Privacy Policy
Last updated: 4 August 2026
This explains what we collect when you use codroon.com, why we collect it, how long we keep it, and who else can see it. We have tried to write it in plain English rather than in the usual legal register, because a policy nobody reads protects nobody.
If anything here is unclear, email privacy@codroon.com and we will answer.
Summary
Everything we collect, in one table
| What | Why | How long | Who else sees it |
|---|---|---|---|
| Estimator answers | To calculate and show your estimate | 24 months, then deleted | Supabase |
| Your email, if you give it | To send you your estimate | Kept as a business record | Supabase, Resend |
| Contact form details | To reply to you | Kept as a business record | Supabase, Resend |
| Booking details | To schedule a call | Per Calendly's policy | Calendly |
| Analytics data | To see which pages work | Per each provider's settings | Google, Microsoft, Mouseflow |
| Session recordings | To find where the site confuses people | Per each provider's settings | Microsoft, Mouseflow |
| Server and security logs | To keep the site up and safe | Short term | Vercel, Cloudflare |
Who we are
Codroon (Pvt) Ltd is a private limited company registered in Islamabad, Pakistan.
Your data is handled by people in Pakistan, and stored on servers in the United States and elsewhere depending on the provider. Wherever you are contacting us from, you are consenting to that transfer by using the site.
For any question about your data, email privacy@codroon.com.
The cost estimators
Our estimators at /tools/ai-agent-cost-calculator and /tools/mvp-cost-calculator save your answers as you go, so you can come back to an estimate or share it with someone else.
We save those answers anonymously. There is nothing personal attached unless you choose to give us an email address at the end. An estimate is identified only by a short code in its URL, which means anyone holding that link can see the estimate.
We keep anonymous estimates for 24 months and then delete them automatically. If you gave us an email address, the estimate and the contact details are kept as a business record, because that is a conversation we may need to refer back to.
Answers are stored in Supabase, a hosted database provider, on servers in the United States.
When you contact us
Our contact forms ask for some combination of your name, email address, phone number, and a description of what you are building. We use those to reply to you and, if it goes further, to scope the work.
If you book a call, that happens through Calendly, which handles the booking data under its own privacy policy. We see the name, email address, and any notes you enter.
We do not add you to a mailing list. We do not have a mailing list. If you give us your email to receive an estimate, you receive that estimate and nothing else.
Email is sent through Resend, which processes the address in order to deliver the message.
Analytics and session recording
We use four things to understand how the site is used.
Google Analytics tells us which pages people visit and roughly where they come from. Vercel Analytics measures page performance. Both are aggregate and neither identifies you personally.
Microsoft Clarity and Mouseflow are different, and worth explaining properly because most policies bury them. Both record sessions, meaning they capture a replay of mouse movement, scrolling, and clicks on the pages you visit. We use them to find where the site confuses people, which is a genuine problem to solve and also a genuine intrusion to disclose.
We configure both tools to mask text you type into forms, so your name, email address, phone number, and message are not captured in a recording. We do not review recordings looking for individuals, and we do not connect them to any contact details you give us.
Recordings and analytics data are held by those providers under their own policies. You can opt out of all four using the cookie controls on this site, or by using a browser extension that blocks them.
What we don't do
- We don't sell your data
- Not to anyone, in any form, including anonymised or aggregated. There is no arrangement under which anyone pays us for information about you.
- We don't run advertising or retargeting
- No Meta pixel, no Google Ads tag, no LinkedIn insight tag, no retargeting of any kind. If you visit this site you will not start seeing our adverts elsewhere.
- We don't have a marketing list
- Giving us your email to receive an estimate subscribes you to nothing. There is no newsletter and no drip sequence.
- We don't ask for more than we need
- The estimators work without an email address, and we say so on the page. Our forms ask for the minimum required to reply to you.
Who else processes your data
We use these providers. Each has its own privacy policy governing what it does with data it handles on our behalf.
| Provider | What it handles | Where |
|---|---|---|
| Vercel | Website hosting, performance analytics | United States |
| Cloudflare | Network security and traffic filtering | Global |
| Supabase | Estimate answers and contact submissions | United States |
| Resend | Sending email | United States |
| Calendly | Call bookings | United States |
| Google Analytics | Site analytics | Global |
| Microsoft Clarity | Session recording and heatmaps | Global |
| Mouseflow | Session recording and heatmaps | Global |
| Spaceship | Email hosting for our addresses | Varies |
Your rights
Whatever jurisdiction you are in, you can ask us to do any of the following and we will do it.
Tell you what data we hold about you. Correct anything that is wrong. Delete what we hold, unless we are required to keep it. Send you a copy of it in a usable format. Stop using it for anything you have not agreed to.
Email privacy@codroon.com and we will respond within 30 days. We will not ask you to justify the request.
For analytics and session recording specifically, you can opt out immediately using the cookie settings link in the footer, without emailing anyone.
How we protect it
The site runs over HTTPS. Our database uses row-level security, meaning the database itself enforces who can read what rather than trusting application code to get it right. Contact submissions cannot be read from the browser at all. Credentials are held in a managed secrets store rather than in code.
No system is perfectly secure and anyone claiming otherwise is overselling. If we became aware of a breach affecting your data, we would tell you.
Children
This site is aimed at businesses and is not intended for anyone under 16. We do not knowingly collect data from children. If you believe a child has given us information, email privacy@codroon.com and we will delete it.
Changes to this policy
If we change what we collect or how we use it, we will update this page and change the date at the top. Material changes will be noted at the top of the page for at least 30 days.
Contact
For anything in this policy, email privacy@codroon.com.
Codroon (Pvt) LtdIslamabad, Pakistan