01Who we are and what this policy covers
Pontian builds custom software, connects business systems, and develops AI tools for business operations. In this policy, “Pontian,” “we,” and “us” refer to the operator of the Pontian website and business.
This policy covers pontian.co, Pontian-operated versions of this website, our presentations and inquiry forms, and our direct communications with prospective clients, clients, suppliers, and partners. It explains our own handling of personal information, meaning information that identifies or can reasonably be linked to a person.
When we process information for a client under its instructions, the client determines the purpose of that processing. The client’s privacy notice and our written processing agreement govern that work. A separate product notice applies where provided. This website policy does not replace a client platform’s privacy notice, a data processing agreement, or a healthcare business associate agreement.
02Information we collect and where it comes from
We receive information directly from you when you complete a form, call or message us, send correspondence, or participate in a business discussion. We may also receive relevant business contact details from your organization, a referral, or a publicly available professional source.
- Contact details: your name, company, work email, and any telephone number or contact details you give us in correspondence.
- Company context: your industry, company size, role, coordination methods, number of software platforms, knowledge storage, administrative workload, AI use, technology adoption, and reason for contacting Pontian. Write-in answers may contain information you choose to add.
- Communications and business records: messages, meeting notes, proposals, service requirements, contracts, billing contacts, and records needed to manage an engagement. Recordings or transcripts require the notice or permission required by law.
- Technical and security information: IP address, browser and device details, requested pages, timestamps, referring pages where available, verification results, and information generated by hosting and security services.
- Client service information: documents, system records, project decisions, and other information a client authorizes us to handle. The agreed scope determines the categories involved. We do not gain access to a client’s systems simply because someone visits this website.
The public inquiry forms require your name, company, and email. The general Get Started form also requires company-context answers. Without the required information and a successful security check, the online submission cannot be completed. You can contact us directly instead.
The public website does not collect payment-card details, account passwords, or uploaded client files. Do not put health information, government identifiers, financial account details, credentials, children’s information, or confidential third-party records into the inquiry form.
03What happens when you submit a form
Your answers remain in the open page’s memory while you complete the form. The application does not save unfinished answers to a browser database or send each answer as you select it. Refreshing or leaving the page can clear them.
When you send the form, our server receives the submitted contact details, answers, and verification token. It validates the submission and sends the token to Cloudflare for verification. After verification, accepted contact details and answers are forwarded to our configured inquiry-handling service with a submission timestamp and a label identifying the form. The Skorman contact form collects contact details without the ten-question questionnaire.
The inquiry-handling service may be a CRM or an automation provider acting for Pontian. A failed verification prevents forwarding to that destination. A submission error does not establish that no technical information was processed or that a destination received no data. Contact us if you need to confirm receipt or request deletion.
04Why we use information
We use contact details and company context to respond to requests, assess whether an engagement fits, prepare proposals, and follow up on the conversation you started. We use business records to provide agreed services, coordinate work, maintain systems, manage billing, and keep a record of decisions.
Technical information helps us deliver pages, troubleshoot failures, prevent spam and abuse, and protect the website. We may use relevant records to meet legal obligations, resolve disputes, and establish or defend legal claims.
Submitting an inquiry requests a response about that inquiry. It does not enroll you in a general marketing list or authorize unrelated promotional calls or texts. If we offer optional marketing, we provide the choice required by law and a way to stop receiving it.
05Legal bases where required
Where applicable law requires a legal basis, we rely on steps requested before entering a contract and performance of a contract for proposals and agreed services. Our legitimate interests support responding to business contacts, maintaining business records, and securing the website, provided those interests do not override your rights.
We rely on legal obligations for required records and disclosures. We request consent when required for optional marketing, recording, or another activity that needs it. You may withdraw that consent without affecting processing that was lawful before withdrawal. Browsing the website or reading this policy is not consent to every possible use of your information.
06Cookies, browser storage, and security checks
The bilingual presentation and contact pages use a browser preference named pontian-locale to remember English or Portuguese. This is local storage on your device. It stays until you clear it or change the preference. It does not contain your form answers.
Cloudflare Turnstile runs on the form’s final contact step to distinguish visitors from bots. It processes technical signals such as IP address, browser headers, TLS characteristics, and the website’s origin. Cloudflare processes signals on our behalf to provide verification and also processes them for its own security-improvement purposes. See the Turnstile Privacy Addendum and Cloudflare Privacy Policy for its handling of that information.
Our website application does not include advertising pixels or tools for tracking you across unrelated sites. Hosting and security services may use necessary technical mechanisms. You can manage cookies and local storage through your browser, although blocking security scripts may prevent online submission.
We do not sell personal information or share it for cross-context behavioral advertising. There is no such advertising activity on this website for a Do Not Track or Global Privacy Control signal to disable. Where law requires a response to a recognized privacy signal, we honor it.
08Client systems, AI, and confidential information
Client engagements may involve databases, documents, transcripts, operational systems, and AI providers. Access, approved providers, permitted uses, security requirements, retention, and return or deletion of data must be defined in the client agreement and any required data processing agreement before that processing begins.
The public website’s inquiry flow does not send your answers to an AI model. Prepared examples in presentations do not connect your browser to a client’s private systems. In an agreed AI service, authorized input may be sent to an approved model provider. Model outputs can contain personal information and require the same access and handling controls as the underlying input.
We do not treat possession of client data as permission to reuse it for unrelated clients or to train general-purpose models. Any such use needs a separate lawful basis and the client’s written authorization. Provider retention and training settings must be assessed for the particular service rather than assumed from a marketing description.
If your information is in a platform operated by one of our clients, contact that organization first. We assist with requests under our agreement with the client. We do not independently override its lawful instructions or disclose another person’s or client’s records.
09International processing
Pontian works across countries, and hosting, security, communications, and project providers may process information in the United States or other locations where they operate. Those locations may have different privacy laws from your country.
Where a restricted international transfer is involved, we use the lawful mechanism required for that transfer, such as an applicable adequacy decision or approved contractual safeguards. Client agreements must identify any required geographic restrictions. Visiting the website does not waive your statutory rights. Contact us for information about the safeguards applicable to your information.
10How long information is kept
We retain personal information for the time needed for its purpose, taking account of the nature of the information, the status of the relationship, legal requirements, and unresolved claims.
- Inquiry records are kept while we address the request and any relevant follow-up. We delete or anonymize them when they no longer serve that purpose, unless another lawful reason requires retention.
- Engagement, billing, and contract records are kept for the relationship and the applicable legal, tax, accounting, or limitation periods.
- Client data follows the retention and return or deletion instructions in the client agreement and applicable law.
- Technical logs follow the hosting or security service’s configured retention and any justified incident-preservation period.
- The language preference remains on your device until you remove it or change it.
Deletion may take additional time to propagate through backups or provider systems. Information kept solely for recovery or a legal hold must remain restricted and must not be used for unrelated purposes. We explain an applicable retention exception when responding to a deletion request.
11Security
We use measures appropriate to the information and processing involved, including access restrictions, HTTPS connections, server-side form validation, and verification before forwarding online inquiries. Client security controls are defined for each engagement.
No transmission or storage system is guaranteed to be secure. A statement about a proposed control, uptime target, or acceptance test is not a certification or a guarantee that every client system has that control. If an incident requires notification, we provide it in accordance with applicable law and contractual obligations.
12Your choices and privacy requests
You can ask about our processing, request access or a copy, correct information, request deletion, restrict or object to a use, or withdraw consent. Which requests we must fulfill depends on the applicable law, our role, and any lawful exception. You can also ask us to stop optional marketing.
Use the contact channels in the final section. Describe the relationship or form involved and the right you wish to exercise. We may request proportionate information to verify your identity or an agent’s authority. We use that verification information for handling the request and protecting the people concerned.
We respond within the period required by applicable law and explain any lawful refusal, extension, or fee. We do not discriminate against you for exercising a protected right. Where available, you may appeal a refusal through the same contact channel and complain to the relevant regulator.
13Additional rights under regional laws
European Economic Area and United Kingdom. Where the GDPR or UK GDPR applies, your rights may include access, correction, erasure, restriction, portability, and withdrawal of consent. You may object to processing based on legitimate interests and to direct marketing. You can complain to your local supervisory authority or the UK Information Commissioner. The public inquiry flow does not make solely automated decisions with legal or similarly significant effects.
Brazil. Where the LGPD applies, you may request confirmation of processing, access, correction, anonymization, blocking or deletion of unnecessary or unlawful data, and portability subject to regulation. You may request information about recipients and consent choices, revoke consent, and request deletion of consent-based data subject to legal exceptions. You may challenge unlawful processing and request review of qualifying automated decisions. Complaints may be directed to the ANPD.
California and other U.S. states. If an applicable state privacy law covers our processing, you may have rights to know, access, correct, delete, receive a portable copy, or opt out of specified sale, sharing, targeted advertising, or profiling. California residents may also have rights concerning certain uses of sensitive information and authorized agents. Our collection and disclosure categories are described in this policy. We do not sell personal information or share it for behavioral advertising, and the public forms do not request sensitive personal information.
These descriptions apply only where the relevant law grants the right and covers the processing. They do not remove any protection granted by another applicable law.
14Children and sensitive information
This public business website and its inquiry forms are intended for adults acting in a business capacity. They are not directed to children under 13, and we do not knowingly collect their personal information through these forms. A parent or guardian who believes a child has provided information should contact us so we can address it and delete it where required.
Education, healthcare, employee, or other regulated client services require their own appropriate notices, permissions, contracts, and controls. This policy does not establish compliance with COPPA, FERPA, HIPAA, or another sector-specific rule for an individual client platform.
15Third-party websites and communications
Property links, research sources, telephone links, and WhatsApp links may take you to another provider. If you contact us through WhatsApp, your carrier, device, and WhatsApp provider process communications under their own arrangements. Another website’s operator is responsible for its own notice and practices.
We remain responsible for our own handling of information received through those channels. Linking to a provider does not make every part of its service subject to this policy.
16Changes to this policy
We update this policy when our practices or legal requirements change and identify the revision date. For a material change, we give additional notice where required. If a new purpose requires consent, we obtain it before starting that processing. A policy update does not retroactively authorize a use that required permission.
17Contact Pontian
Direct privacy requests and legal notices to Pontian through our contact page. Identify the request as a privacy request or legal notice and describe what you need. Do not send passwords, identity documents, or sensitive records with your initial request.