Privacy policy

Information you provide

We collect information you choose to send to us. Depending on the form or conversation, that can include your name, work email, optional company details, an app URL or product name, what you want reviewed, timelines, and other context you enter.

Please do not put passwords, private keys, API tokens, production credentials, health information, or other unnecessary sensitive data into a general website form. Forms used for audit and review inquiries reject common credential-like patterns, but that check is not a substitute for your own care.

Production Check data

When you start a Production Check, we store the submitted URL, builder and launch-stage answers you choose, campaign attribution associated with the visit, scan progress, and a sanitized result. The result can include public-risk scores, finding counts and classifications, detected technologies, coverage information, evidence labels, and a public report-share identifier.

The scanner makes bounded requests to public pages and public browser assets. Its persistence layer is designed not to retain fetched raw HTML or JavaScript bundles, discovered raw credentials, query strings, URL fragments, or unnecessary page content. Credential-like values cause a report to be rejected instead of stored. A report may still identify the scanned public origin and describe the kind of public evidence observed.

Production Check reports use hard-to-guess links, but anyone with a report link may be able to view it until it expires. Share the link only with people you trust.

Engineer Scope Review and offers

If you request an Engineer Scope Review, we store your contact details, sanitized app URL and scan summary, builder and launch answers, the type and timing of help requested, optional shipping context, your main concern, your willingness to provide limited evidence or access later, and the review status.

If Engisols prepares a scoped offer, we also store its recommendation, inclusions, exclusions, price, billing basis, delivery window, status, and any approval or decline. Approval records your decision about the proposed scope; it does not record a payment. Payment and onboarding are handled separately.

An AI App Audit inquiry stores the name, work email, app or product, review concern, and attribution you submit. Any repository access or client code later shared for a paid engagement is governed by the relevant NDA or signed engagement terms, not by the public Production Check retention schedule.

Analytics, session replay, and advertising measurement

We use PostHog for product analytics, error capture, and session replay. Depending on your use of the site, it may record pages visited, navigation, clicks, scrolls, browser and device information, performance information, and other page interactions. Input values are masked in session replay, while sensitive rendered evidence is blocked. Replay and PostHog events are disabled on internal Production Check operator pages, and automatic capture is disabled on capability-bearing offer pages.

We use the Meta Pixel and Meta Conversions API to understand advertising and conversions. Meta may receive page-view or conversion events, Meta cookie identifiers such as _fbp and _fbc, a hashed version of a submitted email for saved lead events, IP address, browser user agent, event time, and the page where an event happened. We do not send Meta scanned app URLs, inquiry text, findings, source code, builder answers, shipping context, UTM values, or report contents as conversion-event data.

We respect Global Privacy Control and any stored Engisols Meta tracking preference. A denied decision prevents browser Pixel events and server-side Meta conversion events. Browser privacy tools may also block provider requests.

Attribution and technical data

We may collect UTM campaign fields and a Facebook click identifier from the page address. Analytics and advertising providers may also process referrer, browser, device, operating-system, IP-address, cookie, and event information. Engisols uses those signals to understand traffic, attribute inquiries, prevent duplicate conversion events, protect the service, and diagnose failures.

PostHog event properties are restricted at the application boundary for the AI App Audit and Production Check funnels. Names, emails, app details, free-text inquiry content, attribution tokens, and Meta event identifiers are not included in PostHog funnel-event properties.

How we use information

• Provide, secure, maintain, and troubleshoot the website and public tools.
• Run a requested scan and make its sanitized report available.
• Respond to inquiries and perform an Engineer Scope Review.
• Prepare, send, and administer a scoped offer or engagement.
• Measure site use, improve funnels, and understand advertising performance.
• Prevent abuse, enforce these terms, and meet applicable legal obligations.

Service providers

We use Vercel for website hosting and request processing, Upstash for retained application records, Resend for transactional email delivery, PostHog for analytics, error capture, and session replay, and Meta for advertising and conversion measurement. These providers process information for the functions described above under their own service and privacy terms.

We may also disclose information when required by law, to protect users or the service, or as part of a business reorganization where appropriate safeguards apply. We do not sell personal information for money. Some laws may classify advertising measurement with Meta as “sharing” or targeted advertising; the tracking choice described above controls Engisols-initiated Meta events.

Retention

Production Check scan records, including sanitized reports, expire 90 days after creation. AI App Audit inquiries and Production Check lead records expire after 365 days. Engineer Scope Review records and scoped-offer records are also retained for up to 365 days; an offer itself is normally open for 30 days unless it says otherwise.

The Engisols Meta preference cookie lasts 180 days. Browser storage may keep a conversion-event identifier to avoid sending the same event twice. PostHog and Meta apply their own retention periods under Engisols account settings and their terms; those periods are not defined in this application code.

These application retention periods do not automatically delete transactional email copies held by Resend or message recipients. Provider, inbox, backup, and account-retention settings may apply separately.

We may delete data sooner when it is no longer needed, and may keep limited records longer where a signed contract, dispute, security investigation, or legal obligation requires it.

Security

We use access controls, bounded inputs, credential-pattern checks, sanitized persistence, expiring records, and provider security features intended to reduce risk. No internet service or storage system is completely secure, so we cannot guarantee absolute security.

If you believe sensitive information has been exposed through an Engisols service, contact us promptly and do not submit the information again through a general form.

Your data rights

Depending on where you live, you may have rights to ask for access, correction, deletion, restriction, portability, or information about how personal data is used, and to object to or opt out of certain processing. You may also withdraw a consent choice for future processing.

Email us using the address below. We may need to verify your identity and authority before acting. We will respond within the period required by applicable law and explain if an exception applies. You may also have the right to complain to your local data-protection authority.

International processing

Engisols and its service providers may process information in countries other than the one where you live. Privacy protections can differ between countries. Where applicable law requires it, we use contractual or other safeguards for those transfers.

Children

This website and its business services are not directed to children, and we do not knowingly collect personal information from children through these tools. If you believe a child has submitted information, contact us so we can review and remove it where appropriate.

Changes to this policy

We may update this policy as the website, tools, or providers change. We will publish the revised version here and change the “Last updated” date. Material changes may also be highlighted in the service where practical.

Contact

For privacy questions or requests, contact Engisols using the email link on this page. Engisols does not currently publish a separate privacy-office address or company registration identifier on this site.