What I collect, where it goes, and how to get it deleted.

Effective 10 August 2026. Ventus Optera, LLC operates ventusoptera.com. I do not sell your information, I do not rent it, and I do not share it with anyone who is not listed on this page. If you want any of it removed, email me and I will remove it.

What you hand me on purpose

The contact form asks for six things. Three are required: your name, your email address, and a description of what you are trying to build or fix. Three are optional: your phone number, your company, and whether you would rather I reply by email or by phone. Nothing else on this site asks you for anything.

I use those details for exactly one purpose: to answer you, and to keep track of the conversation if it turns into an engagement. There is no newsletter, no drip sequence, and no list you are added to by submitting the form.

What gets recorded without you typing it

When you submit the form, five things are attached to your submission on the server: your IP address, your browser's user-agent string, the page you submitted from, the time, and a session identifier for that visit. The IP address is there to rate-limit the form, which is what stops it being used as a spam relay. It is capped at three submissions per address every ten minutes.

Also attached is how you found the site: campaign tags in the link you clicked (the utm_ parameters), advertising click identifiers if you arrived from an ad (Google, Microsoft, Meta, or LinkedIn), the site that referred you, and the first page you landed on. This is an allowlist of sixteen named values, each truncated at 200 characters. Nothing else from the address bar is stored.

Before you submit anything, that same arrival information is held in your own browser, in localStorage under the keys vo_attr_first and vo_attr_last, and it expires after 90 days. A page-view identifier lives in sessionStorage as vo_session_id and disappears when you close the tab. If you never contact me, that information never leaves your browser, and clearing your site data removes it.

The services this passes through

These are the only third parties involved, and each one is here because the site needs it to work.

Supabase

The database that stores form submissions, hosted in the United States. This is where your details actually live.

Resend

Sends me the notification email when the form is submitted. Your submission is in the body of that email, and your address is set as the reply-to, so my reply goes to you directly.

Netlify

Hosts the site itself and serves every page you load, so it processes the standard web-server request data in the course of delivering them.

Google Analytics

Measures traffic on property G-D3T3D3C97E. It sets cookies and tells me which pages get read and where visitors arrive from. If I run advertising, Google's advertising domains are contacted from these pages as part of measuring whether the ads worked.

PostHog

Product analytics, United States region, on an account belonging to Ventus Optera alone. Two things worth stating plainly, because both are choices rather than defaults: session replay is disabled in the code, so there is no recording of your screen, and automatic event capture is restricted to links and buttons, which puts form inputs structurally out of its reach. Both are set by the page's own code rather than left to a setting in the PostHog account, so they hold regardless of how that account is configured.

Google Fonts

Serves the typefaces the site is set in, which means Google receives the request for them, including your IP address.

Figma

The portfolio embeds design previews from Figma. Those load only on pages that contain one, and only when you open them.

How long I keep it

Form submissions are kept indefinitely, until you ask me to delete them. I would rather say that than name a period I have not built anything to enforce. If that changes, this page changes with it. Analytics data follows the retention settings of Google Analytics and PostHog respectively.

What you can ask me to do

Email michael.obrien@ventusoptera.com and I will tell you what I hold on you, correct it, or delete it. I am not going to make you prove a jurisdiction first. There is one person to ask, and asking is the whole process.

Independently of me, you can turn most of the measurement off yourself. Google publishes a browser opt-out add-on for Analytics. Any modern browser will block or clear cookies and site data per site. A Do Not Track or Global Privacy Control signal sent by your browser is honoured to the extent the services above act on it, which is a limit I can describe but cannot enforce for them.

Security, and what I will not claim

The site is served over HTTPS with a content security policy that restricts which outside domains a page may contact at all. The form posts to a server-side function rather than exposing the database, submissions are validated and rate-limited before anything is written, and access to the stored data is mine alone. What I will not tell you is that this makes it impossible to breach, because no one can honestly tell you that about anything connected to the internet.

Children

This is a business-to-business consultancy. The site is not directed at children under 13 and I do not knowingly collect anything from them. If you believe a child has submitted the form, email me and I will delete the record.

Changes to this policy

If what the site does changes, this page gets updated and the effective date at the top moves. I am not going to notify you individually, so the date is how you tell.

Who to contact

Ventus Optera, LLC. Michael O'Brien, michael.obrien@ventusoptera.com. That address reaches me directly, not a ticket queue.