What this site knows about you

Who is responsible

Sunil Mathew, operating as The Living Craft, from Bangalore, India. Under India's Digital Personal Data Protection Act that makes me the Data Fiduciary for everything described here, and you the Data Principal. There is no team. The person who answers a deletion request is the person who wrote this page.

Reach me at apply@thelivingcraft.ai.

What is collected, and when

When you read a page

Three pages keep a first-party record of visits: the cohort page, the Fractional CAIO page, and the AI Readiness Assessment page. The field notes and resources pages send the same signal, but the server accepts only those three addresses and discards the rest, so nothing is stored for them.

Nothing at all is recorded on this page, or on any page behind a sign-in. The course area carries no counter of any kind.

Each recorded visit holds:

• which of the three pages, and what happened on it — a view, opening the assistant, starting a form, following a link between the pages
• the host you arrived from, such as linkedin.com, never the full link and never its query string
• your country, taken from the hosting layer, and your region only if it is in the page address
• whether the device is a phone or a computer
• a visitor identifier, described next

The visitor identifier is deliberately short-lived. It is a cryptographic hash of your IP address, your browser's user-agent string, a secret held on the server, and today's date. Because the date is part of it, the identifier changes at midnight UTC and the same person returning next week is an unrelated row. This is not a limitation I have chosen not to lift. It means following someone across days is not reconstructible from what is stored, by me or by anyone who obtained the database.

The raw IP address is used to compute that hash and is never written to storage. Automated crawlers are identified and dropped before anything is recorded.

When you submit an enquiry or application

The forms on the cohort, CAIO and assessment pages collect your name, work email, job title, company, and whatever you write in the message field. Applications also carry the region you were shown pricing for.

Submissions are emailed to me through a form-delivery service, and separately written to my own database so that I have a searchable history. That second copy also records whether the email actually went through, because a failed delivery used to be invisible and meant someone believed they had applied when I had never seen it.

When you talk to the assistant

The question-and-answer assistant on the public pages is built on a Claude model from Anthropic. Your question and its answer are sent to Anthropic in order to produce a reply, and both are stored here along with which page you asked from, your country, and some counters about how the answer was produced.

A short session identifier ties the messages of one conversation together. It lives in the browser tab's memory, is never written to your device, and is gone when you close the tab.

I read these. They are the most useful thing on this site, because they are people telling me unprompted what my own pages failed to explain. Please do not type anything confidential into a chat box on a stranger's website, here or anywhere.

When you book a call

Booking a discovery or scope call records your name, email address, company, job title, anything you write in the notes field, your timezone, and the time you chose.

The booking is then created as an event in my Google Calendar with you as an invited guest, which is what sends you the invitation and the video link. That means your name, your email address and your notes are passed to Google as part of the event. Moving or cancelling the call updates that same event. Cancelling removes it from both calendars.

The link in your invitation that lets you reschedule carries a secret. Only a cryptographic hash of it is stored here, so the database never holds anything that could open somebody else's booking. Please do not forward that invitation.

If you join the cohort

Participants get an access code for the course area. I store your name, email, which cohort you are in, and a cryptographic hash of that code. The code itself is never stored, so a copy of the database does not let anyone sign in as you.

The pre-cohort questionnaire stores your answers against your seat. Those answers are read by me and used to plan the sessions. They are not shared with the other participants.

Cookies and what is stored in your browser

There are no advertising cookies, no analytics cookies and no third-party trackers on this site. Nothing is written to local storage or session storage anywhere, on any page.

Two cookies exist, and only after a deliberate sign-in:

• one that keeps you signed in to the course area, if you hold a seat
• one that keeps me signed in to my own operator console

Both are signed, both are marked HttpOnly so that no script on the page can read them, both are sent only over HTTPS, and both are restricted to this site. Neither one identifies you to anybody else.

Who else processes it

A one-person practice runs on other people's infrastructure. This is the complete list, and each entry says what actually reaches them.

Vercel

Hosts the site and runs its server code. Sees every request, and supplies the country your visit is recorded with. Vercel also provides its own aggregate traffic and performance counters, which run on the five public pages — the three above plus the field notes and the resources pages — and on neither this page nor anything behind a sign-in.

Supabase

The database behind everything described above. Reachable only with a server-side key that never reaches a browser.

Web3Forms

Delivers form submissions to my inbox. Receives whatever you typed into the form.

Anthropic

Provides the Claude model behind the assistant. Receives your question and the context needed to answer it.

Google

Calendar only, and only when you book a call. Receives the event, your name, your email address and your notes, and sends you the invitation.

GitHub

Holds the site's source and the drafts of published research. No personal data from this site is sent there.

These are service providers, not partners with a commercial interest in you. Nothing here is an advertising network, a data broker, or an enrichment service, and your details are never sold, rented or traded.

How long it is kept

What	Kept for	Why that long
Page visits	180 days	The identifier has already rotated daily, so an old row answers no question worth keeping it for.
Assistant conversations	365 days	These carry text you typed. A year is long enough to see what my pages keep failing to explain, and not longer.
Enquiries and applications	Until you ask me to delete it	A real enquiry must not be lost to an automated job. There is a copy in my inbox either way.
Booked calls	Until you ask me to delete it	A record of a conversation that happened. Cancelled bookings are kept as cancelled rather than erased.
Seats and questionnaire answers	Until you ask me to delete it	A participant record outlasts the six weeks. Withdrawn seats are kept deliberately.

The first two windows are enforced by the database itself, with a floor that refuses a window shorter than thirty days rather than silently accepting one. That guard exists so a mistyped number cannot empty a table while looking like a policy.

Your rights, and what happens when you use them

Under the Digital Personal Data Protection Act you can ask for a copy of what I hold about you, ask me to correct it, ask me to delete it, and nominate someone to act for you. Email apply@thelivingcraft.ai and say which. I reply myself, and I aim to do it within thirty days.

Deletion means deletion. The row is removed from the database, not flagged as hidden or moved to an archive. Deleting a participant also deletes their questionnaire answers. Deleting a booking cancels the calendar event first, so it disappears from your calendar as well as mine.

Two honest limits. Emails you sent me, and the email copy of any form you submitted, live in my ordinary mail account and have to be deleted there as a separate step. And the page-visit counter holds nothing that can be linked back to you by design, so there is no way for me to find your rows in it, and nothing there to return or delete.

What this site does not do

• No advertising, no advertising cookies, no remarketing, no conversion pixels.
• No selling, renting or sharing of your details with anyone outside the list above.
• No profiling, scoring or automated decisions about you. Applications are read by me.
• No tracking across other websites, and no attempt to recognise you across days.
• No email newsletter, so there is no list to be added to without asking.

Children

This is a professional programme for practising senior engineers, and it is not intended for anyone under 18. I do not knowingly collect anything from a child. If you believe a child has sent me something, write to me and I will delete it.

Security

Everything is served over HTTPS. The database refuses every key except one held on the server, which is never sent to a browser. Access codes and reschedule links are stored only as cryptographic hashes, so the stored form cannot be used to sign in or to open a booking. The operator console is password-gated and excluded from search engines.

No system is perfectly secure, and a practice that claimed otherwise would be telling you something false on its privacy page. If you find a problem here, write to me and I will fix it and tell you what happened.

Changes to this page

This page is versioned alongside the code it describes, and it is expected to change when the site does. The date at the top is the date it last changed. There is no archive of earlier versions, and material changes will be noted here rather than announced by email, because there is no mailing list to announce them on.