Website Privacy Policy & Data Protection Standard

1. Scope & Fundamental Privacy Posture

This Policy applies to information collected directly through our website (including both our primary origin at https://www.allenaisolutions.com and our diagnostic assessment subdomain at https://assessment.allenaisolutions.com) and associated public communications. We operate under a foundational Data Minimization and Zero-Data-Retention (ZDR) architecture. We do not solicit, sell, rent, broker, or retain sensitive personal information on this public web application.

All strategic consulting engagements, proprietary client data reviews, and bespoke software deployments are governed by separate, mutually executed Master Services Agreements (MSAs), Statements of Work (SOWs), and bilateral Non-Disclosure Agreements (NDAs) that enforce complete contractual data isolation.

2. Categories of Information Collected

We collect and process only the following strictly defined categories of technical and voluntarily submitted information:

• Contact & Discovery Inquiries: Basic business communication details (such as full name, business email address, company name, phone number, and narrative project description) voluntarily submitted through our contact form (contact.php) or guide download request (newsletter.php).
• Readiness Assessment Submissions: Operational category ratings, team sizing estimates, workflow automation interests, and contact information submitted via our interactive assessment intake (submit-assessment.php) or ingested securely from our diagnostic subdomain (assessment-webhook.php).
• Technical Server Access Metadata: Standard, automated web server operational records created by our hosting infrastructure, including client IP addresses, browser user-agent strings, referring URLs, HTTP protocol headers, and request timestamps required for network diagnostic security and DDoS mitigation. These records are separate from optional funnel measurement.
• Consent-Gated First-Party Funnel Measurement: After analytics consent, this site may increment aggregate counts for coarse milestone names such as assessment started or completed, detailed-assessment or implementation-review intent, guide requested, or consultation requested. The measurement request contains only the event name; it does not include names, email addresses, form contents, assessment answers, scores, URLs, cookies, or other identifiers.
• First-Party Real-User Performance Telemetry: In accordance with our Core Web Vitals observation charter, our pages collect non-identifiable, real-user performance metrics (record-perf-metric.php). This captures purely numerical timing values for page responsiveness and load latency (LCP, CLS, INP, TTFB) alongside sanitized URL paths. No IP addresses, persistent cookies, device fingerprints, or personal identifiers are collected or stored in performance aggregates.

3. Authorized Sub-Processors & Infrastructure Providers

We do not rely on third-party SaaS form aggregators (such as Formspree, Resend, or Supabase). Forms submit directly to self-hosted, origin-validated PHP handlers. Third-party operational service providers are restricted to the following:

4. Data Retention Schedules

We maintain defined data lifecycle limits to guarantee data minimization:

• Contact Inquiries & Diagnostic Assessments: Retained in secure email archives for the active duration of the business evaluation or client consulting engagement. Stale or non-converting operational inquiries are scheduled for permanent deletion within twelve (12) months.
• Hosting Server Access Logs: Diagnostic access logs maintained by Hostinger are rotated automatically and purged within standard operational diagnostic windows (typically 30 to 90 days).
• Aggregate First-Party Funnel Telemetry: Stored strictly as anonymized numerical counters (e.g. total assessments launched) containing zero personal identifiers or timestamps.
• Real-User Performance Telemetry: Daily aggregate timing distributions and percentile latencies stored in local JSON logs containing zero personal identifiers or individual request IPs, rotated and purged after 90 days.
• Client Engagement Artifacts: Governed by client SOW terms, with zero retention of client training corpora or proprietary prompts on public foundation models.

5. Consumer Privacy Rights (Texas DPSA & CCPA/CPRA)

Under the Texas Data Privacy and Security Act (TDPSA), the California Consumer Privacy Act (CCPA/CPRA), and applicable United States privacy statutes, consumers and prospective clients possess specific statutory rights regarding their personal data:

• Right to Know & Access: You may request confirmation of whether we process your personal data and obtain a copy of the specific categories of personal data collected.
• Right to Correct: You may request correction of inaccurate or outdated personal data.
• Right to Delete: You may request permanent deletion of personal data voluntarily provided through our website forms.
• Right to Opt-Out of Sale & Targeted Advertising: We do NOT sell personal data, exchange personal information for monetary or other valuable consideration, or engage in cross-context behavioral advertising.
• Right to Non-Discrimination: We will never discriminate against you, deny consulting services, or adjust pricing terms for exercising your statutory privacy rights.

To exercise any of these privacy rights, submit a verified request to our designated privacy contact at privacy@allenaisolutions.com or contact@allenaisolutions.com. Under Texas law, we respond to authenticated consumer requests within forty-five (45) days of receipt.

6. Technical & Organizational Security Measures

We deploy defense-in-depth technical and physical security controls to safeguard data integrity and confidentiality:

• Transport Layer Security: Enforced modern TLS 1.3 encryption across all website routes, backed by HTTP Strict Transport Security (HSTS: max-age=31536000; includeSubDomains; preload).
• Content Security Policy: Strict CSP Level 3 controls restricting script execution to authorized origins and preventing unauthorized cross-site scripting (XSS).
• Cookie Hardening: All session-related cookies enforce HttpOnly, Secure, and SameSite=Lax directives.
• Server-Side Protection: Bounded payload parsing, server-side CSRF validation, honeypot spam traps, and token-bucket rate limiting across all intake endpoints.

7. Children’s Privacy Protection

Our services and website are exclusively directed to commercial businesses, software engineering teams, and enterprise executives. We do not knowingly solicit or collect personal information from individuals under eighteen (18) years of age.

8. Governing Law & Operational Inquiries

This Policy shall be governed by, construed, and enforced in accordance with the laws of the State of Texas without regard to conflict of law principles. For questions, comments, or legal notices concerning this Policy, direct inquiries to: