What we collect, and what we don’t.
One form, no cookies, no trackers, and no list to get added to. This page is the whole of it, in the same plain terms as everything else here.
The short answer
- No cookies
- No analytics, no ad pixels
- Nothing sold, ever
Four sentences, if you read nothing else. The rest of the page is just the detail.
Every claim below can be checked against the code this site is built from, which is the only kind of privacy promise worth making.
-
The only thing we collect is what you type into the contact form
There is one form on this site and it is the only place anything about you is recorded. Read a page, read ten, close the tab, and we have no idea you were here.
-
No cookies, no analytics, no advertising pixels
Not "essential cookies only" — none at all. No Google Analytics, no heatmaps, no session recording, and nothing from Meta, Google Ads or LinkedIn. That is also why there is no consent banner to click past: there is nothing to consent to.
-
It goes to our inbox, our database, and the CRM we reply from — nowhere else
It is not sold, rented, traded or handed to an advertiser, and there is no list to get added to. The CRM is named further down, and it is simply where the enquiry sits while a person deals with it. You get a reply from a person, and then you get nothing until you write back.
-
Ask us to delete it and we will, without asking why
Email hello@opflows.co and it is gone. You do not have to tell us which state you live in or which law you are invoking.
Everything the contact form collects.
This is the complete list — there is no field on the form that is not on this page, and nothing is inferred, enriched or bought to fill in the gaps.
- Name
- So the reply is addressed to a person.
- Company
- So we know whose processes we would be looking at before we reply.
- Work email
- The address we reply to. It is the only channel we use, and it is not added to anything.
- Phone
- Optional, and only if you would rather be called. Leave it blank and nothing rings.
- Roughly how many people
- A range, not a headcount. It tells us what scale of process we would be walking into.
- What takes your team the most time
- Your answer, in your words. It is read by a person and it is what the reply is actually about. Do not put anything confidential in it — it is a contact form, not a secure channel, and the first conversation never needs one.
- Which page you landed on, and where you arrived from
- The first page of your visit, the site that linked you if one did, and any utm_ tags on the URL. This tells us which page did the work. It is filled in by the page, not by you, and if your browser has scripting off it is simply blank.
- City, region and country
- Cloudflare hands these to the form handler with the request, and we keep them at that resolution deliberately. We do not store your IP address — a log of addresses is a retention problem attached to a question nobody is asking.
What happens while you are just reading.
Nothing, is the short version. Most sites quietly disagree with that sentence, so here is what this one actually does.
-
No cookies
This site sets none. Not analytics ones, not "essential" ones, not a consent cookie recording that you dismissed a banner.
-
One entry in your browser, which never leaves it on its own
On the first page you open, a small first-party sessionStorage entry named lo_attr records the page you landed on and any campaign tags in the URL. It is read once — if and when you submit the contact form — and it is dropped the moment you close the tab. Nothing about you is recorded anywhere until you choose to type your name in.
-
No third-party requests at all
The one typeface is served from this domain. No CDN, no font service, no embedded video, no social widget. Opening a page here contacts nobody but this site.
-
Two spam checks, both discarded
The form times how long it took to fill in and includes a hidden field that a person never sees. A submission that is too fast, or that fills the invisible field, is a bot. Neither signal is stored, and neither is kept after the decision is made.
Who else sees it.
Three entries, and the third one is a nobody. A short list is not an accident — every vendor added here is another copy of your details somewhere we do not control.
- Cloudflare
- Serves every page, runs the contact form handler, holds the database the lead is written to, and sends the notification email. Serving and protecting a site means Cloudflare sees the IP address and request details of everyone who visits — that is true of any site behind any host, and it is handled under Cloudflare’s own terms. We do not store any of it. The one place an address is used at all is rate limiting, which counts posts per address for sixty seconds and keeps nothing.
- Our email inbox
- The notification lands in the inbox behind hello@opflows.co, as plain text. Nothing you submit is ever rendered as markup, in the email or anywhere else.
- Attio
- The CRM we work an enquiry from, so it is somewhere a person picks up rather than only an email that can be scrolled past. It receives a copy of what the form collected — the fields listed above, including the page you landed on and the city-level location — and nothing more. Not your IP address, which is never stored anywhere. It is a place to keep track of a conversation, not a marketing list: nothing is sent to you from it, and it is not connected to an ad network. Ask for deletion and the copy there is deleted along with ours.
- Nobody else
- No marketing platform, no ad network, no analytics vendor, no data broker, no AI product trained on what you sent. If that changes, this page changes first and says which one.
How long we keep it
If we work together, for as long as we work together and then as long as tax and contract records require. If we don’t, the lead and its history are deleted after twenty-four months with no contact either way. Keeping a stranger’s enquiry indefinitely on the chance it becomes useful is how a contact form turns into a database nobody meant to build.
What you can ask for.
Some states give you these rights by law and some don’t. We are not going to make you work out which, or prove it. Email us and the answer is yes.
hello@opflows.coA person replies within seven days, and usually the same one.
-
A copy of what we hold
Everything on this page, filled in with your answers, sent back to you.
-
A correction
Wrong company, wrong email, an answer you would put differently now. Tell us and it is fixed.
-
Deletion
The lead and its history are removed. If we are mid-engagement there may be records we have to keep for tax or contract reasons, and if so we will tell you exactly which and why rather than refusing in general terms.
-
To be left alone
There is no list, so there is nothing to unsubscribe from. Say the word and we stop replying.
If any of this changes.
The most likely change is measurement. We run no analytics and no advertising pixels today, and if that ever changes it will not be done quietly: this page will name the vendor, say what it receives, say what it sets in your browser, and carry the date it started — before the tag goes live, not after. A privacy page that turns into a list of “third-party partners” you cannot name is one that has stopped meaning anything.
A 60-minute diagnostic, then a fixed scope. Nothing owed either way.
Free, no pitch deck. We work out whether there is anything here worth building — including when the answer is that there is not.