Privacy Policy

• The build-request form (/create) — your name, email, phone if you enter one, and the project details you fill in: goal, industry, current tools, budget band, timeline, website.
• The AI interview (/start) — the same contact details plus the full text of the conversation you have with it, which is sent to us with your enquiry so we can read what you asked for.
• Email — anything you choose to put in a message to pavneets956@gmail.com.

We use it to reply to you, to scope and quote the work, and to deliver and support what you ask us to build. Nothing else.

Several parts of this site are powered by a language model from OpenAI, a company in the United States. When you type into any of them, the text you type is sent to OpenAI so it can generate a reply. This applies to:

• the AI Worker Showroom demo at /demo;
• the AI interview at /start, including the spoken audio, which is generated by sending the reply text to OpenAI's text-to-speech service;
• the solution finder and the product demos on the shop pages.

One thing worth calling out. The showroom demo asks the model to pull a name, phone number, email, service and location out of whatever you type, because that is what a real receptionist would capture — that is the thing being demonstrated. So if you type a real phone number into the demo, a real phone number is what gets sent to OpenAI and shown back to you on screen. It is a demonstration: it never places a call, sends a text, sends an email, or books anything, and the details it extracts are not saved to our database unless you separately submit the contact form.

We do not use anything you type to train a model. OpenAI states in its API data policy that content sent through its API is not used to train its models; their terms govern that, not ours. Demo conversations are held in your browser for the length of the session and are not stored on our side.

The calculators under /tools run entirely in your browser. The numbers you enter — your rates, your costs, your revenue — are never sent to us or to anyone else. The only thing recorded is an anonymous count that a tool was used, which tells us the tool is worth keeping. Your figures are not part of that count.

We use Vercel Web Analytics. It is cookieless and does not follow you across other websites, which is why this site shows no cookie-consent banner. It records aggregate traffic: which pages were viewed, the country, the coarse device type, and the site that referred you.

On top of that we record a small number of named events so we can see which parts of the site work: a tool being used, a call-to-action being clicked, a form being started or submitted. Each event carries only machine tags — a page path, a button identifier, a package name, a budget band. No event ever carries a name, an email address, a phone number, or anything you typed in free text.

On your first page view we store a small record in your browser's sessionStorage under the key hb_attr_v1. It holds only how you arrived: campaign tags from the link you clicked (utm_*, gclid), the hostname of the site that referred you, the path of the page you landed on, a coarse device class, and the date. It contains no personal information and no part of any URL query you typed. It is not a cookie, it is never read by anyone else, and your browser deletes it when you close the tab.

If you submit the contact form, that record is attached to your enquiry so we know which page or campaign brought you in.

This site sets no advertising, marketing, or cross-site tracking cookies. The only cookies that can be set are the session cookies from Google sign-in, and only if you actually sign in. Sign-in exists for a limited, non-public area of the site; almost every visitor never touches it. If you do sign in, Google confirms your identity to us and we store the email address, name and profile image Google returns, so the session works.

Our host, Vercel, records standard request logs — IP address, browser type, the URL requested — for security and reliability, as every web host does.

When you submit the contact form we also write one line to those logs so we can tell a healthy submission from a broken one. That line deliberately carries only coarse facts: which form it came from, whether a phone number was present, how many characters long the goal was, and a one-way hash of the IP address used for abuse limits. Your name, email, phone number and the text of your enquiry are not written to the logs.

• Vercel — hosting, the functions that run this site, request logs, and analytics.
• Neon — the PostgreSQL database where a submitted enquiry is stored so it cannot be lost if the email fails.
• Resend — delivers the notification email that tells us an enquiry has arrived. That email goes to us, not to a mailing list. If it fails to send, the attempt is recorded against your stored enquiry and retried automatically until it succeeds, so a delivery problem on our side never means your message goes unread. We do not send you an email; we reply to yours.
• OpenAI — receives the text you type into an AI feature, as described above.
• Google — only if you use Google sign-in.
• Stripe — payment code exists in this project but no payment is taken through this website today. There is no reachable checkout. If that changes, this policy changes in the same release.

These providers are based in the United States, so information you send through this site is processed outside Canada. We share only what each one needs to do its job. We do not sell your information, we do not trade it, and we never show one client's project details to another. We would disclose information if the law required it.

• Enquiries — kept in the database until you ask us to delete them, or until they are no longer needed for our business and tax records. There is no automatic deletion schedule today; ask and we will remove yours.
• Server logs — kept by Vercel for the retention window of our hosting plan, which is short and set by them, not by us.
• Analytics — aggregate only, retained by Vercel; there is no record tied to you to delete.
• The browser record — deleted by your browser when you close the tab.
• Text sent to AI providers — held under those providers' own data policies.

You can ask for a copy of what we hold about you, ask us to correct it, or ask us to delete it. Email pavneets956@gmail.com from the address you contacted us with, or tell us which address to look for. We will confirm when it is done, normally within a few days and always within 30 days.

We do not send marketing email. If we ever do, it will be because you asked for it and every message will carry an unsubscribe link.

Under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) you may also complain to the Office of the Privacy Commissioner of Canada if you are not satisfied with how we handle a request. We would rather you told us first.

This site is for businesses. It is not directed at children and we do not knowingly collect information from anyone under 13. If you believe a child has sent us information, email us and we will delete it.

When the site starts using a new service that receives your information, this page is updated in the same release and the date at the top changes. The date above is the date it was last checked against the code.

Handbuilt AI is operated by Pavneet Singh in Surrey, BC, Canada. Questions about this policy, or a request about your information, go to pavneets956@gmail.com.