Privacy policy

1. No analytics, no tracking

This site does not use analytics tools, advertising trackers, tracking pixels, or marketing cookies. It does not build profiles of visitors and does not sell or share visitor data with advertisers. Browsing this site does not require an account and does not ask you for any personal information. Because nothing is stored on your device beyond what the browser needs to display the page, there is no cookie consent banner — there is nothing to consent to.

2. Server logs

Like almost every website, the hosting infrastructure that serves this site may keep standard, short-lived server logs — including IP address, browser type, and request timestamps. An IP address is personal data, so this is processing, and we do it on the basis of our legitimate interest in keeping the site available and secure (Article 6(1)(f) GDPR). We do not use these logs to identify or track individual visitors, and we do not combine them with anything else.

3. Data you choose to send us

If you submit the enquiry form on this site, or email us at hello@throughbolt.com, we receive the information you choose to provide. The form asks for your name and email address, optionally your company or website and how you found us (free text, in your own words), what kind of work you need, and a description of it. If you arrived through a link that carries campaign parameters (such as utm_source), the form also sends those parameters — which link brought you here — with your enquiry, and if the first page you opened on this site was not the homepage, it sends the address of that page too; nothing is stored on your device to do this. Nothing you write is stored in a database: the form composes an email to us, and that email, with one line in our own sales log (your email address, how you reached us and, if you give it, your company), is normally the only record of your enquiry. There is one exception, and it exists so that a technical fault cannot cost you a reply: if that email fails to send, what you submitted is written to our hosting provider's server log instead, so we can still answer you. That happens only when delivery has already failed, the entry is kept only for as long as the hosting provider retains its logs, and it rests on the legitimate interest set out in section 2. To stop the form being used to send bulk mail, the site briefly counts recent submissions against the sending IP address — that count is held in memory for fifteen minutes, contains none of the text above, and is covered by the same legitimate interest described in section 2. We use the information you send only to:

• respond to your enquiry,
• evaluate and prepare a potential consulting engagement, and
• carry out an engagement we agree on.

We do not add you to a mailing list, and we do not send marketing email based on an enquiry.

4. Why we are permitted to process it

Under the GDPR every purpose needs a legal basis. Ours are:

• Responding to an enquiry — our legitimate interest in answering people who contact us about our services, and yours in getting a reply (Article 6(1)(f)).
• Preparing and carrying out an engagement — performance of a contract with you, or steps taken at your request before entering one (Article 6(1)(b)).
• Invoicing and business records — compliance with a legal obligation, principally tax and accounting retention rules (Article 6(1)(c)).
• Keeping the site available and secure — our legitimate interest in operating infrastructure that is not abused (Article 6(1)(f)).
• Writing first to a business about our services — our legitimate interest in offering relevant services to businesses (Article 6(1)(f)); see section 12.

We do not rely on consent for anything, because we do not do anything that requires it. No tracking and no profiling. We do write first to some businesses about our services; section 12 covers that, and it rests on legitimate interest.

5. Third-party processors

This site is hosted by Vercel. Mail sent to our throughbolt.com addresses is received in a mailbox hosted by Namecheap, our domain registrar (its Private Email service, on servers in the United States), and we write from the same mailbox. Mail sent to addresses at whenbird.com is forwarded by Namecheap to a Gmail mailbox provided by Google. The notices of calls booked with us, and any reply to them, go to that mailbox too. Enquiries submitted through the form on this site are delivered by Resend, an email delivery provider, to the throughbolt.com mailbox; Resend processes the contents of the form in order to transmit it. Our notes of an enquiry or a call may be kept in a private GitHub repository (GitHub).

We use an AI assistant, Anthropic's Claude, to help draft replies and to send the ones a person has approved. To draft a reply it may read your message, so the text of what you send us can reach Anthropic, which acts under its own terms and privacy policy. A person approves every reply before it is sent.

The "Book a 30-minute call" link on this site opens a booking page on whenbird.com, a separate service run by the same person. The page runs on Vercel and, to stop abuse, counts requests by IP address, including the ones your browser makes to show the open times. That counter is held in the server's memory or at Upstash. It expires after about two minutes if you only open the page, or after about two hours if you book; a counter held in memory is deleted at the server's next clean-up or when the server stops, which can be later than that. If you book, the page also stores your name, email address, the time you chose, your time zone and language, and a phone number or note if you add one, in a database (provided by Neon), and sends your confirmation and reminders through Resend. The call itself runs on the video-call service named in your booking confirmation, which handles your name, your email address and any audio or video.

We do not pass your data to any other third party unless you ask us to or the law requires it, and we never sell it.

6. Transfers outside the EEA

Namecheap, Google, Vercel, Resend, Neon, Upstash and GitHub are US companies or owned by one, so correspondence, enquiries, booking details and server logs may be processed in the United States. Anthropic, the provider of the AI assistant described in section 5, is a US company too, and acts under its own terms and privacy policy. The video-call service named in your booking confirmation may also be a US company or owned by one. Where a provider is certified under the EU–US Data Privacy Framework, the transfer relies on that certification. Where it is not, or the Framework does not cover the transfer, it relies on the European Commission's Standard Contractual Clauses in the provider's data processing terms. If you would like to see the specific mechanism a given provider relies on, ask and we will point you at it.

7. Retention

We keep correspondence for as long as it is relevant to an ongoing or potential engagement, plus any period required for legitimate business records — invoicing and tax obligations typically fix that at several years, and the exact figure is set by the tax law that applies to us rather than by us. We delete enquiries that clearly lead nowhere.

