Privacy Policy

ThynkQ ("we", "our", or "us") is operated by Abanoub Rodolf Boctor. This Privacy Policy explains how we collect, use, and protect information when you visit thynkq.com or engage us for services.

We collect the minimum information needed to provide our services. We do not sell personal information to third parties.

Contact and proposal request submissions: When you submit a project request, we collect your name, work email, company or team, budget range, timing, relevant URL or repository, written project context, and route metadata such as the requested service lane and source page. This is used solely to respond to your inquiry and is delivered to us via Resend. Sending a proposal request does not subscribe you to marketing email.

Email newsletter subscriptions: When you subscribe to updates, we collect your email address. We use it to send engineering articles and occasional announcements. You can unsubscribe at any time by replying to any email.

Payment information: When you purchase a digital product or book a paid consultation, Stripe processes the payment. The site does not accept or store card numbers or CVVs. Stripe webhooks can place a limited record in Vercel KV: checkout or subscription event ID, session or subscription ID, product or source, email when supplied by Stripe, status where applicable, and an event timestamp.

Booking data: If you book a call via Cal.com, your name, email, and scheduling information are processed by Cal.com under their privacy policy. We receive a copy of the booking details.

Analytics data: We use Vercel Analytics to understand site use and performance. No tracking cookies are set for analytics purposes. The site also records anonymous conversion events: button clicks, whether a form submit succeeded or failed, calendar opens, and checkout redirects. The site sends each one to Vercel Analytics, but Vercel Analytics does not record custom events on this site's plan, so ThynkQ's own anonymous daily counts in Vercel KV are the record that is kept. Those counts store no IP address, user agent or visitor id next to them. To rate-limit the counting endpoint, the site hashes your IP address with a secret salt that changes daily and keeps that hash in Vercel KV for 60 seconds, then it expires. The hash is never stored with an event. An event carries a page or lane label and a result, with no names, emails or form contents.

AI behavior analysis: The AI behavior panel is shown only to the signed-in site owner and never to visitors. Your browser keeps a per-tab browsing record in sessionStorage: visited paths, time on page, scroll depth, tracked interaction labels, and a random session identifier. That record stays in your tab, is not sent anywhere unless the panel is opened, and clears when the tab closes. Only the owner can open the panel, so visitor traffic never reaches our analysis route or Groq. When the owner opens it, the route sends Groq a compact summary of paths, durations, scroll depth, current page, recent tracked interaction labels, and visit count to generate suggestions. If the Groq key is not configured, the route does not call Groq and returns an unavailable response. We have not set a fixed retention period for what Groq keeps.

Server logs: Our hosting provider (Vercel) may collect standard server log data such as IP addresses, request paths, and timestamps. We use available log information for security and performance monitoring.

• Responding to project inquiries and consultation requests
• Sending newsletters to subscribers who opted in
• Processing digital product purchases and delivering order confirmations
• Improving our website based on anonymized analytics
• Maintaining the security and integrity of our site

We set the following cookies on thynkq.com:

We do not set analytics cookies. Vercel Analytics is cookie-free. It collects only aggregate, anonymized performance metrics with no personal identifiers.

We do not use cookies for advertising, cross-site tracking, or marketing purposes.

The following third-party services process data on our behalf or in connection with our services:

• Stripe: Payment processing for digital products and consultations. Stripe may collect payment card data, billing address, and email. See Stripe's Privacy Policy.
• Resend: Email delivery for contact form notifications and newsletter messages.
• Vercel Analytics: Cookie-free website performance metrics.
• Vercel: Hosting and edge infrastructure. May collect server log data including IP addresses.
• Sentry: Error monitoring and performance tracing on the production site, in Sentry's US region. It receives error reports and a 10% sample of page and request traces. When a page errors, it also receives a replay of that session with all text masked and media blocked; sessions without an error send no replay. Sentry does not set cookies on this site; while its replay SDK is active it writes one session-scoped key to sessionStorage, which clears when the tab closes.
• Cloudflare: Runs the Worker proxy used by the on-site AI chat route when one is configured. The on-site AI chat is currently turned off, so no chat request is sent. If it is turned on, the provider will be listed here first.
• Groq: Called only when the site owner opens the AI behavior panel, which visitors never see. The analysis route then sends Groq the compact browsing-behavior summary described above. Visitor traffic never reaches Groq, and without a configured key this analysis route does not call Groq.
• Google: When Google OAuth is configured, Google authenticates sign-in for the owner and active client portal accounts and returns the verified account identity used for access control.
• Neon: Serverless Postgres for portal features. When those features are used, it holds client account, project, invoice, payment, referral, kickoff-brief, and audit data.
• Cal.com: Calendar booking and scheduling. Booking data processed by Cal.com under their privacy policy.
• Vercel KV: Key-value storage for site controls, rate-limit state, the limited Stripe webhook records described above, and the anonymous daily event counters (one evt:<day>:<event> record per event per day).

The anonymous daily event counters in Vercel KV expire 400 days after the last count is added to that day's record. Rate-limit records expire when their window ends: 60 seconds for most routes, 15 minutes for sign-in, and 1 hour for kickoff-brief submissions and Vigil report calls. Most routes key those records on the requester's IP address, so an IP address can sit in Vercel KV for the length of its window. Owner sign-in also keeps a 15-minute limiter keyed on the owner's email address. Kickoff-brief records are keyed on the client account, and Vigil report records on a hash of the report token. The event counting endpoint is the exception and uses the salted hash described above; without its secret it drops the count instead of hashing. The expiry is set again on every request, so a record whose first expiry failed still expires on the next hit. We have not set a fixed retention period for our inbox, our newsletter list, or the records held by Stripe, Vercel, Cloudflare, Sentry, Neon, Groq, or the Stripe webhook records in Vercel KV. If you need a defined retention or deletion schedule, ask before you send us data so we can settle it in writing.

Privacy laws in your jurisdiction may give you rights to ask for access, correction, deletion, restriction, or a copy of personal data. Whether a request applies depends on the data and the law that governs it.

• Ask what personal data we hold about you
• Ask us to correct inaccurate data
• Ask us to delete data where applicable
• Ask about restriction, objection, portability, or consent where applicable

To make a request, email rodolf@thynkq.com with enough detail to identify the record. We may need to verify your identity and will assess the request under applicable law. This policy does not publish a universal response-time commitment.

Our services are not directed to individuals under 18. We do not knowingly collect personal information from minors. If you believe we have inadvertently collected data from a minor, contact us at rodolf@thynkq.com and we will delete it promptly.

We use HTTPS for data in transit. Admin and portal access are protected by authentication. Card numbers and CVVs are handled by Stripe rather than accepted by site routes, while limited payment-event data can reach Vercel KV as described above. No system is 100% secure. Do not transmit credentials, access tokens, protected health information, customer records, or other highly sensitive personal information through our contact or proposal request forms.

We may update this policy from time to time. We will update the "Last updated" date at the top when changes are made. Material changes will be noted prominently. Continued use of our site constitutes acceptance of the updated policy.

Privacy questions or data requests: rodolf@thynkq.com

ThynkQ / Abanoub Rodolf Boctor, New York, NY, United States