Chính sách Bảo mật

01What this policy covers

This policy explains what personal information Hutgate LLC (“Hutgate”, “we”, “us”) collects through this website, why we collect it, who we share it with and how long we keep it. It covers this website and the project request form on it. It does not cover information you give us under a signed engagement agreement, which is governed by that agreement.

02Information you give us

There are two places on this site where we ask for personal information: the project request form, and the project assistant described below. In both cases we collect:

• your name and company;
• your work email address and phone number;
• the services you selected, your estimated budget and timeline;
• the project brief you write.

Please do not put passwords, production credentials or regulated personal data about other people in the brief.

03Verifying your contact details

Before your request reaches us we send a 6-digit code to your email address or, if you choose, by text message, and ask you to enter it. Until the code is verified your details are held only temporarily and are discarded automatically if you do not finish — currently after 10 minutes. Once verified, your request is saved to our private back-end system and emailed to our team so an engineer can reply.

The project assistant verifies you the same way before it talks about your project. If verification fails — the code cannot be delivered, a wrong code is entered three times, or a code expires twice in a row — nothing is sent to us, and the form or the assistant, whichever you were using, is paused for you for 24 hours. There is no second attempt during that time; you can still email us directly.

To enforce that pause we store a one-way, keyed hash of the email address and phone number you entered, of your IP address, and of a random identifier your browser keeps for this site, together with a partly masked copy of the email and phone (for example j•••@example.com · •••• 0142) so our team can recognise you if you contact us. We cannot turn the hashes back into your details, and we use these records for nothing else. When a pause is applied, our team is told in its internal Discord channel, with your IP address and the masked email and phone, so it can help if you contact us. The records are deleted automatically after 24 hours — sooner if our team lifts the pause at your request.

04The project assistant

The chat box on this site is an AI assistant whose only purpose is to understand the project you want built and to pass it to our team. To generate its replies, the text you type is sent to our AI provider, z.ai (Zhipu AI), which processes it on our behalf under contract and does not use it to train its models. z.ai operates from China, so the text you type into the assistant is transferred to and processed outside the United States. We do not keep the conversation itself — only the inquiry you agree to send, which is saved in the same way as a form submission. Your own browser keeps it for the tab you are using, so that reloading the page or moving to another one does not start the conversation over; closing the tab discards it.

The assistant is restricted to that subject. It will not ask for, and our server refuses before sending anything to the provider, passwords, API keys, card or bank details, government ID numbers or health information. Please do not type such information into it.

Before the assistant talks about your project, it asks for your name, phone number and work email and confirms them with a 6-digit code sent by email or text message, as described above; an inquiry it files carries those verified details. If the conversation runs long, the assistant hands you to the project request form with what it has gathered so you can check it and send it yourself. Once you have sent a request, your browser keeps a short marker for 48 hours so the assistant can see that we already have it and point you to the form or our email instead of asking you to describe it again. That marker is a random value with no meaning outside this site, it says nothing about who you are, and clearing your browser’s site data removes it.

05Information we collect automatically

We keep this to a minimum:

• Your IP address, used only to limit how many requests the form accepts from one address per hour, so it is not abused. It is stored in a shortened, non-reversible form for one hour and is not kept with your request.
• Your cookie choice, stored in your browser so we do not ask again on every visit. See our Cookie Policy.
• Analytics, only if you accept analytics cookies. We do not use analytics at the moment, so no analytics cookies are set; if we add a provider we will name it here and ask for your consent before anything is set.

Our web server also keeps standard access logs for security and troubleshooting, retained for 30 days.

06How we use your information

We use it to evaluate and respond to your project request, to verify that the contact details you gave us are yours, to protect the form from automated abuse, and to keep records of inquiries we have received. We do not use it for advertising, we do not sell it, and we do not share it for anyone else’s marketing.

07Service providers

A small number of providers process this information on our behalf, only for the purposes described here and under contract with us:

• Amazon Web Services (AWS), United States — hosting for this website and our back-end system;
• Amazon Web Services (Amazon SES) — sending verification codes and notifying our team;
• z.ai (Zhipu AI) — generating the project assistant’s replies from what you type into it;
• one text-message provider — Twilio, Amazon SNS, Sent or Telnyx — sending verification codes by text message, if you choose that option;
• Discord — notifying our team, in its internal channel, of new requests (with the details you sent) and of verification pauses (with your IP address);
• Cloudflare — bot protection on the form, where enabled.

08How long we keep it

Verified project requests are kept for 24 months so we can follow up and keep a record of the inquiry, then deleted. Unverified requests are discarded within minutes, and the records behind a 24-hour verification pause are deleted after 24 hours, as described above. We will delete a request sooner if you ask us to and we have no legal reason to keep it.

09Your choices and rights

You can ask us to confirm what we hold about you, to correct it, to send you a copy, or to delete it — email [email protected] and we will respond within the time the law allows. You can change or withdraw your analytics cookie consent at any time from “Cookie settings” in the site footer. Depending on where you live, including California’s CCPA/CPRA and similar comprehensive privacy laws in other U.S. states, you may have additional rights; we honour those rights for everyone who asks.

10Security

This site is served over HTTPS. Project requests are stored in a private system that is not publicly reachable, and access is limited to the people at Hutgate who need it. No system is perfectly secure, so please do not send us sensitive data through this form.

11Children

This site is for business inquiries and is not directed to children. We do not knowingly collect personal information from anyone under 16.

12Changes to this policy

We may update this policy as the site, our providers or the law change. The “Last updated” date above shows when it last changed. If we start using your information for a materially different purpose, we will say so before we do.

13Contact

Questions about this policy or your data? Email [email protected].