Privacy policy and GDPR information
This page explains how paul-okhrem.com handles visits and enquiries. Paul Okhrem is the site operator and data controller, based in Prague, Czech Republic. Contact paul@paul-okhrem.com about privacy or an enquiry. The site has no advertising trackers, analytics service or automatic marketing subscription.
What is collected when you send a brief?
The form asks for your name, work email, company, inquiry type and message. Role, budget and decision timing are optional. Do not include passwords, patient or customer records, confidential transaction documents or other sensitive information. A secure sharing process and an NDA can be agreed before detailed work.
On submission, the form also sends its page path and, when available, a referring hostname and short campaign labels. It excludes full referring URLs, search terms, query strings and fragments from those source fields. These labels help identify which pages and channels lead to enquiries. A missing source is recorded as unknown or direct, not assumed to be an AI referral.
Paul uses the submitted information to assess and answer your request and to take requested steps toward an engagement. Proportionate security and delivery measures protect that process. You are not added to a mailing list by sending a brief.
Optional answer about how you found Paul
The form includes an optional “How did you find Paul?” field. Your selected answer is stored with your brief. It helps Paul understand which channels lead to enquiries. You can leave it blank. It does not request a search term, conversation link or account identifier, and it does not enable browser tracking.
Role, inquiry type, budget and decision timing are also optional. Your name, work email, company and message are required to send the brief.
Optional source remembering in your browser tab
By default, no source record is written to browser storage. The form uses information available on the current page only when you submit it. An unchecked, optional box lets you remember the source from the point you opt in as you navigate within the tab.
If you choose this option, session storage holds the page path, referring hostname, permitted campaign labels and consent time. It does not hold your name, email, message, budget or assessment answers. The record expires when the tab's session ends, or after 24 hours, whichever comes first. Uncheck the box to remove it. If storage is blocked, the form still works.
Source information is not transmitted by the attribution script itself. It is included only with a submitted enquiry. This option does not enable analytics, advertising or cross-site tracking.
How a submitted enquiry reaches Paul
Your enquiry is saved to a restricted database before receipt is confirmed. A copy is sent to Paul through Telegram. If that notification is delayed, delivery is retried. Confirmation means the enquiry was saved, not that Paul has read it.
If the record cannot be safely stored, the site does not show success. A network interruption may leave receipt uncertain, so the form keeps your text and offers retry or direct email. Repeated identical submissions are checked for duplicates.
Delivered outbox records are deleted after 30 days under the current configuration. Undelivered records are retained for retry for up to 730 days, rather than being silently dropped after 30 days. Subsequent email correspondence and any agreed engagement records are handled separately for the relevant communication, contractual and legal needs. Contact Paul to request deletion or ask about a specific record.
Technical logs and abuse prevention
The server receives connection information needed to deliver the site. The enquiry API uses a short-lived, process-local hash of the connection address for rate limiting; the form payload does not include that address.
The dedicated site access log records operational details such as time, request method, host, path, status and user agent. It removes client and remote IP fields, forwarding-address headers, cookies, authorization headers and the referring URL before writing. Query values in the requested URL are replaced with a redacted marker.
The log is restricted to the service account, rotates daily or at 20 MiB, keeps no more than 10 rolled files and expires rolled files after 30 days. These controls concern this site's dedicated log; hosting and network providers may also process connection data to operate and secure their infrastructure.
Local tools and third-party services
The free AI readiness assessment calculates its result in your browser. It does not send or save your answers to the server. Its downloads and print option work without an email signup. The site does not currently provide emailed assessment reports, automated newsletters, a booking embed or a thank-you survey.
Telegram processes notification copies under its privacy policy. Direct email and later correspondence use the email providers involved. Hosting providers process site and lead-storage data for service operation. Provider processing locations and safeguards may differ; contact Paul for information relevant to your enquiry before sending sensitive material.
External profile, research and vendor links lead to sites with their own policies. No Google Analytics, Clarity, advertising pixel or similar third-party tracking script is enabled here.
Privacy requests and GDPR rights
Depending on the applicable law and circumstances, you may request access, correction, deletion, restriction or portability of your personal data and object to relevant processing. You may withdraw optional source-storage consent by unchecking the form option. You can also raise a concern with the relevant data-protection authority.
Email paul@paul-okhrem.com with the subject “Privacy request.” Describe the request without sending extra sensitive data. Paul may need proportionate information to verify identity before releasing or changing a record. Requests are handled under the applicable legal requirements.
The European Commission's guidance for individuals explains GDPR rights. This notice describes current site behavior; it is not a claim of independent compliance certification.
When this notice changes
This notice is updated when the site's data practices materially change. New analytics, booking, marketing or survey services must not be enabled on the assumption that this notice already covers them. Any necessary notice and consent changes must come first.