Privacy notice

Who to contact

BriteThought runs britethought.com from Florida, United States. We deliver consulting remotely. To ask about information you’ve shared with us, use the privacy enquiry form.

When you visit or contact us

Our fonts and images are hosted with the website. We don’t use advertising trackers, analytics scripts or a newsletter signup. There is no customer upload portal. Namecheap hosts the site and may keep access and security logs, including IP addresses, requested pages and request times.

The contact form asks for your name, email address and the message you want to share. Customer enquiries also ask about the service, collection mode, timing and timezone. We use this information to reply, check whether we can help, discuss an engagement and keep necessary correspondence. Sending an enquiry does not sign you up for marketing. The form doesn’t accept attachments.

Your service finder answers

The finder asks you to choose answers about your situation. It doesn’t ask for your name, email address, server identity, passwords or diagnostic files. Your browser uses the answers to suggest a service. The suggestion isn’t an order or confirmation that the service fits your environment.

If you choose to discuss a suggestion, the finder can save your answers in this browser tab’s session storage so you can review them on the contact page. They stay there for the tab’s session. You can remove the summary before sending your enquiry. If your browser can’t save the answers, the link still selects the service.

The reviewed answers are sent to us only when you submit the protected contact form. We don’t send them to an analytics service or add you to a mailing list. Page and asset requests may still appear in the hosting logs.

Verification and essential cookies

The contact form uses self-hosted ALTCHA spam protection for the “Verify you’re human” check. Your browser does a short calculation and our server checks the result. BriteThought hosts the verification scripts and styles. We don’t send verification information or your enquiry to an external CAPTCHA provider. JavaScript and a secure browser connection are required. This helps limit automated submissions alongside our other spam controls.

The form uses an essential session cookie and an expiring, one-time form token to prevent forged submissions. The cookie lasts for the browser session and page scripts can’t read it. Form tokens and verification challenges expire after five minutes. The form can’t send until verification succeeds.

For spam protection, we store a keyed hash of your network address, a hash of the verification token and the time of the request. These records contain no enquiry messages and are stored outside the public website.

Who receives your message

Product and customer messages go to our customer enquiries mailbox. General, privacy and administrative messages go to our general contact mailbox. Namecheap hosts the website and handles incoming domain mail routing and filtering. Those hosting and email services process your requests and messages to deliver them.

We use your enquiry to respond and discuss your needs. We don’t sell it or use it for public examples or model training. Please keep passwords, query output, diagnostic packages, backups and sensitive business records out of the contact form and ordinary email.

How long we keep information

We keep enquiry correspondence as long as needed to respond, manage an agreed engagement or meet applicable recordkeeping obligations. Hosting logs and email backups may follow the providers’ own retention and backup schedules.

Spam-protection events older than one hour and verification-token hashes older than ten minutes are removed when a later request is processed. The host’s session cleanup removes expired server sessions. These technical records are separate from your enquiry.

Use the privacy enquiry form to ask about information you’ve shared, request a correction or deletion, or raise a concern. We may need to check your identity or retain records for an active engagement or applicable obligations. Please don’t include additional sensitive records with your request.

SQL Server diagnostic information

Use the contact form to discuss an assessment first. The website doesn’t take payments or diagnostic uploads. Before you share technical information, we’ll agree the scope, collection method, access and data-handling arrangements.

Diagnostic files can include server and database names, object and index definitions, file paths, job history, errors, query text and execution plans. Query text and plans can reveal values such as names or identifiers written into queries or passed as parameters, even when the collector doesn’t intentionally export application table rows. Diagnostic output can identify your environment and contain sensitive information. Review it before sending and remove credentials and unrelated information.

You review the information before submission. Managed collection uses named, temporary access with the minimum permissions needed, through your approved channel. Raw packages and temporary working files have a retention window of 30 calendar days after report delivery or cancellation. Final reports are available for 90 days. We confirm the applicable handling arrangements before collection; the website has no diagnostic upload portal.

For Recovery Proof, backup files and restored business data stay in your own controlled environment. Work uses agreed access to an isolated target. Don’t send database backups through this website or ordinary email.

Before collection, we’ll explain the applicable processing, retention and deletion arrangements, including any agreed extended retention, backup purge delays or legal holds. Order and accounting records are retained separately where required.

Customer diagnostic information is used to deliver the engagement. Selling it, using it for public examples or model training, or sending it to external AI services requires separate informed authorisation and suitable agreements. Any required data-processing agreement is addressed with the engagement.

When this notice changes

We’ll update this notice when our services or information-handling arrangements change. We’ll explain material changes to a paid engagement’s data handling before collection. Check the current notice and your agreed order before sharing diagnostic information.