Legal
Privacy Policy
The short version. This is a marketing website. There is no account to create, nothing to buy, and nothing to upload. If you never touch the contact form, the only personal data involved is the IP address your browser has to send in order to receive a page — plus, if you agree to it, an analytics cookie. No analytics or advertising loads until you say yes, and you can change your mind at any time using Cookie settings in the footer of any page.
1. Who we are
PRJCT LAZRUS LLC ("PRJCT LAZRUS", "we", "us") operates the website at prjctlazrus.com, which describes the software products we build.
For the purposes of the UK GDPR and the EU GDPR, PRJCT LAZRUS LLC is the data controller for the personal data described in this policy.
- Privacy contact: hello@prjctlazrus.com
- Postal address: available on request from the address above
- Security contact: see /.well-known/security.txt
We have not appointed a Data Protection Officer. Given the small volume and low risk of the processing described here, we do not believe one is required under GDPR Art. 37; we will review that if it changes.
2. What this policy covers — and what it does not
This policy covers prjctlazrus.com only.
Our product pages link out to separate landing pages hosted on different domains (heirloom-landing.vercel.app, exitzork-landing.vercel.app, kairos-landing-six.vercel.app, w33knd-landing.vercel.app, neo-plus-landing.vercel.app). Those are separate deployments with their own data flows, and this policy does not describe them. Neither does it describe the products themselves — Kairos, Heirloom, eXitZork, W33KND and NeoPlus each handle data in ways this website does not, and each needs its own notice.
3. What we collect
3.1 From every visitor, automatically
Your browser has to tell a web server where to send the page. We cannot switch that off, and neither can anyone else.
| What | Why we need it | Legal basis |
|---|---|---|
| IP address | Deliver the page; limit how often the contact form can be submitted from one address; block abuse | Legitimate interests (Art. 6(1)(f)) — running a website you asked to see, and keeping it up |
| Browser and device type (user agent) | Serve the right assets; diagnose display problems | Legitimate interests (Art. 6(1)(f)) |
| Page requested, referring page, timestamp | Serve the page; find broken links | Legitimate interests (Art. 6(1)(f)) |
Nothing else your browser loads on this site comes from anyone else. As of version 2026-09-05 the typefaces are served from our own domain and the interface icons are drawn inline, so Vercel is the only company that sees your IP address on an ordinary page view. Google Fonts and Cloudflare's cdnjs, which previously received it on every page before you had agreed to anything, are gone.
3.2 Only if you accept analytics
We use Google Analytics 4 (property G-62WCEKB4P3) to see which pages get read. None of it loads unless you accept. Not the script, not the cookie, not a single request. If you reject, or if your browser sends a Global Privacy Control signal, the Google Analytics script is never fetched at all.
| Cookie | What it holds | Lifetime |
|---|---|---|
_ga | A randomly generated number identifying your browser. Not your name, and not linked to one. | 2 years |
_ga_62WCEKB4P3 | Session state for this specific analytics property | 2 years |
pl_consent | Your consent choice and the policy version you saw. Stored in your browser's local storage, not sent anywhere. This one is strictly necessary — without it we would have to ask you on every single page. | Until you clear it |
With analytics accepted, Google also receives: the page URL and title, the referring page, your
approximate location derived from your IP, your device, browser, operating system, language
and screen size, and the following event names —
page_view, product_<name>_view, cta_click,
click (for links leaving our site), and lead_submit.
The lead_submit event records that a contact form was sent and nothing
else. Your name, email address, subject line, and message are never sent to Google or
to any advertising network.
Legal basis: your consent (GDPR Art. 6(1)(a); PECR reg. 6 / ePrivacy Art. 5(3)). You can withdraw it at any time, as easily as you gave it, from Cookie settings in the footer. Withdrawing deletes the analytics cookies immediately and stops any further data being sent.
3.3 Only if you use the contact form
The contact form on the home page asks for your name, email address, subject and message. We use them to read your enquiry and reply to it. That is the whole purpose.
