Privacy Policy

1. Who this notice covers

This notice explains how Ampheres ("we", "us") handles personal information collected through this website, ampheres.com. It does not cover work we perform for clients under a signed agreement; in client engagements, the client is normally the controller of the personal data involved, and our obligations are defined by that agreement instead.

Ampheres is an independent studio serving businesses in New York. We have not yet incorporated as a legal entity. This notice will be updated with our corporate details once incorporation is complete.

2. What we do not do

To be explicit, because most privacy policies are vague about this:

• We do not set cookies.
• We do not use Google Analytics or any other analytics or measurement tool.
• We do not use advertising pixels, remarketing tags or cross-site tracking.
• We do not build visitor profiles or make automated decisions about you.
• We do not sell, rent or trade personal information.
• Our content delivery network is configured without access logging, so we do not keep server logs of the pages you visit.
• We do not store the answers you type into the project brief in any database. They travel to us as an email and live in our mailbox, nowhere else.

3. Information you choose to send us

The project brief on our website is a guided form. Your answers stay in your browser while you move through the steps; nothing is sent until you press the final submit button.

When you submit it, your answers are transmitted over an encrypted connection to a small function we run on Amazon Web Services. That function does one thing: it formats your answers into an email and hands it to our email provider for delivery to our contact address. It does not write your answers to a database, and it keeps no copy of them once the email has been handed over.

What we then hold is the email itself, typically containing: name, work email, company or project name, the outcome and capability layers you selected, your description of the situation, a link you chose to share, and your timing and budget range.

If you email us or message us on Instagram, we hold that conversation. We ask you not to send sensitive personal information, credentials, or confidential third-party data through these channels.

4. Keeping the contact form from being abused

A public form with no protection gets found by bots and filled with junk. Two measures guard it, and both involve limited processing of technical data, so we would rather state them plainly than bury them.

First, we limit how many briefs can be submitted from the same internet connection within an hour. To count them without keeping a record of who you are, your IP address is converted into an irreversible cryptographic hash the moment it arrives. We store only that hash and a counter, never the address itself, and the record deletes itself automatically about an hour later. The hash cannot be turned back into your IP address, and we do not use it for any other purpose.

Second, we use Cloudflare Turnstile, a bot-detection service, in its invisible mode. You are never shown a puzzle or asked to click anything: it works silently in the background, assessing signals from your browser to judge whether the submission is automated, and issues a token that our function verifies before accepting your brief. Cloudflare processes your IP address, browser and device characteristics for this check. As Cloudflare requires us to state, this processing is governed by the Cloudflare Turnstile Privacy Addendum, available at https://www.cloudflare.com/turnstile-privacy-policy/. Turnstile is not an analytics tool: it does not track you across sites and is not used to profile you.

5. Why we use it and on what basis

We use the information you send us to reply to your enquiry, assess whether we can help, and, at your request, prepare a scope, proposal or workspace. We also keep ordinary business records of this correspondence. The technical measures described above are used only to keep the form usable and free of automated abuse.

For visitors in the EU, EEA and UK: responding to your enquiry relies on our legitimate interest in answering someone who contacted us, on steps taken prior to a possible contract at your request, and, where applicable, on compliance with a legal obligation. The anti-abuse measures rely on our legitimate interest in protecting our systems from misuse.

We do not send marketing newsletters from website enquiries.

6. Information stored in your browser

We store three short-lived values in your browser’s sessionStorage, purely so the interface behaves correctly: which section you asked for while a page loads, and two flags that prevent the entry animation from replaying during internal navigation or a language change. These are not identifiers, they are not shared with anyone, and your browser discards them when you close the tab.

7. Who else is involved

We keep the number of third parties deliberately small. Each one below handles a specific, limited task:

• Amazon Web Services: hosts the site as static files (Amazon S3 and Amazon CloudFront) and runs the function that turns a submitted brief into an email, along with the counter used for rate limiting.
• Resend: our email provider. It delivers project briefs from the website to our contact address, and therefore processes the contents of what you submit in transit.
• Cloudflare: provides DNS for our domain and the Turnstile bot-detection check described in section 4.
• Our mailbox provider: receives and stores the project briefs and correspondence sent to our contact address.
• Instagram: our footer links to our Instagram profile. If you follow it, Meta’s own policies apply. We do not embed Instagram content or trackers in our pages.

8. How long we keep it

We keep enquiry correspondence for 24 months from our last exchange, then delete it, unless an engagement started or the law requires us to keep it longer.

The hashed rate-limiting records described in section 4 expire automatically about an hour after they are created.

9. Security

We maintain administrative, technical and physical safeguards appropriate to the small amount of information we hold, including access control on the mailboxes that receive enquiries, encryption in transit, and a static website with no public database.

No method of transmission or storage is completely secure. If a security incident affects private information we hold, we will notify affected individuals and authorities as required by applicable law, including the New York SHIELD Act.

10. Your choices

Regardless of where you live, you can ask us to tell you what correspondence we hold about you, correct it, delete it, or stop using it for a particular purpose. We will respond within 30 days. We may ask you for enough information to confirm who you are, and we may keep records where the law requires it.

If you are in the EU, EEA or UK you also have the right to object to processing based on legitimate interests, to request restriction or portability, and to complain to your local data protection authority. We do not discriminate against anyone for making a request.

11. Children

This website is intended for business audiences and is not directed to children under 16. We do not knowingly collect information from children. If you believe a child has sent us personal information, write to us and we will delete it.

12. Changes

If we change how we handle personal information, we will update this page and its effective date. Material changes will be summarised at the top of the page.