PRIVACY NOTICE
Business enquiry data, without marketing reuse.
This notice covers information sent through the Sought enquiry form and correspondence that follows.
Controller and purpose
The controller is Yan Dobromyslov in Portugal. Sought uses the information you volunteer to answer a business enquiry, assess fit and scope, and preserve the correspondence needed to do that. The lawful basis is legitimate interests.
Enquiry data is not reused for marketing.
What is collected
The form asks for your name, work email, the problem you want to discuss and, optionally, a website. Cloudflare Turnstile processes network, browser and request signals to distinguish people from automated abuse. Sought does not store the Turnstile token in the enquiry record or technical event log.
Do not submit passwords, payment details, or special-category personal information.
Processors and data flow
- Supabase
Hosts the form function and stores the submitted form record and technical consult-event metadata. The project database is in Ireland.
- Cloudflare
Serves the site, runs Turnstile and forwards direct email through Email Routing. Cloudflare acts as Sought's processor when protecting the form and as a separate controller when it uses Turnstile signals to improve that service.
- Resend
Sends Sought's Google mailbox a notification containing the site, form source, record ID and submission time, but not the form answers.
- Google
Receives that minimal notification and hosts the mailbox used for replies and privacy requests. Direct email to [email protected] is forwarded to that mailbox through Cloudflare Email Routing.
International processing
The database is stored in Ireland, but these providers and their subprocessors may process information outside the European Economic Area. For restricted transfers, Supabase's, Cloudflare's and Resend's terms incorporate the European Commission's standard contractual clauses. Cloudflare and Resend also identify the EU–US Data Privacy Framework for eligible US transfers; Google identifies adequacy decisions, including that framework, and standard contractual clauses where required. Write to [email protected] for information about, or a copy of, the safeguard applicable to a particular transfer.
Retention
The form record is retained for 12 months from submission. Technical consult-event metadata is retained for 30 days.
Resend states that email data and production backups are retained for 30 days.
Google receives the minimal operator notification when the form is submitted and stores that notification and any later correspondence without a fixed automatic mailbox-deletion period.
Deleted form records and technical consult-event metadata can remain temporarily in local periodic disaster-recovery backups until rotation. These copies are not used for ordinary operations.
Your choices and rights
You may ask for access, correction, erasure, restriction or portability where applicable, and you may object to processing based on legitimate interests. Send the request to [email protected]. Enough information may be needed to identify the relevant record without collecting unrelated data.
You may also complain to Portugal's supervisory authority, the Comissão Nacional de Proteção de Dados.
Changes
This notice will be updated when the form, processors, purposes or retention practices materially change.
Last updated: 16 August 2026