Privacy Policy

1. Who we are

VanPaulTek Inc. ("VanPaulTek," "we," "us") is a Delaware corporation. This Privacy Policy covers vanpaultek.com, forum.vanpaultek.com, and outbound email from noreply@vanpaultek.com (collectively, the "Services").

Registered agent for legal notice: [DE Registered Agent — from Certificate of Incorporation]
Contact: legal@vanpaultek.com

2. What we collect

2.1 Marketing site (vanpaultek.com)

• Contact form submissions — when you submit a contact form or click a mailto: link, we receive your name, email, company, topic, and message contents.
• Server logs — IP address (hashed with a rotating daily salt so we cannot identify you retroactively), user-agent, timestamp, and requested URL. Retained for 90 days for abuse prevention and troubleshooting.
• No third-party trackers — no Google Analytics, Facebook Pixel, Mixpanel, Segment, or advertising cookies.

2.2 ServiceNow Forum (forum.vanpaultek.com)

• Account data — email address (required). If you set a password, we store the scrypt hash — never the plaintext. If you sign in via passkey, we store the WebAuthn credential public key only. If you sign in via Google, we store the Google user ID + email.
• Session cookie — vpt.sid, scoped to .vanpaultek.com, HttpOnly, Secure, SameSite=None. Expires after 30 days.
• Content you post — thread titles, replies, category selections. Publicly visible on the forum.
• Anonymous search log — for anonymous visitors, we record IP + date to enforce the 2-free-searches-per-day paywall. Cleared after 30 days.
• Per-user search log — for signed-in users, we record user ID + date to enforce the 10-per-day quota. Cleared after 30 days.
• Magic-link tokens — SHA-256 hash of the emailed sign-in token, expires 15 minutes after issue, single-use.

2.3 AI search (dividirix on servicenow-forum)

When you submit a search query on the ServiceNow Forum landing page, we send the query text to Anthropic PBC (Claude Haiku API) to generate a structured answer. Anthropic's commercial API terms state your queries are not used to train foundation models. See Anthropic's privacy policy.

3. How we use it

• Respond to your inquiries and provide the Services you request.
• Run the forum: authenticate you, remember your session, enforce fair-use quotas, moderate posts, prevent spam and abuse.
• Improve the site: analyze anonymized error logs, catch broken pages.
• Communicate about the Services: sign-in links, account notices, and (rarely) material changes to these policies.

We do not sell your data. We do not share it with advertisers, data brokers, or marketing partners.

4. Third-party processors

We use a small, deliberate set of vendors to run the Services. Each is bound to their own privacy commitments:

• Anthropic PBC — Claude API for AI-generated ServiceNow answers. Located in the United States. Queries are not used for model training. Anthropic terms & privacy.
• InterServer, Inc. — Authoritative DNS provider and outbound SMTP host for noreply@vanpaultek.com. Located in the United States.
• jsDelivr CDN (cdn.jsdelivr.net) — Serves the small tech-vendor logos (AWS, Azure, GCP, etc.) on our /about page. Loaded as images, not scripts. This CDN sees your IP when your browser fetches an icon; it does not receive cookies or personal data from us. Fonts and stylesheets are served from our own domain — no font or CSS CDN sees your browser.

5. Cookies

We use functional cookies only. No analytics, advertising, or cross-site tracking cookies.

Your browser can block or delete these cookies at any time; blocking vpt.sid will log you out.

6. Data retention

• Contact-form submissions — retained for 24 months, then deleted.
• Forum accounts and content — retained until you request deletion (see §7).
• Server logs — 90 days.
• Anonymous / per-user search logs — 30 days.
• Magic-link tokens — 15 minutes.

7. Your rights

You have the right to:

• Know — what data we hold about you.
• Access + port — get an export of your data.
• Correct — fix inaccurate personal data.
• Delete — request full deletion of your account and associated content.
• Opt out of sale — a no-op since we do not sell data, but the right is preserved under CCPA.
• Non-discrimination — we won't degrade Services or charge you differently for exercising these rights.

To exercise any right, email legal@vanpaultek.com from the address associated with your account. We'll respond within 30 days.

If you're in the EU/UK, GDPR and UK GDPR give you these same rights plus the right to lodge a complaint with your data protection authority.

8. Children

The Services are not directed at users under 16. We do not knowingly collect personal information from children. If you believe a child has registered on the forum, contact legal@vanpaultek.com and we'll remove the account.

9. International transfers

VanPaulTek operates from the United States. If you access the Services from outside the US, your personal data (including forum content and AI queries) will be transferred to and processed in the US, which may not offer the same privacy protections as your home country. By using the Services, you consent to this transfer.

10. Security

We use industry-standard controls: TLS everywhere, HttpOnly + Secure + SameSite session cookies, scrypt password hashing, WebAuthn passkey support, CSRF protection on state-changing endpoints, and automated database migrations that self-heal common schema issues. No system is perfectly secure — if you suspect a breach affecting you, contact legal@vanpaultek.com.

11. Changes to this policy

We may update this Privacy Policy from time to time. Changes take effect when posted. For material changes affecting how we handle your data, we'll notify signed-in forum users by email. The "Last updated" date at the top always reflects the current version.

12. Contact

Privacy questions or requests: legal@vanpaultek.com
Mailing address: VanPaulTek Inc., [DE Registered Agent — from Certificate of Incorporation]