What is kept, and what is not.

One submission makes one record. It holds your name, your email address and your message, which the form requires. It holds your organisation and how you found us, which it does not — leave either blank and nothing is stored in its place. If you followed a link from a case study, it holds which case study that was. It holds a status, moved by hand as the reply is written and followed up on, and the time it arrived.

The studio adds to the record as it answers: when it first replied to you; the notes it writes about the enquiry — how it was sorted, what was said on a call, anything else worth keeping — each dated, with who on the team wrote it, and never edited once written; and when it last made a working copy of the enquiry to plan the build from. A note is quoted in that copy only if the studio marks it to be, and then with your full name, your email address and any phone number taken out.

That is the whole of a written enquiry. The builder keeps more, and the next two sections are all of it.

When a page here loads, the server notes where the visit began, so it can be known which posts, links and pages bring people at all: the page you landed on, the page or site that sent you — its address only, never anything after a question mark — the name of the campaign if the link that brought you carried one, the service or case study a link was for, and which of this site’s links you came through. It notes nothing about your device or your network address, and a crawler’s or a link preview’s visit is not noted at all. Moving from page to page inside the site adds nothing.

If you open the builder, the same note carries on, so the parts people get stuck on can be found and made easier. The builder notes which steps you reach and which options you choose — never what you type, and never the wording of an answer — the address the builder was opened at, which link on this site you pressed to get there, and whether the screen is a phone’s, a tablet’s or a computer’s. It notes when the visit started and when it last did anything.

All of it is held against a random number made for the visit — by the server as the page loads, or by the builder itself — which the page keeps in its memory and forgets when it closes. There is no cookie in it, no network address and no name. If your browser sends Global Privacy Control, none of it is recorded at all, and every page works exactly the same.

If you send what you built, this note of how you got there is kept with it, as part of the enquiry. If you do not, it is deleted twelve months after it was last used. Once it is sent, the same note goes on recording which of the later questions you answer or put off on your project's pages, when you are signed in to the account that sent it — never what you answer, and never a note you leave.

Nothing you type leaves your browser until you send: what you pick is held there as a draft, and clearing it clears it. Sending writes the record the form writes, plus the scope itself — the answers you gave, the selection as it was priced, and the document that came out of it — and the note of how you used the builder, from the section above. The scope gets its own unguessable link, which is the only way to open it. If you gave a WhatsApp number so the reply could come back there, it is stored with the enquiry and used for that.

Sending also opens an account, because the scope has a page you keep and that page has to know you. The account holds your name, your email address and your password — stored as a hash, which is not the password and cannot be turned back into it — and the sessions you are signed in on, each with the browser and the network address it was opened from. A session is deleted once it has expired. The enquiry carries a link to that account. There is no sign-up form on this site: an account exists because a scope was sent, and for no other reason.

Anything you add to the project afterwards — a site you like, an answer you would rather give later — is kept on the same scope, with a line saying what changed and when. Each question also keeps whether it was answered or put off, when, and whether that was done by the account that sent the scope or through the project's link — never who else, and nothing more about them. A note you leave under a question is kept with it as you wrote it, read by the studio, and carried into the brief written from your scope. All of it goes when the scope does.

Five messages can be sent to you: a copy of what you sent — for a new account it carries the link that confirms your address — a new confirmation link if you ask for one, a code to sign in when you sign in on a browser this site does not remember, a link to set a new password — only if you ask for one — and a note that your password was changed once a new one is set, so a change you did not make is never a surprise. They come from hello@opinternational.dev and are carried by Resend, a mail service, from its servers in northern Virginia in the United States. When one cannot be carried, it is not dropped. The message is written down for the studio exactly as you would have received it, subject, wording and link, and someone sends it by hand. A confirmation link stops working seventy-two hours after it is made, a password-reset link two hours after, and a sign-in code ten minutes after it is sent, whichever way they travel, and each is deleted once it has. A written-down message stays on that list until it is marked dealt with and removed by hand.

Each message the site tries to send is also counted, so a day’s mail stays inside what the mail service allows: a line with its kind, the project it is about, whether it went, and when — never the address or a word of the message. Erasing a project takes it off those lines, and what is left is a count.

The server keeps a log of the requests it answers — the time, the page asked for, and whether it worked — so the site can be kept running and a fault can be found. Your network address is cut to its first three parts before it is written, whichever kind of address it is, which names a neighbourhood of an internet provider and never one connection. Nothing else your browser sends is kept — not which browser it is, not its language, not the port the request came from. The part of a private link that opens a scope or resets a password is blanked out before the line is written. The log is deleted after thirty days.

No page reads your location, your contacts, or anything another site has stored in your browser, and nothing is used to recognise your device from one visit to the next. The currency the builder first shows prices in is a guess from your browser’s language setting, made for that page and not kept.

