Privacy & Data Security · Updated November 2026

Privacy Policy

Vancroft is committed to protecting your privacy, securing confidential codebases, and safeguarding enterprise data throughout our engineering engagements.

01 Introduction & Scope

This Privacy Policy outlines how Vancroft ("Vancroft," "we," "us," or "our") collects, processes, and protects information gathered when you visit vancroft.co, schedule an architectural diagnostic session, or partner with us for software engineering sprints.

We recognize that our clients entrust us with sensitive codebases, proprietary models, and commercial architectures. We treat data privacy as a core engineering invariant, not a compliance checkbox.

02 Strict Zero-Training Guarantee

Fundamental Guarantee: We never sell, monetize, or utilize client proprietary source code, internal schemas, private databases, or operational prompts to train or fine-tune public foundation models (such as OpenAI, Anthropic, or open-source community weights).

All fine-tuning, retrieval indexing, and evaluation benchmarks conducted during an active sprint are executed within isolated, dedicated client environments or via enterprise zero-data-retention API endpoints.

03 Information We Collect

We collect only the minimum information necessary to communicate effectively and deliver engineering solutions:

  • Inquiry & Contact Details: Name, professional email address, company name, and project description submitted via our contact forms.
  • Diagnostic Call Scheduling: Timezone, meeting availability, and brief technical context submitted through our Calendly booking integration.
  • Technical & Repository Access: When engaged under an SOW, temporary GitHub/GitLab credentials or cloud environment roles granted strictly to build and harden your system.
  • Telemetry & Server Logs: Standard HTTP request logs (IP address, user-agent string, page request timestamps) collected automatically to prevent DDoS attacks and maintain site uptime.

04 How We Use Information

Information collected is utilized exclusively for the following purposes:

  • Responding to technical inquiries and scheduling diagnostic calls within our 24-hour SLA.
  • Executing architecture audits, drafting Statements of Work, and fulfilling sprint deliverables.
  • Transmitting milestone updates, invoices, and post-sprint documentation.
  • Maintaining web security, mitigating bot traffic, and optimizing system performance.

05 Sub-processors & Infrastructure Providers

We collaborate with select, enterprise-grade infrastructure providers to deliver our web presence and communications:

  • Hosting & Edge Delivery: Vercel and Cloudflare (DDoS mitigation, edge caching, and SSL termination).
  • Email Transmission: Resend / transactional SMTP services for relaying inquiry notifications.
  • Meeting Scheduling: Calendly for calendar orchestration.

Each sub-processor is evaluated to confirm strict GDPR and SOC 2 Type II compliance safeguards.

06 Data Security & Encryption Standards

We deploy layered security defenses to safeguard client assets:

  • In-Transit Encryption: All web traffic and API communications are strictly encrypted using TLS 1.3 / modern HTTPS ciphers.
  • At-Rest Encryption: Any persistent diagnostic materials or schemas are stored with AES-256 encryption.
  • Principle of Least Privilege: Production environment access keys, tokens, and SSH credentials are managed via password managers, never committed to git, and rotated immediately upon project handoff.

07 Data Retention & Your Rights

We retain personal contact information only as long as necessary to serve your project needs and comply with statutory legal and accounting obligations.

Under applicable privacy regulations (including GDPR and CCPA), you have the right to:

  • Request a copy of the personal data we hold concerning you.
  • Request the correction of inaccurate or incomplete information.
  • Request the permanent erasure ("Right to Be Forgotten") of your personal data from our contact databases.
  • Withdraw consent at any time without affecting past lawful processing.

To exercise any of these rights, email us at [email protected] or [email protected]. We process verified requests within 30 days without fee.

08 Cookies & Tracking

Our website is engineered to be privacy-first. We do not use third-party cross-site advertising trackers, third-party pixel beacons, or invasive behavior surveillance cookies.

Only essential functional session cookies (required for navigation state, security headers, and reduced motion preferences) are stored in your browser.

09 Contact Us

For any questions or privacy inquiries, contact our data protection team: