Privacy notice

Your request and contact details

Antepath LLC, United States, is the controller; privacy contact: contacto@antepath.com. Antepath collects the idea text and five Discovery answers you confirm, your name, email, optional international phone number, preferred language, page language and text or dictation input mode. We use them to understand your project, assess your request and follow up about a free Discovery or quoting conversation. Do not submit passwords or confidential, medical or financial information.

Before confirmation, your idea, answers and contact details stay in this tab's memory. Session storage holds only progress metadata, not these texts or contact details. A full reload can lose your draft. When you confirm, we store your request, a deterministic initial orientation, identifiers, timestamps and consent evidence. This intake does not send your idea to an AI model.

Required permission and optional marketing

The required checkbox authorizes processing your submitted information and contacting you about this request. It is separate from marketing. We record the privacy notice version and acceptance time, together with your request language.

Marketing is optional and unchecked by default. Declining it does not prevent submission, confirmation email or project follow-up. If selected, it permits email news and updates about Antepath services; we record its acceptance time and version (mvp0-marketing-2026-10-07-v1). No marketing campaign sender is implemented in this intake. You can withdraw permission by replying to our confirmation or follow-up email.

Confirmation and internal email

Your request is saved before email delivery. A separate delivery queue sends a localized confirmation to your email and an internal notification to the Antepath team. The internal message contains your idea, answers, name, email, phone if provided and submission identifier. Delivery records contain status, attempts and timestamps. Email is sent through the configured SMTP provider; the application does not establish which provider is used. Mailbox copies are separate from the application database.

Optional booking: Cal.com and Google Meet

Booking is optional and available only after a saved request when the service is enabled. To offer and book a free 30-minute call, the server sends Cal.com your name, email, language, selected time and timezone, event type and an opaque booking attempt identifier. It does not send your idea, answers or phone to Cal.com. We retain the booking state, provider identifier, start/end times, provider update time and Google Meet link. The timezone is used for scheduling; it is not stored as an intake contact field.

Cal.com manages scheduling, confirmation and cancellation/rescheduling links, with Google calendar/Meet involvement when configured. Joining a Google Meet call involves Google's service processing. Antepath does not implement call recording in this flow. Provider activation and actual email/Meet delivery depend on configuration; this notice does not claim those services are currently enabled.

First-party analytics and browser storage

Analytics is off until you explicitly accept it. Our optional first-party telemetry uses no analytics cookies and no third-party analytics SDK. It measures landing, intake and booking actions using random visit/event/action identifiers, sequence, elapsed time, language, viewport category and limited source/medium/campaign/referrer categories. It excludes your idea, answers, name, email, phone, raw IP, user agent, full URLs, booking identifiers and access tokens. It does not join analytics to lead records or create an identifier from contact information.

After consent, session storage holds random analytics identifiers, timing, categories and deduplication metadata. Visits rotate after 30 minutes; blocked storage falls back to tab memory. Do Not Track or Global Privacy Control disables collection even after acceptance. Use “Analytics preference” on any page to change or revoke your choice. Revocation stops future events and clears active analytics state; previously received events follow the 90-day retention rule. Necessary local storage saves only your granted/denied choice and consent version, without PII or a timestamp. Analytics is independent of marketing. Rejection or analytics failure does not prevent Discovery, submission, receipt or booking. No actions before consent are backfilled. Hosting and network infrastructure still handle connection metadata; this code does not establish their access-log or cookie practices. External booking and meeting services have their own practices.

Abuse protection and reliability

For submission rate limits and abuse detection, the server reads an IP address from a configured trusted proxy header and stores keyed hashes of IP and email, plus event type and time. A keyed digest of the submitted payload and an idempotency identifier distinguish retries from conflicting requests. These are pseudonymous technical records, not browser fingerprinting or anonymous data. A hidden anti-bot field and completion timing help detect automated submissions; no device fingerprint is collected.

Retention

Free lead records, including idea, answers, contact details, orientation and consent evidence, expire within six months of creation under the configured policy. Local booking rows and queued email rows are deleted with the lead. Abuse/security records and sent delivery-queue rows are eligible for cleanup after 90 days under the current policy; operational submission/email events after 90 days. First-party funnel analytics expires 90 days after receipt, independently of lead retention.

Physical deletion requires the maintenance task to run. This application defines cleanup rules but does not configure a schedule. Mailboxes, hosting logs, backups, Cal.com and Google records have separate provider retention, which this code does not control or verify. A booking cancellation does not itself delete your lead. You may request earlier deletion where applicable.

Providers, security and international processing

The server stores application records through Supabase/PostgREST and uses the configured SMTP service for email. Cal.com and Google are involved only if you choose an enabled booking/call. Browser dictation is optional: the browser's speech recognition service may process audio remotely under that browser provider's practices. Antepath receives the resulting text and does not upload or store an audio file in this intake. Text input remains available.

We use server-side validation, origin checks, restricted database access and separate email delivery to limit access and abuse. No system guarantees absolute security. Hosting, database, email, browser speech and scheduling providers may process information internationally depending on their configuration. Provider locations, contractual safeguards and mailbox/backup retention require confirmation before production use; no specific transfer safeguard is represented as already approved.

Your choices and requests

To ask about access, correction, deletion, restriction, portability, objection or withdrawal of consent where applicable, reply to an Antepath confirmation or project follow-up email and identify the request using the email you submitted. Requests need human handling and may require identity verification. Withdrawal does not undo processing already performed. You may also contact the competent data protection authority where applicable. Antepath has no automated rights-request portal in this flow.