Privacy Policy

Effective 2026-08-07  ·  Last updated 2026-08-10

Nothing tracks you on this site unless you say yes. We load no analytics scripts and set no analytics cookies until you choose “Accept” on our banner, and you can change your mind at any time. We do not sell or share your personal information, and we run no advertising features.

Who we are

This website (project5.ai) is operated by Project5.ai — legal entity [LEGAL ENTITY NAME — to be confirmed], registered at [POSTAL ADDRESS — to be added]. It is run by The Operator, who is the controller of the personal information described in this notice. You can reach us at rick@project5.ai.

This site is instrumented by Project5 itself: its Google Tag Manager container (GTM-WJSNBN47) was created with the product, and the consent behaviour described below is the behaviour we ship to clients. If anything on this page ever stops matching what the site actually does, that is a defect — tell us and we will fix it.

What we collect with your consent

If — and only if — you choose “Accept” on our cookie banner, we load Google Analytics 4 through Google Tag Manager. From that point on, and until you withdraw your consent, Google Analytics collects:

• Pages you view on this site, and when you viewed them.
• Clicks on our contact links, recorded as a cta_click event together with which part of the page the link was in — for example header or start. We use this to tell which parts of the site prompt people to get in touch. It records no part of your email address and nothing you go on to write to us.
• A request you actually send us through the form, recorded as a generate_lead event together with which product was requested — audit, setup, monitoring or general. It is recorded once, when our server has accepted the request, and not when you click a button or open the form. We use this to tell which product people ask about. It is analytics only, governed by the same consent as everything else here; it records no part of your email address and nothing you go on to write to us.
• An approximate location (typically city or region level) derived from your IP address.
• Device and browser information, such as browser type and version, operating system, screen size, and language.
• How you arrived at the site, such as the referring website or search engine.
• A randomly generated identifier stored in cookies on your device, which lets us tell repeat visits apart from new ones.

Cookies we set once you accept

We also store your consent choice itself in your browser’s local storage under the key project5_consent_v1. It records only whether you accepted or declined and when. It is never sent to us or to anyone else, and it is what stops the banner from asking you again on every page.

What we collect if you decline — or never choose

Nothing, for analytics purposes. If you decline, or if you simply ignore the banner, no Google Analytics or Google Tag Manager code is ever downloaded or executed, and no analytics cookies are set. There is no “cookieless” or anonymised tracking fallback running in the background.

As with any website, our hosting provider records standard server request logs (such as the IP address and the file requested) as a technical necessity for delivering and securing the site. These logs are not used to build profiles, are not combined with analytics data, and are not used to identify individual visitors.

Information you send us on purpose

This site has one form — the request form at the foot of the home page — and no newsletter signup. It posts to our own server on our own domain. Nothing you type passes through a third-party form processor, a marketing automation platform or a CRM, and submitting it loads no tracking pixel and sets no cookie.

When you submit it we store what you typed — your email address, and the site URL, container ID and note if you filled them in — together with the IP address and browser user-agent string the submission arrived with, and the time it arrived. We use the IP address and user-agent only to rate-limit the form and identify automated abuse; they are not used to profile you and are not combined with analytics data. This is processed on the basis of our legitimate interest in responding to enquiries and keeping the form usable, and, where applicable, in order to take steps at your request before entering into a contract.

We also send you a confirmation email and send ourselves a notification of the same request. Those are transactional emails: they carry no tracking pixel, no open tracking and no click tracking. They are delivered by Resend, our email service provider, which processes your address on our behalf and for no other purpose.

You can still just email us instead, at rick@project5.ai. If you do, we receive whatever you choose to send and use it only to reply to you and to keep a record of the conversation.

If we later add a sign-in for your scan history, it works by emailing you a one-time link rather than by asking you to create a password. The link is stored on our server only as a one-way hash, expires within minutes, and works once.

Why we collect analytics data

To understand, in aggregate, how the site is used: which pages people read, roughly where visitors come from, and whether the site works on their devices. That is the entire purpose. We use it to decide what to improve.

We do not sell your personal information and we do not share it for cross-context behavioural advertising. No advertising features, remarketing, audience export or Google Signals functionality is enabled on our Google Analytics property. Google’s advertising consent signals (ad_storage, ad_user_data and ad_personalization) are set to denied on every page load and are never granted, even when you accept analytics.