8. Your rights

You can ask us at any time to give you a copy of the personal data we hold about you (access), correct it (rectification), delete it (erasure), limit what we do with it (restriction), or hand it to you or another provider in a machine-readable form (portability). Where we rely on legitimate interests, you can also object to the processing, and we will stop unless we have compelling grounds that override your objection.

Email hello@throughbolt.com and we will act on the request within one month, unless a legal obligation requires us to retain something — in which case we will tell you which one.

You also have the right to lodge a complaint with the data protection supervisory authority in the EU or EEA country where you live or work, or where you believe the issue occurred. You do not have to raise it with us first, though we would rather you did.

9. No automated decision-making

We do not make decisions about you by automated means, and we do not profile you. We build AI systems for clients; we do not point them at the people who email us. Enquiries are read by a person. A person may ask an AI assistant to help draft a reply, as section 5 says; it makes no decision about you.

10. Children

This site is a professional services site and is not directed at children. We do not knowingly collect data from anyone under 16.

11. Changes

If this policy changes — for example, if analytics are ever added — the updated version will be posted on this page with a new effective date.

12. If we contacted you first

This section is for people we contacted without them contacting us first, usually by one email about our services to their business, or a phone call to their company's switchboard, or an invitation to try Whenbird, our booking service.

Who we are. Arber Rexha, trading as Throughbolt, who runs Throughbolt (throughbolt.com) and Whenbird (whenbird.com), hello@throughbolt.com. One person runs both and is the person who wrote to you.

What we hold about you:

• your name, your work email address, your company and, where the page gave it, your role;
• the public page where we found your address, and the observation about your company's public product or site that the email mentioned;
• our emails to you, your replies, the date and kind of each, the country we think you are in, and whether you asked us to stop;
• how we read your reply (positive, neutral or negative), and short notes on our exchange, for example when to follow up, why we stopped, or whom you suggested we contact;
• the switchboard number we called (the one printed on your site); the date and outcome of each call; the role of whoever answered, with no personal remarks; the date of any callback you agreed, and the date and place of any meeting; the reason in two words, if you said no; the address you gave and the words in which you agreed, if you asked us to write; and the number on our do-not-call list, if you asked us not to call again.
• if you open the link in our email: the short code in it that names your company, and your IP address in the hosting provider's short-lived server log. If you then send the contact form, the code travels with your message;
• if you open the booking page or book a call: what section 5 lists for the booking page.

Where it came from. Publicly accessible sources: your company's website, or a public post you or your company made (for example a Hacker News hiring or launch post). Our first email names the exact page. If we phoned you first, the number came from your company's website, and you gave us your email address on the call. We also view your public LinkedIn profile.

Why, and on what basis. To offer our services, or a seat in Whenbird's partner programme, to your business, in one email and at most two short follow-ups. We may also view and follow your LinkedIn profile and send you one connection request with a short note; a "no" stops that too. The basis is our legitimate interest in offering relevant services to businesses (GDPR Art. 6(1)(f); Kosovo Law 06/L-082 Art. 5(1.6)), using contact details from publicly accessible sources (Kosovo Law 06/L-082 Arts. 73–74).

Who processes it for us (each under its own terms):

• Namecheap (its Private Email service) hosts the throughbolt.com mailbox we write from and receive replies in. Its servers are in the United States.
• Google (Gmail) holds a few early emails we sent from a Gmail account, the mail sent to addresses at whenbird.com, which is forwarded there, and the notices of calls booked with us, with any reply to them. We do not use Google for mail to and from throughbolt.com addresses.
• GitHub keeps copies of our draft emails and notes in a private repository.
• Vercel (hosting) serves our website and the booking page and keeps short-lived server logs, so it handles a visit even if you only open the link in our email. If you open the booking page, we hold your IP address briefly in an abuse counter (in memory or at Upstash) that expires after about two minutes, or about two hours if you book; a counter held in memory is deleted at the server's next clean-up or when the server stops, which can be later than that. If you use the contact form or book a call: Resend (email delivery) and, for a booking, Neon (database), as section 5 describes. A booked call runs on the video-call service named in your booking confirmation.
• A file on our own computer logs who we emailed and when. It is our own record, not a processor.

Anthropic (Claude), an AI assistant, researches public pages, drafts our emails, drafts replies when you answer (it may read your message to do so) and, once a person has approved an email, may send it. It acts under its own terms and privacy policy. A person approves every email before it goes out, and an email the person did not rewrite says it was drafted with AI.

We do not sell your details or share them with anyone else.

Where it goes. Most of these providers are US companies, so your details may be processed in the United States. Transfers rely on the provider's certification under the EU–US Data Privacy Framework where it has one, and otherwise on the European Commission's Standard Contractual Clauses in its data processing terms. Ask, and we will say which applies to which provider.

How long:

• We keep your details while a follow-up is still possible, and then as a record of whom we contacted, so that we never write to you twice. We delete them if you ask.
• If you ask us to stop, we add your address to a do-not-contact list and never write again; our past emails to you are kept as section 7 describes.
• If you book a call, the booking stays in Whenbird's database until you ask us to delete it, or the account that owns the booking page is deleted.
• A number on our do-not-call list is kept, so that we never call it again.
• If we end up working together, the client terms apply instead.

Your rights:

• Object at any time. Reply "no" or "stop" to any of our emails. We stop straight away and confirm it in writing.
• Say "do not call again" on any call; we add the number to our do-not-call list that day.
• You can also ask what we hold, have it corrected or deleted, or restrict how we use it.
• You can complain to your own data-protection authority, or to Kosovo's Information and Privacy Agency (AIP).

No automated decisions are made about you.

13. Contact

Questions about this policy, or any request under section 8: hello@throughbolt.com.