and they arrive for different reasons.

What you send us

When you submit a contact or enquiry form, we collect the details you enter: typically your name and email address, plus any project description, budget range, or timeline you choose to include. Nothing in the form is collected until you press the submit button, and you decide how much detail to give.

  • Name and email address
  • Project notes, if you include them
  • Anything else you type into the message field

What the site records

Our servers write standard technical entries as pages are served: IP address, browser type, the pages you viewed, and the time of the request. These entries keep the site stable, help us spot abuse, and feed aggregate statistics about which pages are useful.

We do not collect payment card details on this website. No part of this site takes card numbers, and there is no checkout here.

Why we process it

Contact details exist here for one purpose: so we can reply to your enquiry, ask a clarifying question, and continue that conversation if you want to keep it going. If your message turns into a project, the same details support the normal back-and-forth of scoping and delivery.

Technical data works differently. We read it in aggregate to keep the site running, block abusive traffic, and see which service and insight pages visitors actually read. We do not sell personal data, and we do not build advertising profiles of individual visitors from it.

Retention

We keep enquiry messages for as long as we need them to handle your request and any engagement that follows from it, then for a reasonable period afterwards so our records stay consistent. After that, they are deleted or reduced to a note that no longer identifies you.

Technical logs follow a shorter schedule. They are kept only as long as they are useful for security and statistics, unless we need a specific record to investigate an incident — in which case that record is held until the investigation closes.

Your rights

Depending on where you live, you may hold some or all of the rights listed below. They are not limited to any one country, and we apply them to any request we can reasonably honour.

  • Access — ask what personal data we hold about you.
  • Correction — have inaccurate details put right.
  • Deletion — ask us to erase what we no longer need.
  • Restriction and objection — limit or object to certain processing.
  • Portability — receive your data in a portable format.

To make a request, email [email protected]. We may ask you to verify your identity before acting, so that we do not release data to the wrong person.

Cookies and third parties

This site uses cookies. Some are necessary for the site to work — remembering a form state or a session, for example. Others may be set by third-party services embedded in pages. The full list, with what each one does and how long it lasts, sits in our Cookie Policy.

Where a third-party provider processes data on our behalf, that provider is bound by its own terms and by the data protection obligations that apply to it. We choose providers that can meet those obligations, and we do not pass personal data to unrelated companies for their own marketing.

Security

We apply reasonable technical and organisational measures to protect personal data against unauthorised access, loss, or alteration. In practice that means limiting who inside the company can reach enquiry records, keeping systems patched, and using encrypted connections between your browser and our servers.

No method of transmission or storage removes every risk, and we cannot promise that data will never be affected by an incident. If a breach puts your rights at risk, we will tell you and the relevant authority where the law requires it.

Children

This website is built for business and professional use: companies looking at engineering, design, and AI work. It is not directed at children, and we do not knowingly collect personal data from them. If you believe a child has sent us personal data, write to us and we will delete it.

Changes to this policy

We may update this policy when our practices change or when the law does. The revised version takes effect the day it is published on this page. If you keep using the site after that date, we treat it as acceptance of the updated policy. When a change materially affects how we handle your data, we will make that clear at the top of the page.

Other documents in this set

This policy covers personal data. Two neighbouring documents cover related ground, and it helps to know which one answers which question.

  • Cookie Policy

    Lists the cookies this site sets, what each one is for, and how you can control them in your browser.

  • Terms of Service

    Sets the rules for using this website and the basis on which we describe our engineering, design, and AI work.

An empty software studio floor in the evening, workstations dark and one floor lamp still lit

Still unsure what we hold?

Send a short message and we will look up what we have, explain how it got there, and delete it if you ask us to. Most questions take one reply to settle.