Your consent choices

We use an opt-in model everywhere in the world, not just where the law requires it. Analytics stays off until you actively choose to turn it on, and Accept and Decline are presented with equal prominence.

You can change your decision at any time using the Privacy choices control in the bottom-left corner of every page, or right here:

Open privacy choices

If you switch from Accept to Decline, we do three things immediately: signal the withdrawal to Google so collection stops, delete the Google Analytics cookies described above from this browser, and reload the page so that nothing already running continues. You can also clear cookies and site data for project5.ai in your browser at any time, which resets your choice entirely and brings the banner back.

Global Privacy Control

We honour the Global Privacy Control (GPC) browser signal. If your browser or extension sends a GPC signal, analytics is treated as declined by default and nothing loads. We still show you the banner, with a note explaining that we have honoured the signal, so that you can turn analytics on deliberately for that browser if you want to. We will never treat a GPC signal as permission.

Who else processes this data

Google LLC (and its affiliates) processes analytics data on our behalf as our service provider or processor, through Google Analytics 4 and Google Tag Manager. Google’s handling of that data is governed by its own terms and by Google’s Privacy Policy. Data may be processed on servers in the United States and other countries where Google operates. Our hosting provider (Google Firebase Hosting) serves the site’s files and keeps the server logs described above.

Resend (Plus Five Five, Inc.) delivers the transactional email described above, and receives your address and the contents of that email in order to send it. It is used for nothing else.

No other third party receives personal information from this site. Web fonts are served from our own domain rather than from Google Fonts, so no request — and therefore no IP address — is sent to a third party merely because you loaded a page. Until you accept, this page makes no request to any origin except project5.ai — including the request form, which posts to project5.ai and is only sent when you press the button.

How long we keep it

Google Analytics event-level and user-level data is retained for 2 months, Google’s default setting, after which it is deleted. Aggregate, non-identifying reports derived from that data may be retained for longer. Emails you send us, and requests you submit through the form, are kept for as long as needed to handle your enquiry and any follow-up, and for our own business records afterwards. You can ask us to delete a request at any time. Your consent choice stays in your browser until you clear your browser storage.

Your privacy rights

California and other U.S. states

If you live in California, the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA) gives you the right to know what personal information we collect and how we use it, the right to request deletion of it, the right to request correction of inaccurate information, and the right to opt out of the sale or sharing of personal information. We do not sell or share personal information, so there is nothing to opt out of — but the Privacy choices control turns analytics off regardless. We will never discriminate against you for exercising any of these rights.

Residents of other U.S. states with comprehensive privacy laws — including Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana and others as those laws take effect — have comparable rights of access, correction, deletion, portability and opt-out, and we extend the same treatment to all of them.

European Economic Area, United Kingdom and Switzerland

If the GDPR or UK GDPR applies to you, our legal basis for analytics is your consent (Article 6(1)(a)), and you have the right to:

• access the personal data we hold about you;
• have inaccurate data rectified;
• have your data erased;
• restrict how we process it;
• receive your data in a portable format;
• object to processing;
• withdraw your consent at any time, without affecting the lawfulness of processing carried out before you withdrew it; and
• lodge a complaint with your national supervisory authority (in the UK, the Information Commissioner’s Office).

How to exercise your rights

Email rick@project5.ai and tell us what you want us to do. We will respond within the timeframe the applicable law requires. We may need to ask you for information to verify who you are before we act on a request. You may use an authorised agent where the law allows it. Because analytics data we hold is not tied to a name or email address, we may need details such as approximate visit dates to locate any records about you — and in many cases there will be nothing identifiable to find.

Complaints

If you think we have handled your information badly, tell us first at rick@project5.ai — it goes to the person who runs the site, not a queue. If you are not satisfied, you can complain to a data protection authority: [SUPERVISORY AUTHORITY — to be confirmed once the entity and its jurisdiction are settled].

Children

This site is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us with personal information, email us and we will delete it.

Changes to this notice

We may update this notice as the site changes or as the law does. When we do, we will revise the “Last updated” date at the top. If we make a change that materially expands how we use your personal information, we will ask for your consent again through the banner before the change takes effect for you.

Contact

Questions, requests or complaints about privacy on this site: rick@project5.ai.