Summary of Our Practices
- Business Structure: TrustByte Solutions operates as a software development partnership based in Pakistan.
- No Account Registration: Browsing our website does not require registering an account or logging in.
- No Application Database: We do not operate a persistent user database on our web servers. Submissions are delivered directly as transactional emails to our team inbox.
- Inquiry Delivery Channel: Resend email delivery is our sole production notification channel. No external webhook is configured or active in production.
- No Data Monetization: We never sell, rent, or trade your contact information or project ideas.
1. Information We Collect
We collect information only when you voluntarily provide it through our website contact forms, or automatically as you navigate our public pages.
A. Information You Provide in the Contact Form
When you submit a project inquiry via our contact form at /contact, we collect:
- Full Name: Required to address you professionally in correspondence.
- Email Address: Required to respond directly to your technical inquiry.
- Phone / WhatsApp Number: Required to coordinate project discussions, technical consultations, or provide prompt updates.
- Company / Organization Name: Optional; provided to give context to your business requirements.
- Service Interest: Optional selection indicating your domain of interest (e.g., Custom Business Systems, Web & Mobile Applications, Applied AI & Computer Vision, or IoT & Embedded Systems).
- Project Timeline: Optional indicator of your scheduling constraints (e.g., immediate, 1–3 months, exploratory).
- Project Scope & Message: Detailed requirements and specifications you share regarding your planned project.
B. Automatically Collected Technical & Usage Information
When you load any page on our website:
- Client IP Address: Platform-provided client IP addresses are evaluated transiently by our edge hosting platform (Vercel) and rate limiting service (Upstash) to protect against automated abuse and request flooding. Rate limit counters operate within a 10-minute sliding window.
- Aggregate Interaction Data (Google Analytics): If enabled, Google Analytics 4 (GA4) collects aggregate, pseudonymous interaction data using browser cookies or device identifiers (e.g., page views, approximate geographic area at the city/region level, browser type, and interactions with buttons such as WhatsApp). Our codebase includes a client-side filter designed to prevent contact form fields (names, emails, phone numbers, and message bodies) from being attached to custom analytics events. However, we do not operate a cookie consent banner on this website; visitors who wish to prevent Google Analytics tracking can use browser settings or privacy extensions.
2. How We Use Your Information
We process the information collected through our website strictly for the following purposes:
- Responding to Inquiries & Scoping: Reviewing your project requirements, evaluating technical feasibility, preparing architectural proposals, and scheduling technical discovery discussions.
- Direct Business Communication: Corresponding directly with you by email or WhatsApp regarding requested milestones, technical deliverables, and business inquiries.
- Abuse & Spam Prevention: Enforcing automated rate limiting (3 submissions per 10 minutes per IP) and honeypot validation to protect our mail servers and inquiry inbox against malicious flooding.
- Site Reliability & Performance: Monitoring website uptime, diagnosing rendering bottlenecks, and measuring aggregate engagement to refine navigation.
3. Third-Party Service Providers & Infrastructure
We do not sell, rent, or trade your personal information. To operate a reliable and secure web application, we integrate with the following third-party infrastructure providers:
| Provider | Role & Activity | Data Shared |
|---|---|---|
| Resend Transactional Email Delivery | Dispatches inquiry notification emails to our team inbox (`trustbytesolutions@gmail.com`). Defaults in code to Resend's sandbox sender (`onboarding@resend.dev`) unless a custom domain sender is configured. We do not represent that a custom sending domain is verified in production. | Submitted inquiry fields (name, email, phone, organization, service, timeline, message) and generated inquiry reference ID. |
| Google (Gmail) Inquiry Inbox Storage | Receives and stores inquiry notification emails sent to `trustbytesolutions@gmail.com` for our engineering team to review and reply. | Inquiry email contents and subsequent correspondence. Handled under Google's standard terms and privacy policies. |
| Upstash Serverless Redis | Enforces distributed rate limiting on `POST /api/contact` to prevent abuse. | Client IP address (stored transiently as a rate-limit key evaluated within a 10-minute sliding window; no inquiry text or personal details are shared with Upstash). |
| Vercel Edge Cloud Hosting | Hosts the Next.js App Router application, manages HTTPS/TLS in-transit encryption, and executes serverless API routes. | Standard HTTP request metadata (IP address, user-agent, request path, HTTP headers). Standard platform-level access logs may be collected by Vercel under its infrastructure privacy practices. |
| Google Analytics Measurement (GA4) | Measures aggregate website traffic, page visits, and conversion button clicks. | Pseudonymized device tokens, cookie identifiers, and aggregate navigation events. Our client-side code excludes contact form text fields from custom events, but standard browser-level identifiers are handled under Google's policies. |
Secondary Webhook Code Notice: The contact API source code includes an optional webhook integration (`CONTACT_WEBHOOK_URL`) capable of forwarding inquiry payloads to an external messaging service (such as Slack or Discord). The business owner has confirmed that no external webhook is configured or used in production; customer inquiries are handled solely via Resend email delivery.
