Trust Centre
Privacy and data handling
What we collect, why, where it lives, and how long we keep it.
- Data minimisation in discovery
- The Project Architect deliberately does not ask for personal data about your customers, production credentials, or the contents of sensitive systems. We ask about categories and volumes, not records.
- Service communication separated from marketing
- Replying to your enquiry is service communication and is not optional. Marketing communication requires a separate, explicit opt-in that you can withdraw at any time without affecting service communication.
- Hosting and residency
- This platform is hosted on Vercel with its database and storage in Supabase’s London (eu-west-2) region. Where a client engagement requires a specific residency position, that is a design constraint agreed during Shape rather than something reconciled afterwards.
- Retention and deletion
- Retention periods are defined per data category. Deletion is implemented and tested rather than asserted. You can request export or deletion of your data through your client portal or by contacting us.
- Subprocessors
- We maintain a register of the third parties that process data on our behalf, what each one processes, and where. It is published below and updated when it changes.
Questions
Ask us anything about this
Security and privacy questions reach a person who works on the platform, not a sales inbox.