Trust

Privacy Policy

Last revised: September 28, 2026

Short version: No cookies for visitors. No third-party tracking scripts. No fingerprinting. We run our own privacy-first analytics that collect anonymized, aggregated data. The only personal data we store is what you type into our forms or email us, such as a logo for a QR order. If you buy a QR pack, you pay on Stripe's site and your card details never reach us. Chat messages go to an AI provider to write the replies, and we do not keep them. We don't sell your data or send you marketing emails you did not ask for.

What we collect

Forms: What you type into a form and send:

  • Contact form: your name, email address, budget range (optional), and project description
  • Project questionnaire: your email address and your answers about the project
  • Lab unlock: your email address and which Lab page you unlocked
  • QR order form: see QR orders and payments below
  • Changeable Code waitlist on /qr: your email address (see Changeable Code waitlist)
  • Print checklist box on /qr: your email address, to send you the checklist once (see Print checklist email)

Email: What you email us, such as a logo for a QR order or a reply to one of our emails. It stays in our email inboxes, and for a QR order, what the design needs goes into Canva (see QR orders and payments). What you send through our forms and by email is the only personal information we store.

Site analytics: We collect anonymized, aggregated performance and usage data to keep our site fast and reliable. This includes:

  • Page paths visited (not full URLs — no query strings or fragments)
  • Referring domain (e.g., "google.com" — not the full search query URL)
  • Device type (mobile, tablet, desktop) and browser family (Chrome, Firefox, Safari)
  • Country (derived from server-side headers, not geolocation APIs)
  • Core Web Vitals performance metrics (page load speed, layout stability)
  • Scroll depth and time on page (for content quality, not surveillance)
  • Button clicks, form opens, form submissions and chat opens, counted by page, without anything you type into a form

How we anonymize: Your IP address is never stored. We compute a one-way hash (SHA-256) of your IP, browser, and the current date. This lets us count unique visitors per day without being able to identify anyone. The hash rotates daily and cannot be reversed. No cookies are set. No browser fingerprinting is performed.

Analytics data is retained for 90 days, then permanently deleted.

QR orders and payments

The QR code generator on /qr runs in your browser. What you type into it, and any logo you add, is not sent to us or stored anywhere. The rest of the site runs on /qr as it does on every page: the site analytics, the chat assistant, and the contact form described on this page.

The order form on the same page sends what you type into it, and only when you press its button. It stores:

  • Your name and email address, so we can send your files and reply to you
  • Your business name (optional), so we know who the order is for
  • The pack you chose, so we know what to make and what you paid for
  • Your answer to where the code should point (something you already have, a page or site we build for you, or not sure yet), so we know whether you need a page as well as a code
  • Your answer to what the code should do, with its details: the link, contact details, text or email to start, or event it should hold, or a Wi-Fi network name and the Wi-Fi password if you give it to us. We need these to make the code.
  • Your brand colors and notes (both optional), so we can design the files
  • An order number your browser makes when you send the form, and the time you sent it, so we can match your order to your payment

The form does not take files. If you want your logo in your files, you email it to us.

Design. To fulfil a pack, we lay out your card or flyer in Canva, an online design service. The details you send us for the design, such as your name, contact lines, and logo, are placed in our Canva account, along with the code, which holds what you asked it to (for example your contact details or a Wi-Fi password). We delete that copy of the design, and the logo and code files we uploaded for it, within 90 days of delivering your final files, or of refunding the order, unless you ask us to keep them for reorders.

If the form cannot confirm that your order was saved, it offers a link that starts an email to us with your order written out, and for some orders a link to Stripe's checkout page that carries your order number and email address (see Payment below). Neither is used unless you choose it, and the email goes only if you send it from your own email app.

Payment. You pay on Stripe's checkout page, on Stripe's own site. Your card details go to Stripe and never reach otrovertlabs.com. The link that takes you there carries your order number and your email address, so Stripe can fill in your email and we can match the payment to your order. Stripe shows us the payment details it shows any seller, such as your email address, the amount, and your card's brand and last four digits. It never shows us your full card number. Stripe keeps its own record of the payment under Stripe's privacy policy, and its checkout page sets its own cookies on Stripe's site.

