Privacy.

What this page covers.

RSH is a boutique software house operating from Cyprus. This site has two narrow data surfaces: the contact form and, if you choose to forge or present one, a symbolon. There are no ads and no advertising cookies. The sections below describe both surfaces.

What the form collects.

Your name, your company, your email address, and the message you write. Nothing is inferred and nothing is bought. You choose every field, and the only required ones are your email address and the message itself.

Where it goes.

To HubSpot, which we use to receive and answer enquiries, and nowhere else. We do not sell it, rent it, or pass it to anyone for their own purposes. It is read by the people who would do the work — the same people who answer you.

Why we keep it.

To answer you, and to hold the thread of a conversation that may take more than one message. If an engagement follows, the record becomes part of that work. If none does, the enquiry is of no further use to us and you can have it removed at any time.

The symbolon.

When a forging completes or you present a symbolon, this site sets one functional first-party cookie. Its Max-Age is 604,800 seconds (seven days) when issued; lawful refreshes shorten as needed near the signed cookie’s absolute 30-day cap. It is httpOnly, Secure, and SameSite=Strict; it is not an advertising or analytics cookie.

The progress record is keyed by a SHA-256 hash, not by a name or contact detail. It contains closed, site-authored progress tokens and bounded counters; it has no semantic personal information or free-text field. The secret itself is not stored by the site.

That design has a consequence worth stating plainly: because the record is keyed by a hash of a secret only you hold, we cannot identify, retrieve, correct, export, or delete a symbolon record on request — we have no way to tell whose it is. The rights described below therefore apply to what the contact form holds. A symbolon ends when its half is discarded or re-forged; keeping one, or letting it go, is entirely yours.

Analytics.

We use Vercel Analytics and Speed Insights to see which pages are read and how quickly they load. These measure the site, not the visitor: no cookie is set for them and no individual is identified.

What you can ask for.

Under the GDPR you can ask what we hold about you, ask for it to be corrected, ask for it to be deleted, ask for a copy, or object to our holding it at all. These apply to what the contact form holds — the one surface where we know who you are. Ask through the contact form, or reply to any message from us, and we will answer within the same two working days we promise everything else. A symbolon record cannot be reached this way, for the reason given above.

If you think we have handled your information badly, you can complain to the Office of the Commissioner for Personal Data Protection in Cyprus.