Legal
Privacy
What this site collects, why, how long it is kept, and how to have it removed. Short, because the site does very little.
The short version.
- No analytics, no advertising, no tracking pixels, no third-party scripts.
- No cookies are set for visitors. A theme preference is stored in your own browser and never sent to us.
- If you sign in to a course, we keep your email address and your course progress, and set one cookie that keeps you signed in. You can delete the account yourself at any time.
- If you use the contact form, we keep what you typed so we can reply.
- If you write a review, we publish it with the name you give once a person has read it. Your email address is never shown.
- If you use the assistant, your questions go to Cloudflare Workers AI to write the answer, and nobody stores them.
- Your IP address is never stored in readable form — only as a salted hash, used for rate limiting.
- Email legal@pontelon.com and we will delete your records.
Who we are
Pontelon LLC operates pontelon.com. For anything on this page, write to legal@pontelon.com.
What we collect
When you just read the site
Nothing that identifies you is collected or stored by us. The public pages are static files served from Cloudflare's edge network. They load no analytics, no advertising, no social widgets and no third-party scripts, and they set no cookies.
Typefaces are served from this domain rather than from a font CDN. That is deliberate: a hosted font means a third party receives your IP address and the address of the page you are reading, on every page load, for a file. Ours are in /fonts/ on this site.
If you choose a light or dark theme, that choice is written to localStorage in your own browser. It is not a cookie, it is never transmitted, and we cannot read it.
Cloudflare, as our hosting provider, processes request logs — including IP addresses — in order to route and protect traffic. That processing is theirs and is described in their documentation; we do not receive those logs and cannot query them.
When you use the contact form
We store exactly these fields, and nothing else about you:
| Field | Why |
|---|---|
| Name | To address you correctly in a reply. |
| Email address | To reply. This is the only way we can. |
| Organization (optional) | Context. Leave it blank and nothing breaks. |
| Message | What you wanted to tell us. |
| Browser user-agent string | Distinguishing real submissions from automated ones. |
| A salted hash of your IP address | Rate limiting and abuse triage. The address itself is never written down. The hash is one-way, salted with a secret we hold, and cannot be reversed into an address or matched against one from elsewhere. |
We do not enrich this with anything bought or looked up elsewhere, and we do not build a profile from it.
When you write a review
We store the name and the optional role or company you give, what the review is about, your rating, what you wrote, your email address, and the same user-agent string and salted IP hash as the contact form, for the same reasons.
Nothing is published until one of our staff has read it. If it is approved, the name, role or company, rating, subject, text and date appear publicly on /reviews. Your email address, IP hash and user-agent string are never published. We keep your email so we can check a review with you, and so you can ask us to remove it.
We publish a review because you ticked the box asking us to. You can withdraw that at any time by writing to legal@pontelon.com, and we will take it down and delete it.
When you sign in to a course
Module 1 of every course is open to anyone and stores nothing. To go further you sign in, and then we keep:
- Your email address, to send you sign-in links and to know which progress is yours.
- Your progress: which lessons you have opened and passed, your best score on each, and when.
- Your answers to each lesson's questions, each time you check them, so you can see your last attempt and we can see which questions are unclear.
There is no password. We email you a one-time link through Resend; it works once and expires in 15 minutes. Signing in sets one cookie, __Host-pl_learn, which keeps you signed in for up to 30 days. It is a random value, readable only by this site, and is used for nothing else. We store only a scrambled (hashed) copy of it and of each link.
You can sign out, or delete your account and everything above, from your courses page at any time; deletion is immediate. Our staff can see learners' email addresses and progress in the admin panel. We do not send learners marketing email.
When you use the assistant
The assistant sends your question, the last few messages of the conversation and passages from this site's own pages to Cloudflare Workers AI, which runs the model that writes the reply. We do not store your questions, the conversation or the answers. Cloudflare states that it does not use this content to train models.
The conversation is kept in sessionStorage in your own browser, so it survives moving between pages. It is deleted when you close the tab or press Clear, and it leaves your browser only with your next question.
To stop the assistant being abused, we count questions against the same salted hash of your IP address the contact form uses, and keep a daily total of how much the assistant has been used. Neither record contains anything you typed.
Answers are written by AI and can be wrong. Do not type passwords, confidential information or personal data about other people into it.
What we do with it
Read it and reply to it. Inquiries go to an admin panel only our staff can reach, behind single sign-on. They are not sent to a CRM, a mailing list, an advertising platform or a lead-scoring service.
So that we know to look, we may email our own inbox a short notice when an inquiry arrives. It carries your name and organization and a link to the admin panel — not your message and not your email address — and it is sent through Resend.
We do not sell personal information, and we do not share it for advertising. We have no advertising relationships to share it into.
If a conversation turns into an engagement, your details are kept as ordinary business records for as long as that relationship and our record-keeping obligations require.
Who else touches it
Three processors, each necessary for something the site does:
- Cloudflare, Inc. — hosting, edge delivery, the database this site stores inquiries, reviews and course progress in, the AI model behind the assistant, and the access control in front of our admin panel.
- Resend, Inc. — delivers the short notice to our own inbox when an inquiry arrives, and course sign-in links to learners.
- Google LLC — hosts the mailbox behind our @pontelon.com addresses, where email you send us is received and answered.
We may also disclose information where the law requires it. We have not been asked to date.
How long we keep it
Inquiries are kept while they are useful — typically no more than 24 months — and are deleted when they are not, or sooner if you ask. A published review stays up until you ask us to remove it; one we do not publish is kept no longer than an inquiry would be. A course account is kept until you delete it, and is removed in routine clean-up once it has gone 24 months without a sign-in. Sign-in links stop working after 15 minutes and are cleared out in the same clean-up. Rate-limiting records expire within days, and assistant conversations are not kept at all. Nothing on this site has an indefinite retention period.
Your choices
Wherever you live, we will do the following on request, at no cost:
- Tell you what we hold about you.
- Send you a copy.
- Correct it.
- Delete it.
Email legal@pontelon.com. We will reply within 30 days, and usually within two working days. We do not require you to fill in a form or create an account to ask.
If you are in the UK or the EEA, our lawful basis for handling contact form submissions is legitimate interest — responding to somebody who asked us to. For a course account it is providing the course you signed in to take. For a published review it is your consent, which you can withdraw at any time. You may object, and you may complain to your supervisory authority. If you are in California, the rights above are the ones the CCPA describes; we do not sell or share personal information as that law defines those terms, so there is nothing to opt out of.
Security
Everything is served over HTTPS with HSTS. The admin panel stores no passwords and issues no sessions of its own — identity is verified per request from a single sign-on token, so there is no credential in our database to leak. Administrative actions are written to an append-only audit log. How to report a security problem is on the Security page.
Children
This site is for business use and is not directed at children. We do not knowingly collect information from anyone under 16.
Changes
If this policy changes in a way that affects you, the date at the top changes. We keep every previous version and will send any of them to whoever asks. We will not quietly rewrite it.