Legal

Privacy Policy

Last updated: August 17, 2026

1. Who we are

The Project Analyst Co we provide fixed-scope AI pilot audits and implementation services to businesses. This policy explains what information we collect through this "Site", why we collect it, and what choices you have. We are the data controller for the personal information described below, operating from Islamabad, Pakitsan.

2. What we collect

We collect information in two ways: what you give us directly, and what's generated automatically by visiting the Site.

Information you provide

  • Contact form submissions: name, email address, and any message you write, plus which offer (Audit, Express Audit, Pilot Sprint) you selected collected when you submit the "Get Your Audit" form.
  • Client engagement data: if you become a client, we collect whatever operational, project, or business data is necessary to run your audit or pilot (e.g., the baseline metrics and system access you grant us), this is governed separately by your engagement agreement, not just this policy.

Information collected automatically

  • Server logs: IP address, browser type, pages visited, and timestamps, generated by standard web server operation used only for security and troubleshooting, not profiling.
  • Font delivery: this Site loads typefaces from Google Fonts' CDN. Loading a font makes a request to Google's servers, which by design of the web receives your IP address as part of that request. We don't control what Google does with that request beyond serving the font file; see Google's Privacy Policy.

We do not currently use analytics or advertising trackers on this Site. This Site does not use cookies, and has no login or account functionality of any kind. We do not set marketing, analytics, or tracking cookies..

3. How we use it

  • To respond to your inquiry and follow up about our services
  • To deliver an Audit, Express Audit, or Pilot Sprint you've engaged us for
  • To maintain the security and proper functioning of the Site (rate limiting abuse, detecting bot submissions)
  • To meet legal, accounting, or contractual obligations (e.g., invoicing)

We do not use your contact form information for advertising, and we do not sell personal information to anyone.

If you're located in the EU/UK, our legal bases under GDPR are:

  • Consent — when you voluntarily submit the contact form
  • Legitimate interest — for basic security logging and abuse prevention (rate limiting, spam filtering), balanced against your privacy rights
  • Contract performance — for data processed as part of delivering a paid engagement

5. Sharing & third parties

We don't sell your information. We may share it narrowly with:

  • Service providers we use to run the business. e.g., a transactional email service or CRM to manage your inquiry once one is connected (see note below), hosting providers, and payment processors for paid engagements. Each only receives what's necessary to do their job.
  • Legal compliance if required by law, subpoena, or to protect our rights or the safety of others.

Operational note: as of this policy's last update, contact form submissions are logged server-side and outed via resend..

6. Cookies & tracking

This Site does not set marketing or analytics cookies. Any cookies present are strictly functional (e.g., a session identifier if you're logged into a future client portal) and are not used to track you across other websites.

7. Data retention

  • Contact form inquiries that don't turn into a client relationship: retained for 2 years, then deleted.
  • Client engagement data: retained for the duration of the engagement plus 3 years to meet tax, accounting, or contractual obligations, then securely deleted.

8. Security

We take reasonable technical measures to protect the information you share with us, including:

  • Encrypted connections (HTTPS/TLS) between your browser and our server
  • Server-side validation and sanitization of every form submission, not just client-side checks
  • Rate limiting on the contact endpoint to reduce automated abuse
  • No storage of sensitive data (like payment card numbers) on our own servers payments are handled by a PCI-compliant processor

9. Your rights

Depending on where you live, you may have the right to:

  • Access the personal information we hold about you
  • Correct inaccurate information
  • Delete your information ("right to be forgotten")
  • Object to or restrict certain processing
  • Data portability receive your data in a portable format
  • Withdraw consent at any time, where processing is based on consent

California residents have similar rights under the CCPA/CPRA, including the right to know what personal information is collected and to request deletion. We do not sell personal information, so there is nothing to opt out of in that regard.

To exercise any of these rights, contact us using the details in Section 13.

10. Children's privacy

This Site and our services are directed at businesses, not children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us information, contact us and we'll delete it.

12. Changes to this policy

We may update this policy as the Site or our services change. Material changes will be reflected by updating the "Last updated" date at the top of this page. We encourage you to review this page periodically.

No system is perfectly secure, and we can't guarantee absolute security but we design with these protections as a baseline, not an afterthought.

13. Contact us

Questions about this policy, or want to exercise any of the rights above? Reach us at:

  • Email: theprojectanalystco@gmail.com

Ready to know for sure?

Get Your Audit