Privacy Policy

This policy explains how Phixe handles information from the public website, booking flow, and scoped engagements. It should be read together with trust and data handling, which covers access, testing rules, evidence handling, and what we will not do during an assessment.

What this policy covers

This policy covers:

• Public website visits to phixe.io.
• Booking and inquiry data submitted through the scheduler or contact path.
• Engagement administration data such as scope notes, business contact details, access coordination, and report delivery.
• Assessment evidence created during authorized work: request traces, test inputs, screenshots where needed, logs, finding notes, retest evidence, and remediation context.

Client contracts, NDAs, statements of work, and data processing agreements may add stricter rules. When they do, the signed agreement controls the engagement.

Website analytics

Phixe uses privacy-conscious analytics to understand how the site is found, which pages lead to booking interest, and whether technical content is useful. Analytics may collect page URL, referrer, UTM parameters, browser metadata, coarse location derived from network information, and interaction events such as viewing a guide, clicking a booking link, or scheduling a call.

The analytics loader respects Global Privacy Control, Do Not Track, and a local opt-out flag named phixe_analytics_opt_out. If any of those signals is present, PostHog, Google Analytics, and Meta Pixel do not load. Session recording is disabled. Person profiles are limited to identified use cases. The site may load Google Analytics only when the production environment is configured with a GA4 property, and may load Meta Pixel only when the production environment is configured with a Meta Pixel ID for paid-social measurement or retargeting. Both are behind the same privacy guard.

Inquiry and booking data

The short inquiry form on /book collects name, business email, optional company, the type and timing of the requested work, an optional short message, and the page from which the form was submitted. A consent record and submission time are stored with the inquiry. Phixe does not add the submitted name, email, company, or message to website analytics. Analytics receive only the selected work category, timeline, source page, and a confirmation that saving succeeded.

Inquiry records are stored as private objects in Vercel Blob. They are not available through a public object URL. Phixe uses the records only to review the request, reply, scope possible work, and maintain necessary business correspondence. Access to exports requires a separate server-side administrator secret.

The booking page can load a third-party scheduler, but it does not load the embedded scheduler until you choose to open it. If you open the scheduler here or in a new tab, the scheduler processes the information needed to schedule the call and may show its own privacy notice. The embedded scheduler is loaded with a no-referrer policy. Phixe uses booking information to prepare for the call, follow up, scope possible work, and keep records of business communication.

Do not submit secrets, credentials, regulated production data, or full customer datasets through the booking form. A short product description, deadline, and security-review context are enough for first contact.

Client and assessment data

For scoped work, we collect only what is needed to perform the engagement and produce useful evidence. That may include system diagrams, endpoint lists, tool inventories, prompts, test accounts, representative logs, request traces, screenshots, findings, fix notes, and retest results.

The default rules are:

• Use staging or isolated environments where possible.
• Use least-privilege, time-boxed credentials.
• Keep client code, prompts, logs, and datasets out of third-party AI tools unless written approval says otherwise.
• Capture enough evidence to reproduce a finding without collecting full datasets when a representative sample is enough.
• Keep reports and evidence bounded to the agreed scope.

Subprocessors and service providers

Phixe uses service providers for hosting, website analytics, scheduling, and normal business operations. The public site currently relies on Vercel for hosting and private inquiry storage, PostHog for analytics, Cal.com for scheduling, Google services only where configured for fonts, analytics, or the organizer’s connected calendar, and Meta only if a paid-social measurement pixel is configured.

Where an engagement requires additional tools, the statement of work names the tool class and the data it may touch. Client data does not move into a new tool category silently.

Retention

Website analytics are retained according to the analytics provider configuration. Inquiry records, booking data, and business correspondence are retained only as long as needed for follow-up, records, and legitimate business administration, and are periodically reviewed for deletion. You can request deletion using the contact path below.

Engagement evidence is retained according to the signed agreement. At the end of an engagement, credentials are revoked and working data is deleted or returned as agreed. The final report and necessary evidence may be retained where needed to support retest, audit trail, legal obligations, or the client’s buyer-facing security review.

Disclosure

Phixe does not publish client names, traces, screenshots, prompts, or commercial details without written permission. If testing identifies an issue that affects a third party, the responsible disclosure process described on trust and data handling applies.

Your choices and requests

You can use the short inquiry form without opening the embedded scheduler, or avoid the scheduler by not loading it on the booking page. You can also use Global Privacy Control, Do Not Track, or the analytics controls on this page to suppress analytics on future page loads. To ask for access, correction, deletion, or restriction of information associated with you, use the short inquiry form and identify the message as a privacy request.

If the information is held under a client agreement, the agreement may define who can authorize the request and how deletion, return, or retention works.

Changes

This policy may change as Phixe’s tooling or engagement model changes. The current version is dated July 13, 2026.