# Privacy policy

Last updated: 22 October 2026

## Who we are

This website is run by [legal entity name] (“Arrowhead”, “we”), [registered address]. For anything about this policy or your personal data, write to [privacy contact email].

## What this website collects

What reaches us depends on how you get in touch. Every page visit also passes basic technical details to our hosting provider.

### When you use the contact form

The “Get in touch” form asks for your name and email address, and optionally your company and a message. When you press Send, the website checks the details and stores them in its database, together with the time you sent them. No email is sent.

Only members of our staff who have signed in and been approved as moderators or administrators can see stored submissions. They can mark a submission as handled, or delete it.

The form also contains a hidden field that people never see. Only automated spam programs fill it in, and when they do, the submission is discarded without being stored.

We keep submissions in the database for [retention period].

### When you email or call us

If you write to the email address or call the phone number shown on this website, the website is not involved. Your message reaches us directly, like any other business email or call.

### When you visit any page

Our hosting provider, Vercel, receives the technical details that every web request carries: your IP address, your browser’s user agent, the page you asked for and the time. Vercel uses them to deliver the page and keeps them in its logs for a limited period. If saving a contact form fails, the same logs record the error, so that we can fix it.

### When you use the staff area

The staff area is where our team reads contact-form submissions. Anyone can create an account there, but a new account sees only its own details until an administrator approves it.

An account holds your name, your email address and a hash of your password, never the password itself. When you sign up or sign in, the website records the session with your IP address and your browser’s user agent, and sets two session cookies that keep you signed in. To slow down password guessing, it also counts the requests each IP address makes to the sign-in service.

Administrators can see the name and email address of every account, and can approve it, change its role or delete it.

## What this website does not do

- It sets no cookies for visitors: the only cookies are the two session cookies set when someone signs in to the staff area.
- It uses no analytics, advertising or tracking tools.
- It loads nothing from other companies’ servers: pages, fonts and images all come from this website.
- It has no newsletter or payments, and no accounts outside the staff area.

## Who processes data for us

- Vercel: hosting and delivery of this website. [Hosting region to confirm.]
- Our database provider, [name to confirm]: storing contact-form submissions and staff-area accounts. [Database region to confirm.]
- Our inbox provider, [name to confirm]: storing the enquiry emails we receive and our replies.

## Why we use your data

[Purpose, legal basis and applicable law to confirm.]

## Your rights

Under [applicable law], you can ask us to show you, correct or delete the personal data we hold about you, or to stop using it, by writing to [privacy contact email]. You can also complain to the data-protection authority where you live.

## Changes to this policy

We update this page whenever the way this website handles personal data changes. The date at the top shows when it last changed.

Source: https://arrowhead-website-kappa.vercel.app/privacy