Privacy Policy

This policy explains what Rescue Engineers ("we," "us," "our") collects when you visit rescueengineers.ai or contact us through it, why, and what rights you have over that information. Rescue Engineers is a senior engineering firm that helps founders and companies assess, harden, finish, take over, and scale AI-built applications.

• 1. What we collect
• 2. Why we collect it, and our lawful basis
• 3. Who else sees it
• 4. Our use of AI
• 5. Cookies and local storage
• 6. How long we keep it
• 7. Your rights (GDPR, UK GDPR, CCPA/CPRA)
• 8. International transfers
• 9. Children's data
• 10. Security
• 11. Changes to this policy
• 12. Contact

1. What we collect

We collect information in two ways: what you give us directly, and what your browser sends automatically.

Information you give us

• Contact form (/contact/): name, email address, phone number (optional, only meaningful if you opt in to text messages, see below), company or app URL, what you're building, which AI tool built it, your stage and budget range if you choose to share them, a free-text description of what's wrong or what you need, and an urgency selection.
• Short contact form (on /contact/, on the homepage, on /rescue/ and /rescue/lovable/, and in the pop-up that the "Get a reply within one business day" button opens): your email address and a free-text description of what's wrong or what you need, both required, plus a link to your app or code repository if you choose to give one.
• SMS consent (on the contact form): a separate checkbox, unchecked by default, lets you opt in to text messages about your inquiry. We only text you if you check it, and it is never required to submit the form. If you check it, we record that you agreed, the exact wording you saw when you agreed, and the time you agreed, so there's a real record of what you consented to. You can opt out at any time by replying STOP to any text we send, or simply by never checking the box.
• Supabase exposure check (/tools/supabase-check/): the Supabase project URL and the anon (publishable) key you paste in, plus your confirmation that you own or are authorised to test that project, and, optionally, a list of table names you want tested. We use them for one thing: sending read-only requests to that project while you wait, so we can tell you which of its tables an anonymous visitor can read. When your project will not share its own table list, we test the names you pasted plus a built-in list of names commonly used by AI app builders; any name you paste that is not a valid table name is discarded in memory and never sent, stored, logged, or shown back to you. We do not store any of it. The key, the URL, the project reference, the table names and the results are held in memory for the few seconds the check takes and are then gone. None of them is written to a database or a file, and none of them appears in our logs. To rate limit the tool we keep one thing: a counter keyed on a salted one-way hash of your IP address and of the project reference, never the values themselves, which expires within an hour. That counter is held in our server's memory or in a rate-limit store Upstash runs for us (see Section 3). The secret salt never leaves our server, so the store cannot turn a hash back into your IP address or your project. We never read any of your records: the check asks your database whether a table is readable and how many rows it would return, never for the rows themselves. If you paste a privileged key by mistake (a service_role key, an sb_secret_ key, or a database connection string), the page refuses it in your browser and it is never sent to us at all. Our server does make the requests to your project, so our IP address, and a user agent naming this tool, will appear in your own project's logs.
• Newsletter sign-up (on select blog posts): email address only.
• Direct email: anything you send to hello@rescueengineers.ai, including any files or code excerpts you choose to share.

Information collected automatically

• Server / access logs, generated by our hosting provider (Vercel) for every request: IP address, browser and device type, referring page, pages requested, and timestamps. This is standard web-server logging, not a tracking script we add.
• Delivery-failure records: if Resend (see Section 3) fails to deliver your contact-form submission to us, we record that a submission failed and how urgent you marked it, so we know to go check for it and reply by hand. That record holds no personal details, name, email, phone, or message content are never written to it. This only ever happens when a delivery attempt fails, never on a successful one.
• Page-performance measurements, via Vercel Speed Insights: how fast each page loaded (Core Web Vitals), the page address, your network speed class (for example 4g), browser, device type and operating system, and your country. Vercel states these data points are not tied to any individual visitor or IP address. It sets no cookie; see Section 5. We do not run Vercel Web Analytics.
• Google Analytics 4, as Section 5 describes. Outside the EEA, the UK and Switzerland, and unless your browser sends Global Privacy Control, it is on from your first page view by default until you decline. Inside those regions, or with GPC, it stays off until you accept. When it is on, it collects page views, referring page, an approximate location derived from your IP address (Google truncates/does not store the full IP address against your visit), device and browser type, how long you spend on a page and roughly how you move between pages, and form events that carry no personal information: one when you open or start one of the short contact forms, and one when any contact form is sent successfully. Google Analytics may also record on its own that a form was started or submitted. Each says only which form it was (for example the homepage form, the pop-up, or the contact page) and where it was opened from. It never receives your name, email, phone number, link, or the content of anything you type into a form.

