Legal

Privacy Policy

Describes current site behaviour — not reviewed by counsel

Plain version: we use information you send through the inquiry form to reply to you. We also use Google Analytics 4 to understand how people use this site and whether they contact us. We do not sell inquiry details or add them to a marketing list.

This policy describes how the website currently behaves, which is accurate as written. It has not been reviewed by a lawyer and it is not a complete legal privacy policy. Have it reviewed before relying on it commercially.

What the inquiry form collects

Your name, your business name, your email address, your phone number, your current website if you have one, the type of business you run, what you need help with, the plan you are interested in if you pick one, your preferred contact method, and anything you write in the message box.

Choosing a plan on the form is an expression of interest only. Submitting the form is not a purchase, a contract, or authorization to bill you.

What it is used for

To reply to your inquiry and to discuss the work. That is the whole purpose. We do not sell it, rent it, or add you to a marketing list you did not ask for.

Who processes it

The website itself does not run a database and does not keep a copy of your submission. The form hands the message to an email delivery service, which sends it to us, and the website then discards it.

• Resend delivers the message on our behalf. Resend is an email delivery service. It transmits the message and keeps delivery records of its own, which is how a failed message can be traced.
• Our inbox. The message arrives at our business email address and is held there while we deal with your inquiry. That mailbox is hosted by Google Workspace.
• Cloudflare serves this website, so it processes every request — including your IP address, and the contents of the form as it is submitted — in the course of delivering pages and receiving the form.

These providers handle inquiry delivery. Google separately processes website usage data as described below. Your inquiry is used to reply to you.

Website analytics and third-party requests

This site loads Google Analytics 4 through Google's tag service. Google receives website usage data such as page views and interactions with contact buttons. We record a successful inquiry as an analytics event only after the form is delivered; we do not send your name, email, phone number, business name or message text as event parameters. Google may process device, browser and network information as part of providing analytics. The typefaces are served from this site rather than a font CDN. We do not load advertising scripts.

Cookies, and what your browser stores

Google Analytics may set or read cookies to measure site usage. Two additional small values are stored locally by your browser for site features:

• The plan you clicked. If you click a pricing button, the name of that plan is saved in your tab’s session storage so the inquiry form can preselect it. That stored copy stays in your browser and is cleared when you close the tab. That is not the same thing as the plan you submit: if you go on to send the form, your selected plan is part of the inquiry and reaches us with the rest of it. The storage is a convenience; the submission is data you chose to send.
• Whether you have seen the intro animation. A single flag, so the homepage animation does not replay on every page you open in the same session. It stays in your browser and is not sent to us.

You can limit cookies in your browser settings. Blocking analytics scripts or cookies may reduce the accuracy of our site measurements but does not prevent you from reading the site or contacting us.

How long it is kept, and how deletion works

The website stores nothing, so nothing is retained here. Retention applies to the copy that arrives at our end.

• Inquiries that do not become work. Kept for 12 months from the last contact, then deleted. If you never hear from us again, that is the clock that applies to you.
• Records of actual customers. A different thing, kept for longer. Once you become a customer, your details form part of the business, billing and service records we have to keep for tax and accounting purposes, and they are retained for as long as those obligations require rather than on the 12 months schedule above.

Deletion is something a person does, not something that happens by itself. We are not going to describe an automatic purge we have not built. When the period above is reached, or when you ask us to delete your inquiry, we remove it from the inbox it was delivered to. Where a copy still exists in Resend’s delivery records, we delete it there too if it is still within the window Resend retains it for; beyond that it ages out under Resend’s own retention policy rather than ours.

Ask us to delete your inquiry at any point and we will, without needing a reason. Email hello@tesseractnorth.com.

Customer websites we host

This policy covers tesseractnorth.com. Websites we build and host for customers are covered by their own policies, and any information collected through a customer’s site belongs to that customer.

Client reporting data (Google Analytics, Search Console)

With a client’s permission, Tesseract North staff can set up a read-only connection to the client’s Google Analytics 4 property or Search Console site. The Google account holder completes Google’s consent process; that account may belong to Tesseract North or the client, depending on the arrangement.

We store an encrypted authorization token and the reporting metrics retrieved through the connection. We use those metrics to show website performance in the client’s secure portal. We do not receive or store the Google account password, and the connection does not let us change the property or site.

We protect the Google connection’s refresh token by encrypting it before storage with AES-256-GCM. The encryption key is held separately as a Cloudflare Worker secret, not in the reporting database or the client’s browser. Short-lived Google access tokens are used only in server memory; we do not store them in the database or send them to the browser. Connections to Google and the portal use HTTPS. Staff access to connection setup and reporting is restricted by Cloudflare Access and a staff session. A client’s portal access is separately authorized, and its reporting queries are limited to that client’s records.

Cloudflare hosts the systems that store this information. The Google account holder can revoke the app’s access in their Google Account settings, and a client can ask Tesseract North to disconnect the integration in the staff system.

Disconnecting a Google connection removes its stored authorization token from our system and attempts to revoke it with Google. Metrics previously retrieved for reporting are not automatically deleted when a connection is disconnected. A client can contact us to request removal of those stored metrics, subject to any records we must retain for legal or accounting reasons.

Your choices

You can ask us what we hold about you, ask for it to be corrected, or ask for it to be deleted. Email hello@tesseractnorth.com or call (623) 252-9636.

Contact

Tesseract North, Surprise, Arizona. hello@tesseractnorth.com · (623) 252-9636