4. Data Storage, Retention & Logging
We believe in a minimal data footprint. Here is exactly how and where data resides:
- No Application Database: This website does not connect to or maintain an application database (such as PostgreSQL, MySQL, MongoDB, or Firestore). Inquiries submitted through `/contact` are not stored in any database operated by TrustByte Solutions on our web servers.
- Inquiry Email Retention: Submitted inquiries are stored as received emails within our authorized inbox (`trustbytesolutions@gmail.com`). We retain inquiry correspondence only as long as reasonably necessary for business purposes—including responding to questions, evaluating project specifications, managing client relationships, and fulfilling applicable legal, administrative, or accounting obligations. No fixed retention schedule or deletion deadline has been adopted.
- Application Logging vs. Platform Logs: Our application code logs only the unique tracking reference ID (e.g., `TB-XXXXX`) and delivery status when an inquiry is processed. Application logs do not record client names, email addresses, phone numbers, or inquiry message text. However, standard web access logs (which may record connecting IP addresses, user-agent strings, and request timestamps) may be generated and maintained by our hosting provider (Vercel) according to their platform operations.
- Transient Rate Limiting Cache: IP rate limiting records stored in Upstash Redis consist solely of client IP identifiers and request counts evaluated within a 10-minute sliding window. They do not store contact details or form submissions.
- Third-Party Provider Storage: Data processed by third-party services (such as Resend for email transmission, Google for Gmail and GA4, and Vercel for hosting) is subject to the retention, backup, and deletion lifecycles of those respective providers.
5. Data Security
We apply standard engineering practices to protect information during transit and processing:
- Encryption in Transit (HTTPS/TLS): All communication between your browser and our website is served over HTTPS using Transport Layer Security (TLS).
- Input Sanitization & Header Protection: Form inputs undergo server-side validation and sanitization, including the removal of carriage returns and line feeds (CRLF) to defend against RFC 5322 email header injection and malicious formatting.
- Abuse & Flooding Defenses: Distributed rate limiting and honeypot form fields are deployed to prevent automated flooding of our mail delivery pipeline.
- Server-Side Secret Management: Third-party credentials (such as Resend and Upstash API keys) are restricted to server-side environment variables and are never exposed in client JavaScript bundles.
Please note that no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security or provide specific compliance certifications. Prospective clients are advised not to submit highly confidential trade secrets or credentials via the public contact form prior to entering into a mutual Non-Disclosure Agreement (NDA).
6. Your Rights & Inquiries
Visitors and prospective clients may contact us regarding the information they have submitted:
- Access & Correction: You may email us to ask what correspondence we have on file for you or request corrections to your contact details.
- Deletion Requests: You may request that we delete your inquiry correspondence from our active email inbox. We will review and honor deletion requests subject to legitimate business needs, ongoing contractual obligations, or applicable legal and regulatory requirements.
- Third-Party Systems Limitation: While we can delete correspondence from our active email inbox, we do not control and cannot guarantee the immediate or complete erasure of data from third-party server logs, external provider backups, or transit records maintained by service providers (such as Resend, Google, or Vercel) under their own operational policies.
- Analytics Opt-Out: You may adjust your browser settings or install privacy/ad-blocking extensions to prevent Google Analytics from setting cookies or tracking your visits.
7. Business Identity & Privacy Contact
If you have any questions regarding this Privacy Policy, wish to exercise your data choices, or want your inquiry correspondence reviewed, please contact our team directly:
Business Identity: TrustByte Solutions operates as a business partnership based in Pakistan, providing software engineering and technology consulting services to clients locally and internationally.
Note on Registration: TrustByte Solutions operates as an unregistered general partnership. No formal commercial registration number, National Tax Number (NTN), or dedicated physical corporate office address is published or claimed on this website. Inquiries regarding business identity or governance may be directed to our primary contact channels above.
8. Updates to this Policy
We may update this Privacy Policy periodically to reflect architectural changes in our website, service offerings, or operational requirements. Any revisions will be published directly on this page with an updated effective date.