Your full network address is kept in one place, and it is about signing in, never about reading: a session you are signed in on keeps the browser and the network address it was opened from, which is what lets you see where you are signed in and end it. When a password is wrong — at either sign-in, or when a scope is sent for an address that already has a project — that failure is counted for a quarter of an hour so a password cannot be guessed at by machine; asking for a new-password link or a new confirmation link is counted the same way, and so is each change kept through a project's own link, and each account opened from one network address. What is counted is a one-way hash of the address, the account, the network address or the link, never any of them, and the count is deleted within half an hour — or, for the email address it was tried against, the moment the right password arrives. One count is kept longer: correcting an address that is not confirmed yet is counted for a day, three to an account and to a network address, because each correction sends your project to the new address.

Nothing is sent to anyone else. The form posts to this site and nowhere else: no analytics service, no tracking pixel, no advertising, no external scripts. Even the typefaces are served from here rather than fetched from a font network, which is a performance decision that happens to have the same effect.

Two values, both in the browser’s own storage rather than in a cookie. One remembers whether you chose light or dark in the header: it is written when you use the toggle and read once before the page paints, so the theme does not flash, and it is never sent anywhere. The other is the builder’s draft — what you have picked so far, so you can come back to it. It never holds a password, it leaves the browser only when you send, it is cleared the moment you send or start over, and it is kept for thirty days.

Four cookies, and none is set by reading. Sending a scope signs you in, and a session cookie is what keeps you signed in on your own project page, for thirty days from signing in or until you sign out; the studio's own sign-in sets the same kind for the administration area. When you sign in on a browser this site does not remember, a second cookie holds that sign-in for the ten minutes it waits for the code it emailed you, and once the code is right a third remembers the browser for thirty days, so the code is not asked there again. The fourth is set by the page the form and the builder are on, and holds one thing — the moment the page was drawn — so that a submission arriving faster than a person could type can be handed back. None of them says anything about you, and only this site's server can read them.

The form carries a field that is off-screen, hidden from assistive technology, unreachable by keyboard and refused by password managers. Anything that fills it is not a person. That submission is dropped and nothing about it is stored — not the message, not the address, nothing. It is shown the ordinary confirmation, so an automated sender learns nothing from the answer.

The form also measures how long it took. Something that arrives faster than a form can be filled in is refused and handed straight back with everything you wrote intact, so pressing the button again sends it. A real enquiry is never discarded on timing alone.

On one server that OPI rents from Amazon Web Services, in northern Virginia in the United States, in the database that runs on it. Nothing described here is kept anywhere else, except the working copy of an enquiry the studio makes to plan a build from, which leaves out your full name, your email address and any phone number — and the studio's own message about a new enquiry, which then sits in the studio's inbox. Mail to hello@opinternational.dev, that message included, is passed on by Cloudflare to an inbox the studio keeps with Google, and so is anything you write to that address yourself. The working copy is kept on the studio's own computer and in a private repository on GitHub, for as long as the work it plans goes on, and the studio plans from it with an AI assistant — Claude, made by Anthropic — which reads it there. Before a new version of the site goes live, a copy of that database is taken on the same server, so the site can be put back if the new version fails; a copy is deleted thirty days after it is taken.

So a reply can be written and followed up on. That is the entire purpose, and the shape of the record is the proof of it — every field is something a reply needs.

It is not sold, not shared, and not used to mail anyone unprompted. What is sent to you automatically is the five messages named above and nothing else: your own copy, which carries the confirmation of your address, a new confirmation link if you ask for one, a code to sign in on a browser this site does not remember, a reset link you asked for, and a note that your password was changed. The studio is sent one message of its own when an enquiry or a scope arrives, so it knows to open the record: your name and organisation, and for a scope its summary — a custom build's is the sentence you wrote — the kind of build, its price as sent and anything in it the studio reads in person first. Any email address or phone number is taken out of all of it, and it never carries the message or the note you wrote. When it cannot be carried, it waits on the same list as any other. There is no newsletter and no sequence. Every reply about the work itself was written by a person answering what you sent.

Use the form. It is the channel that exists — there is no separate address published for this, and one is not invented on this page. Say what you want: a copy of what is stored under your name, a correction to it, or the record removed — the account, the scopes sent from it and the enquiries behind them, all of it. Your address is asked for because that is how the answer gets back to you.

An enquiry that never becomes a project is deleted twenty-four months after anything last happened on it — the enquiry, the scopes sent from it, the studio's notes on it, the builder sessions behind it, and your account if nothing else of yours is in it. Once a scope is agreed it is a project, and its records are kept as the business's own accounts require. Asking removes yours sooner — all of it, at once, the studio's own message about it included. These have an end too, and the server carries it out on a timer rather than waiting for anyone to remember: the log after thirty days, a copy of the database thirty days after it was taken, a builder session that never became an enquiry twelve months after it was last used, the counts kept against guessing within half an hour, and a signed-in session or a mailed link once it has expired.

The standard this is held to is the General Privacy Principles in section 6 of Trinidad and Tobago’s Data Protection Act, 2011. If you think something here is not done the way this page says, say that through the same form, and you will get an answer.

Ask through the form