Privacy policy

What this covers

This policy covers the public hai.consulting website, the contact, security checklist and free security assessment forms on this site and the diagnostic tools published under the tools section. It does not cover work carried out under a signed engagement, which is governed by the agreement for that engagement.

What is collected

When you send the contact form

• The name, email address, organization and topic you enter
• The message you write
• The date and time the message was received

Nothing else is collected from the form. There is no tracking pixel, no analytics profile and no advertising identifier attached to a submission. Cloudflare Turnstile checks that the form is being sent by a person. An automatic confirmation is emailed to the address you enter; it does not repeat your name or message.

When you request the security checklist or a free security assessment

Your name, email address, company (optional), what you would like us to look at (assessment only), and the date and time.

Cloudflare Turnstile checks that these two forms are being sent by a person. The request is recorded in HAI Consulting's internal, self-hosted task system so the right person can follow up. Nothing is emailed to you in response.

When you browse the site

Standard edge request logs are generated by Cloudflare, the infrastructure provider serving this site. These include IP address, request time, user agent and the page requested. They are used to keep the service available and to investigate abuse, and are retained by Cloudflare under their own retention schedule.

Google Analytics

The site uses Google Analytics 4 to count visits and understand which pages are useful. It is off until you choose Allow in the notice shown on your first visit; if you decline or do not answer, it does not load. Google sets first-party cookies (_ga and _ga_*) and receives the page address, referring page, approximate location derived from your IP address, and device and browser details. Google signals and advertising personalization are turned off, and the data is not used for advertising by HAI Consulting.

You can change your choice at any time with the button below. Declining stops analytics on this site and removes its analytics cookies. If your browser sends a Global Privacy Control signal, analytics never loads. Your choice is stored only in your own browser.

Change analytics choice

When you use the diagnostic tools

Queries you run in the online tools are processed to return a result and are not stored by the application. Standard edge request logs still apply.

When you use the website assistant

The assistant is the chat panel in the corner of each page. The question you type is sent to this site and passed to a language model running on Cloudflare's network to produce an answer. Your question and the answer are not written to any database, not logged by the application and not used to train any model. They are held only for the moment it takes to answer, then discarded.

The assistant answers from the published content of this site. It has no access to enquiries, engagement records, client systems or any mailbox.

So that the assistant can follow a conversation across pages, the messages are kept in your own browser for the length of your visit, using session storage. They stay on your device, are not sent anywhere except as the question you ask, and your browser clears them when you close the tab. The Clear button in the assistant removes them immediately. Recent messages are sent back with your next question so a follow-up makes sense; they are used to answer it and are not stored on the server.

So that automated abuse cannot run up cost, the number of questions asked from your IP address in the past hour is counted. Only those timestamps are stored, never the questions themselves, and they are deleted automatically once the hour has passed. The contact, checklist and assessment forms are counted the same way.

Why it is collected

• To reply to you. Contact form details are used to answer your enquiry and to continue that conversation.
• To deliver what you asked for. Checklist and assessment requests are used to deliver what you asked for and to reply to your request.
• To keep the site running. Request logs support availability, security and abuse investigation.

Your details are not sold, rented, traded or used to build a marketing profile. You will not be added to a mailing list, and we do not send marketing email.

Who else processes it

• Cloudflare serves this website and processes request traffic on our behalf. The website assistant also runs on Cloudflare Workers AI, so a question you ask it is processed on Cloudflare's network and is not sent to any outside model provider.
• Cloudflare Turnstile checks that a form is being sent by a person, on the contact, checklist and assessment pages.
• SMTP2GO delivers the email generated by the contact, security checklist and free security assessment forms.
• Google Workspace hosts the mailbox that receives your enquiry.

Each of these processes data under its own terms. Checklist and assessment requests are recorded in HAI Consulting's internal, self-hosted task system so the right person can follow up. No other third party receives form data.

How long it is kept

• Enquiries that do not become engagements are retained for up to 24 months, then deleted.
• Checklist and assessment requests are retained like enquiries: up to 24 months, then deleted.
• Enquiries that lead to an engagement are retained under the record-keeping terms of that engagement.
• Assistant conversations are never stored on the server. They are held in your own browser for the length of your visit and cleared when you close the tab, or immediately if you use the Clear button.
• Request counts used for rate limiting are held for one hour and then deleted automatically.
• Edge request logs are retained by Cloudflare under their retention schedule, not ours.

Your choices

You can ask what is held about you, ask for it to be corrected, or ask for it to be deleted. Email Company@HAI.Consulting and the request will be actioned, normally within 30 days.

If you would rather not use the form at all, email the same address directly. The form is a convenience, not a requirement.

Security

This site is served over HTTPS with a strict content security policy. Third-party scripts are limited to Google Analytics, which you can turn off at any time, and, on the contact and request forms, Cloudflare Turnstile. Contact form submissions are transmitted over an encrypted connection.

Please do not send passwords, private keys, recovery codes, tokens or full configuration files through the contact form or by ordinary email. If sensitive material needs to be exchanged, a secure method can be arranged first.

Changes

If this policy changes materially, the updated version will be published here. This version was last reviewed in October 2026.