This policy is a starting point drafted for a services business. It is not legal advice, and it does not by itself make you compliant with GDPR, CCPA, or any other regime. Have a qualified lawyer review and adapt it before relying on it.
Who we are
Invarworks LLC operates invarworks.com and provides software development and operations services. For personal data you send us through this website, we are the data controller. For personal data we process inside systems we build or operate for a client, that client is the controller and we act as their processor under a separate data processing agreement.
Contact for any privacy question: hello@invarworks.com
What we collect from this website
What you send us. If you use the contact form or email us, we receive your name, email address, and whatever you write. We use it to answer you and to evaluate whether we can help.
Basic technical data. Our hosting provider logs IP addresses and request metadata for security and reliability. We do not run advertising trackers, and we do not sell or share personal data with data brokers.
Why we are allowed to process it
For enquiries, our legal basis is legitimate interest in responding to people who contact us about our services, and steps taken at your request before entering a contract. For client engagements, our basis is performance of the contract we have with you. Where we rely on consent, you can withdraw it at any time.
Client data during an engagement
Building and operating software often means access to client systems and, sometimes, to personal data inside them. Our standing practices:
- We ask for the narrowest access that lets us do the work, and we prefer redacted or synthetic data for development and evaluation wherever it is workable.
- Credentials live in a password manager or your secret store, never in source code, tickets, or chat.
- Production data is not copied to local machines unless the statement of work says so and the DPA permits it.
- Where we operate systems on your behalf, model providers, hosting, and other subprocessors are named in the DPA before we use them.
Model providers
Where an engagement sends data to a model provider, that runs through your own provider account under your commercial terms wherever possible. We will tell you which providers a design depends on and what data reaches them before we build it, so the decision is yours and reversible.
How long we keep things
Enquiries that do not become engagements are deleted within twenty-four months. Contracts, invoices, and records we must keep for tax and accounting are retained for the period the law requires. Client project data is deleted or returned per the statement of work, and by default within ninety days of the engagement ending.
Who else sees your data
We use third-party providers for hosting, email, and accounting, and they process data only on our instructions. We do not sell personal data. We may disclose data where the law requires it, and we will tell you unless we are legally prohibited from doing so.
International transfers
We work with clients in the United States, Europe, and Asia-Pacific, so data may be transferred across borders. Where personal data leaves the European Economic Area or the United Kingdom, we rely on Standard Contractual Clauses or another approved transfer mechanism, documented in the DPA.
Your rights
Depending on where you live, you may have the right to access, correct, delete, port, or restrict processing of your personal data, and to object to it. Email hello@invarworks.com and we will respond within thirty days.
If the data sits inside a system we run for a client, we will forward your request to that client, who is the controller, and support them in answering it.
You also have the right to complain to your local data protection authority.
Security
We use encryption in transit, multi-factor authentication on every account that supports it, least-privilege access, and device encryption. No system is perfectly secure. If a breach affects your personal data we will notify you and the relevant authority as required by law.
Children
This site is not directed at children and we do not knowingly collect data from anyone under sixteen.
Changes
We will post any update here and change the date at the top. Material changes affecting an active engagement will be communicated directly.