Legal basis: taking steps at your request before entering into a contract (Art. 6(1)(b)), and our legitimate interest in answering people who write to us (Art. 6(1)(f)).
The message box is free text, so you can put anything in it. Please do not send us health information, government ID numbers, or other sensitive details — we do not ask for them, we do not need them, and a contact form is the wrong place for them.
We also write one line to our server log for each submission so we can spot someone abusing the form. That line contains a one-way hash of the IP address and the domain part of the email only — never the address itself, never your name, and never the message.
3.4 What we do not collect
Every line here is a commitment, not a slogan:
- There is no account, signup, login or password anywhere on this site.
- We take no payments. There are no subscriptions and no recurring charges.
- We collect no precise or GPS location.
- We accept no uploads — no files, images, audio or video. This site has no file storage of any kind.
- We collect no biometric data and no voiceprints.
- We run no session recording, no heatmaps and no scroll tracking.
- We run no advertising or attribution tracking. The Meta Pixel is present in our code but is not configured and does not fire; if we ever switch it on it will sit behind the same consent gate, and we will update this policy before we do.
- We buy no data from data brokers and do no enrichment.
- Nothing you type here reaches an AI model. This website has no AI feature and no chatbot. We build AI products, but this site is not one of them.
- Nothing you give us trains any model, ours or anyone else's.
4. Who receives your data
We do not sell your personal information, and we do not share it for cross-context behavioural advertising. No advertising or attribution tag is active on this site, so there is nothing being shared for those purposes.
The companies that receive data, what they get, and where they process it, are listed in full on our subprocessor page. In summary:
| Who | What they do | What they get | When |
|---|---|---|---|
| Vercel Inc. (US) | Hosts the site and runs the contact form function | IP, browser, page requested; contact form contents in transit | Always |
| Resend (US) | Delivers the contact email to us | Name, email, subject, message | Contact form only |
| Google (US/IE) | Google Analytics 4 | Cookie ID, IP, page and device details, event names | Only with your consent |
Vercel, Resend and Google Analytics act as our processors under written data processing terms, meaning they may only handle the data on our instructions. Every recipient on this site is now one we hold a contract with; the two free public services we used to depend on have been removed. See section 12.
Beyond those, we may disclose personal data where the law requires it, or to protect the rights and safety of people using our products. If PRJCT LAZRUS were ever acquired or merged, data could transfer to the acquirer; we would tell you, and this policy would continue to apply until replaced by one that is not weaker.
5. International transfers
PRJCT LAZRUS LLC is a United States company and our providers process data in the United States. If you are in the UK, the EEA or Switzerland, your data therefore leaves your region.
- Vercel — EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) and the UK International Data Transfer Addendum, incorporated in Vercel's DPA.
- Resend — Standard Contractual Clauses attached to Resend's Data Processing Addendum.
- Google Analytics — the Google Ads Data Processing Terms, which apply the 2021 Standard Contractual Clauses to restricted European transfers.
- Cloudflare self-certifies to the EU–US Data Privacy Framework, its UK Extension, and the Swiss–US DPF.
You can ask us for more detail about these safeguards at hello@prjctlazrus.com.
6. How long we keep things
| What | How long |
|---|---|
| Contact form enquiries (in our mailbox) | Up to 24 months from our last exchange with you, then deleted — unless we are actually working together, in which case we keep them for as long as that relationship runs |
| Server and delivery logs (pseudonymised) | Kept only for the retention period our hosting and email providers apply to their platform logs. We do not export them, copy them, or extend that window. |
| Analytics data at Google | Per the retention setting on the GA4 property. Withdrawing consent stops collection immediately; you can also ask us to delete what has already been collected. |
| Analytics cookies in your browser | 2 years, or until you withdraw consent or clear them — whichever comes first |
| Your consent choice | Stored in your browser until you clear it or the policy version changes |
Backups. This site has no database and no file storage, so there is no application backup holding your data. Contact emails live in a mailbox, and that mail provider keeps its own backups on its own schedule — if you ask us to delete an enquiry, we delete it from the mailbox immediately, and it disappears from the provider's backups as those rotate.