We do not run any advertising pixel (Meta, TikTok, or otherwise) on this site. Google Analytics 4 is the only analytics tool here that uses cookies, and it only runs the way Section 5 describes.

2. Why we collect it, and our lawful basis

• To respond to you · contact form and email submissions are used solely to evaluate and reply to your inquiry. Lawful basis: legitimate interest in operating our business, and steps taken at your request prior to a possible contract (GDPR Art. 6(1)(b)/(f)).
• To send the newsletter · if you sign up, your email is used only to send the content you asked for. Lawful basis: consent (GDPR Art. 6(1)(a)); every email carries an unsubscribe link.
• To text you about your inquiry · only if you separately check the SMS consent checkbox on the contact form. Lawful basis: your explicit consent (GDPR Art. 6(1)(a)). Message and data rates may apply, message frequency varies, and you can reply STOP to any message to opt out at any time, or HELP for help.
• Server logs · kept for security, abuse prevention, and diagnosing technical issues. Lawful basis: legitimate interest (GDPR Art. 6(1)(f)).
• Google Analytics 4 · to understand which pages are useful and where visitors come from, so we can improve the site. Lawful basis: your consent (GDPR Art. 6(1)(a)), given or declined through the cookie banner described in Section 5; outside the EEA, UK and Switzerland we rely on your ability to decline the same way. We honor Global Privacy Control as a decline. No advertising cookies are set, since we don't run ads yet.

3. Who else sees it

We do not sell or rent your information, ever. We use the following subprocessors to run this site and business:

• Vercel Inc. · hosts this website, processes the standard server/access logs described above, and runs Vercel Speed Insights, its cookieless page-performance measurement described in Section 1. We do not use Vercel Web Analytics.
• Our own contact-form endpoint · when you submit either contact form (the full one or the short one) or a newsletter sign-up, it goes to a function we built and operate ourselves, hosted on Vercel at rescueengineers.ai/api/contact/, not to a third-party form host. That function validates the submission and blocks obvious spam before handing it to an email-delivery processor to actually deliver it to our inbox.
• Resend, Inc. · turns each contact-form or newsletter submission into an email and delivers it to our Google Workspace mailbox (next item). Resend only ever receives what you type into the form; it does not run any script on rescueengineers.ai itself. Resend keeps its own copy of every email it sends, including what you typed, for as long as its own data-retention policy sets; deleting the email from our mailbox does not delete Resend's copy. If we switch to a different delivery processor, this line is the one we update.
• Google LLC (Google Workspace) · contact-form submissions are delivered to, and read in, a Google Workspace mailbox held by the owner of Rescue Engineers on a business domain he also uses for other work, not on rescueengineers.ai.
• Cloudflare, Inc. · receives email sent to hello@rescueengineers.ai (Cloudflare Email Routing) and forwards it to the mailbox we read. Cloudflare Email Routing forwards mail; it does not keep a mailbox of its own.
• Upstash, Inc. · provides the rate-limit store for the Supabase exposure check, through Vercel's marketplace (until we switch it on, those counters live only in our server's memory). It only ever holds the salted one-way hashes and timestamps described in Section 1, which expire within an hour. It never receives your IP address, your project reference, your key, or anything about your project.
• Google LLC (Google Analytics 4) · runs on this site the way Section 5 describes: on by default outside the EEA, the UK and Switzerland unless you decline or your browser sends Global Privacy Control, and off until you accept inside those regions or with GPC. Google's own privacy policy governs how it handles that data: policies.google.com/privacy.
• AI tools · see Section 4 below.