Changeable Code waitlist

The Changeable Code on /qr is not on sale yet. Its card has a form for your email address, so we can tell you when it is. Pressing its button stores your email address, a note that it came from that form, and the time, in the same database as our other forms, and emails a copy to the same business inboxes. Nothing else is stored, and nothing is stored until you press the button.

It is not a newsletter. We email you once, when the Changeable Code goes on sale, and then we delete the list. To be taken off before then, email legal@otrovertlabs.com and we delete your address within 30 days.

Print checklist email

Under the "Before you print" checklist on /qr there is an optional box for your email address. Pressing its button stores your email address, a note that it came from that box, and the time, in the same database as our other forms, and our server sends that address one email with the same checklist. It is not emailed to our inboxes, and nothing is stored until you press the button. The downloads never depend on it.

It is not a list and not a newsletter. An address gets the checklist at most once a day, however often it is typed in, and we delete the address within 30 days. To have it deleted sooner, email legal@otrovertlabs.com.

Where it goes

Form submissions, QR orders, and analytics are stored in a Supabase PostgreSQL database hosted in the United States. A copy of each form submission and order, except an address typed into the print checklist box, is also emailed to two of our business inboxes, a main one and a backup, so we can answer it. Both are Gmail inboxes. Only Tony (the founder) accesses them. Form submissions and orders stay until you ask us to delete them (print checklist addresses are deleted within 30 days), and then we delete the database record, the emailed copy in each inbox, the emails between us about it (yours, and ours with the files we sent you), and anything for your order still in our Canva account (the design copy, your logo, and the code). Resend, the service that delivers those emails, keeps its own log of what it sent under its own rules. Analytics data is automatically purged after 90 days.

What we don't do

  • No Google Analytics or any third-party analytics service
  • No advertising pixels or remarketing tags
  • No cookies for visitors to otrovertlabs.com (Stripe's checkout page, on Stripe's own site, sets its own)
  • No session replay or heatmap tools
  • No browser fingerprinting
  • No selling or renting your data, and no sharing it beyond the services listed under Third parties, for the jobs listed there
  • No email marketing list and no newsletter; the only list we keep is the Changeable Code waitlist you join yourself on /qr, which gets one email and is then deleted (see Changeable Code waitlist)

Chatbot

When you send the on-site AI assistant a message, the conversation so far goes through our server to an AI provider that writes the reply: DeepSeek, whose servers are in China, or OpenAI if DeepSeek does not answer. We do not store the conversation. It lives in the open page and is gone when you leave or reload it. The provider handles it under its own terms, so do not put anything private in the chat. If neither provider answers, the assistant falls back to canned answers built into the site.

Third parties

The outside services that handle data from this site, and the job each one does:

  • Netlify — hosts the site and runs its server functions (form notifications, the chat relay, analytics). Like any web host, it sees your IP address when your browser asks for a page
  • Supabase — stores form submissions, QR orders, and anonymized analytics data
  • Resend — delivers the emails our forms trigger: the copies of your submission sent to our inboxes, the contact form's confirmation to you, and the print checklist to an address typed into its box on /qr
  • Gmail (Google) — hosts our business email, so the copies of your submission, and what you email us, sit in our Gmail inboxes
  • Stripe — takes payment for QR packs on its own checkout page
  • Canva — where we lay out the card or flyer for a QR pack, so the details you send for the design sit in our Canva account until we delete them (see QR orders and payments)
  • DeepSeek, with OpenAI as a backup — writes the chat assistant's replies
  • Google Fonts — serves the typefaces for the /draft tool only; the rest of the site's fonts come from our own domain. Google may log the IP address of the request; no cookies are set

Your rights

You can request a copy of your data, correction of inaccurate data, or full deletion by emailing legal@otrovertlabs.com. We honor requests within 30 days.

Children

Services are not directed at children under 16. We do not knowingly collect information from them.

Changes

Material changes to this policy will be posted on this page with an updated "Last revised" date. If the change affects how existing data is handled, we will notify anyone who has submitted an inquiry.

Contact

Privacy questions: legal@otrovertlabs.com
OtrovertLabs is a trade name of Venture Horizon LLC, Newark, Delaware, USA.