7. Your rights
Wherever you live, you can ask us to:
- Tell you what we hold about you, and give you a copy
- Correct anything that is wrong
- Delete it
- Stop using it, or restrict how we use it
- Withdraw consent to analytics — do this yourself, instantly, from Cookie settings
In the EEA, UK or Switzerland you also have the right to object to processing based on legitimate interests, the right to data portability, and the right to complain to your supervisory authority — in the UK, the Information Commissioner's Office; in the EU, your national data protection authority. We would like the chance to put things right first, but you do not have to come to us before going to them.
In a US state with a comprehensive privacy law you have rights to know, delete, correct, obtain a copy, opt out of sale, sharing and targeted advertising, and not to be treated worse for exercising them. As set out above, we do not sell or share personal information for advertising.
Global Privacy Control. We honour the GPC signal. If your browser or extension sends it, we treat it as a refusal of analytics: the banner is not shown, no analytics script is loaded, and no analytics cookie is set. You can still choose to opt in deliberately from Cookie settings if you want to.
How to make a request
Email hello@prjctlazrus.com and say what you want. You do not need an account, because there are no accounts. We may ask you a question or two to check you are the person whose data it is — we will ask for the least we can get away with, and we will not use it for anything else.
How quickly: within one month under the UK/EU GDPR (extendable by two further months for genuinely complex requests, and we will tell you inside the first month if we need that), and within 45 days under US state laws (extendable once by a further 45 days with notice).
These requests are free. An authorised agent can act for you if you give them written authority.
8. How we protect it
- Everything is served over HTTPS, with HSTS preloaded, and HTTP is upgraded automatically
- A Content Security Policy restricts what the page is allowed to load and where it can send data
- Clickjacking, MIME-sniffing and cross-origin protections are set at the edge
- The contact form is rate-limited and validates every field on both the client and the server
- There is no database and no file storage to breach — the most effective control here is that the data mostly does not exist
- Secrets are held in environment variables, never in the repository, and every push and pull request is scanned by
gitleaksin CI - Our third-party stylesheets are pinned with Subresource Integrity hashes
No system is perfectly secure. If a breach happens that is likely to put your rights at serious risk, we will tell you and the relevant regulator as the law requires.
9. Children
This website is a business site aimed at adults, and there is nothing on it to sign up for. It is not directed to children under 16 and we do not knowingly collect personal information from them. We do not age-gate the contact form, because doing so would mean collecting dates of birth from everybody — more data, not less.
If you believe a child has sent us personal information, email hello@prjctlazrus.com and we will delete it.
10. Automated decisions and AI
We make no automated decisions about you that produce legal or similarly significant effects. There is no profiling, no scoring and no automated eligibility check on this site.
There is no AI system on this website. We build AI products, and this site describes them, but the site itself does not run one. Nothing you type here is sent to a language model, and nothing you give us is used to train one.
11. Changes to this policy
We review this policy at least once a year, and our build fails if we let that slip. Each version carries a date, and previous versions stay available so you can see what changed:
- Version 2026-09-05 — current; removed Google Fonts and cdnjs as recipients
- Version 2026-08-22 — first published version
If we make a material change — adding a new tracker, a new recipient, or a new purpose — we will ask for your consent again before it takes effect, by resetting the consent banner.
12. What we are still working on
Publishing this list is deliberate. A policy that only describes the tidy parts is not an honest one.
- Google Fonts and cdnjs — resolved 5 September 2026. Both used to load on every page before you had agreed to anything, handing your IP address to Google and Cloudflare under no contract we were party to. The typefaces are now subset and served from prjctlazrus.com, the icon font has been removed entirely, and our Content Security Policy no longer permits either origin — so the browser could not reach them even if a future change tried to.
- Exact log retention windows. Section 6 describes our providers' platform log retention by reference rather than by number. We are confirming the exact figures and will state them here.
13. Contact
Privacy questions, requests, and complaints: hello@prjctlazrus.com.
Security reports: see /.well-known/security.txt.