We may also disclose information if required by law, subpoena, or to protect the rights, property, or safety of Rescue Engineers, our clients, or others.

4. Our use of AI

Rescue Engineers uses AI tools, including Anthropic's Claude, as part of how we run this business: drafting and researching content, reviewing and writing code, and helping triage and draft replies to inbound inquiries.

• What AI touches your data: if you submit a contact-form message or email us, the content of that message may be reviewed with the assistance of an AI tool to help us understand and draft a response. No fully automated system decides whether to take you on as a client, prices your engagement, or replies to you without a human reading it first.
• Model training: our AI vendors' standard commercial terms state that content submitted through their business/API products is not used to train their underlying models by default, and we have not opted into any different arrangement.
• Opting out / reaching a human: if you'd prefer your inquiry not be processed with any AI assistance, say so in your message or email hello@rescueengineers.ai and a person will handle it manually.
• This site's content: some of the content, code, and design on rescueengineers.ai was produced with AI-assisted tools, including Anthropic's Claude. Our blog drafting tool uses Claude to write first drafts of blog posts, and every draft goes through automated checks. Posts on security and app-rescue topics publish automatically once they pass those checks and a separate automated review, also run with Claude. No person reviews or approves them before they go live, and each one says on the page: "Drafted with AI assistance and checked by automated quality and compliance review before publishing." Comparison posts are never published automatically, and neither is any draft that fails a check, that was not written by that drafting tool, or that our checks flag as touching healthcare, naming another company, stating legal duties, or describing our own services, prices or process: those wait until a person reads and approves them, and say on the page that a person reviewed and approved them. One post published before our human review step began says so on the page, and says whether a person has reviewed it since. Other pages are written and edited by us with the help of AI tools.

5. Cookies and local storage

This site uses Vercel Speed Insights to measure how fast pages load. It is cookieless: it sets no cookie and, according to Vercel, records each measurement without tying it to an individual visitor or IP address, so it cannot follow you from page to page or across other websites. It does not need a cookie-consent banner on its own.

Google Analytics 4 is different: it sets cookies. A compact banner at the bottom of the page lets you Accept or Decline it, and the "Privacy choices" link in the footer of every page reopens that banner at any time. We use Google's Consent Mode v2, and what happens depends on where you are and what your browser tells us:

• Outside the EEA, the UK and Switzerland, without Global Privacy Control: Google Analytics is on from your first page view by default, before you touch the banner. It sets its cookies (_ga and _ga_*) and measures your visit until you decline. You can decline at any time, in the banner or through the footer "Privacy choices" link.
• Inside the EEA, the UK or Switzerland: Google Analytics is off until you click Accept. We rely on Google's own region detection for this (the region setting in Consent Mode); we do no location lookup of our own. While it is off, Consent Mode still sends Google cookieless pings, before you make a choice and after you decline: a signal that a page was viewed, or that one of the form events described in Section 1 happened, with no cookie and no identifier stored in your browser.
• With Global Privacy Control: if your browser sends a GPC signal, Google Analytics is off wherever you are, and stays off unless you click Accept. The same cookieless pings apply while it is off.
• When you click Decline: we switch Google Analytics to denied straight away, delete its _ga and _ga_* cookies from your browser for this site, and remember the choice. On every later page your choice is applied before Google Analytics starts, so it sets no cookie and sends no identified measurement. Google can still receive the cookieless pings described above. Declining does not delete what Google Analytics already measured before you declined.
• When you click Accept: Google Analytics sets its own cookies (_ga and _ga_*) to distinguish you from other visitors across a session and future visits.

