Privacy

What is collected

When you submit the booking inquiry form, we collect your first name, last name, email address, phone number, your preferred contact method (email or phone), the date of your event and its venue or city where you tell us, the event details you write in the message field, the kind of event you choose from the list, and, if you choose to tell us, how you heard about Matt. The event date, the venue, the kind of event, and how you heard about Matt are all optional; the form is submitted successfully without them. Alongside your submission, we also keep internal workflow information you don't enter yourself, such as whether the inquiry has been contacted, booked, or declined, and whether our email notification about it was sent successfully, for our own recordkeeping.

Submitting the form also generates a random submission ID, used only to identify that one particular submission, for example, so that if your browser retries the request, we don't send a second internal notification email to Matt about the same inquiry. No confirmation email is sent to you either way; the submission ID does not identify you on its own.

We also record the page you first arrived on during your visit and the page the form was on, so Matt can see which page brought an inquiry. Each is a page address on this site only. If the link you followed to reach the site carried the three standard campaign codes (source, medium and campaign), they are kept with the arrival page; nothing else from that link is kept. They are stored with your submission and included in the notification email to Matt, which is sent through the same email provider as the rest of the inquiry; they are not used for anything else and are not sold or shared beyond that.

Spam prevention and rate limiting

To stop automated abuse of the form, we run a short-lived check on the IP address a submission comes from. We do not store the IP address in our own application records, only a one-way, salted hash of it is kept there, purely as a counter key, and that record is intended to expire automatically after about two hours via a Firestore data-retention policy. Separately from that check, we also use Cloudflare Turnstile to verify a submission was made by a person rather than a bot; doing so sends the IP address to Cloudflare as part of that verification. As with any request to our hosting infrastructure, the IP address a submission comes from also appears in Google Cloud's standard request logs, which are outside our application's own data and follow Google Cloud's own logging retention.

How it is used

This information is used solely to respond to your inquiry and to arrange a booking. It is never sold, and it is not used for advertising.

Who processes it

Delivering and handling the form relies on these service providers:

• Google Firebase: stores submitted inquiries and runs the form-handling function.
• Resend: delivers the email notification to Matt when an inquiry arrives. That email includes your name, email address, phone number, and message, and is set up so Matt can reply to it directly back to your email address. Resend also delivers a weekly summary email to Matt listing the name of each inquiry received that week.
• Cloudflare (Turnstile): verifies a submission was made by a person, not a bot, and receives the submitting IP address as part of that check.
• Google: this site loads Google's analytics tag (gtag.js) on every page, including this privacy page, which measures aggregate site usage and sets cookies in your browser to do so. This tag runs on every page you visit here, not only the inquiry form, and is separate from the inquiry data described above.

How long it is kept

Inquiries are automatically and permanently deleted 24 months after they are submitted, regardless of status, including inquiries that resulted in a completed booking, by a scheduled cleanup process that runs on this basis. We have not yet built an exception to this for completed bookings; if that changes, this page will be updated to say so.

Your choices

To request a copy of the information tied to your inquiry, or to ask for it to be deleted sooner than the 24-month period above, contactmatt@mswilson.net.