Your choice is stored in your browser's local storage, not a cookie, so we can remember it on your next visit without needing a tracking cookie just to remember you declined tracking. You can change your mind at any time with the footer's "Privacy choices" link. Clearing your browser's site data, or visiting in a different browser or private window, resets the choice and the banner will ask again.

You can also opt out of Google Analytics across every site that uses it, independent of this banner, with Google's own browser add-on: tools.google.com/dlpage/gaoptout.

Beyond Vercel Speed Insights and Google Analytics 4, this site sets no other tracking cookies and runs no advertising or social-media tracking technology (no ad pixel, no cross-site retargeting). If that changes, this section is updated before the change goes live, not after.

6. How long we keep it

Inquiries that do not become a client engagement (contact-form submissions and emails) are deleted from our mailbox 24 months after our last exchange with you, or sooner if you ask. Client records are kept for the length of the engagement and then for as long as tax and contract law require us to keep business records. If you opted in to text messages, we keep the consent record (the exact wording you agreed to and when) for as long as we keep the inquiry or client record it belongs to, since it's our record of that permission. Resend's own copy of each delivered email follows Resend's retention policy, not ours (Section 3). Newsletter email addresses are kept until you unsubscribe or ask us to delete them. Nothing you submit to the Supabase exposure check is retained: your key, URL, project reference, table names and results are never written to a database or a file. The only thing kept is the rate-limit counter described in Section 1, which holds salted one-way hashes rather than your IP address or project reference and expires on its own within an hour, so there is nothing in it that identifies you to hand over or delete. Server logs are retained by our hosting provider on its standard rolling schedule for security and abuse-prevention purposes. A delivery-failure record, described in Section 1, ages out on that same rolling schedule and contains no personal information, so there is nothing about you in it to delete or erase.

Google Analytics data is retained according to the data-retention setting of our Google Analytics property; email hello@rescueengineers.ai if you'd like the current setting. That includes anything measured before you declined: declining stops measurement from that point on, it does not erase what was already collected. To ask for it to be removed, make a request under Section 7.

We are a small, single-operator business without an automated data-deletion pipeline today; deletion requests are handled by hand. See Section 7 for how to make one.

7. Your rights (GDPR, UK GDPR, CCPA/CPRA)

Depending on where you live, you may have the right to:

• Know what personal information we hold about you and where it came from;
• Access a copy of it;
• Correct inaccurate information;
• Delete it ("right to erasure" / "right to delete");
• Restrict or object to certain processing;
• Receive it in a portable format;
• Not be discriminated against for exercising any of these rights.

We do not sell or share personal information for cross-context behavioral advertising, so there is no "opt out of sale/sharing" link to provide.

To exercise any of these rights, email hello@rescueengineers.ai with the subject line "Privacy Request." We will verify your identity as best we can for a small business (typically by replying to the email address on file) and respond within 30 days. EU/UK residents also have the right to lodge a complaint with their local data protection authority.

8. International transfers

Rescue Engineers operates from the United States, and our hosting and processing subprocessors (Vercel, Resend, Google, Cloudflare, Upstash and Anthropic) may process data in the United States or other countries. If you are located outside the US, your information may be transferred to and processed in a country with different data-protection laws than your own.

9. Children's data

This site and our services are directed at businesses and professional founders, not children. We do not knowingly collect personal information from anyone under 13 (or under 16 in the EU/UK). If you believe a child has given us information, email us and we will delete it.

10. Security

This site is served entirely over HTTPS with HSTS enforced, and sends standard hardening headers (content-type sniffing protection, clickjacking protection, a strict referrer policy, and a locked-down permissions policy) on every response. We never collect payment card information on this site. Any paid engagement is invoiced and paid through a separate, PCI-compliant payment processor, not through this website. No system is perfectly secure, but we do not store information beyond what's described above, and we keep the surface area small on purpose.

11. Changes to this policy

If we materially change what we collect, why, or who we share it with, we'll update the "Last updated" date at the top of this page and, for anyone on our newsletter, note the change in an email. We encourage checking back periodically.

12. Contact

Questions about this policy or a privacy request: hello@rescueengineers.ai.