Privacy, withoutthe corporate fog.

We operate on a simple principle: collect only what is required to do the work you asked for, secure the systems that hold it, never sell it, and give you a direct human point of contact at dpo@bytheproject.com.

• What we collect: Contact inquiries, Shop and Event checkout fulfillment details, Client Preview access activity, project materials you send us, repair bench intake notes, limited event-photo delivery records, and standard technical/security telemetry.
• Why we collect it: To reply to you, deliver custom websites, hosting, AI/ML consulting, or hardware repairs, fulfill shop and workshop orders, protect limited-access material, and defend our systems against abuse.
• Where it lives: Studio content, commerce catalog records, and contact submissions are managed by Studio by theProject. Payment card processing is handled directly by Stripe.
• How to reach us: Email dpo@bytheproject.com with the subject “Privacy Request — theProject.”

This policy governs information processed by Project Relentless Design Studio, LLC, doing business as theProject., as well as our owned and operated cybersecurity and technical brand okayhacker (https://okayhacker.com), in connection with:

• The public website at https://bytheproject.com, including marketing, Services, Work, Shop, Events, Blog, Developer Documentation, Field Notes, Contact, and Legal pages
• Client Preview pages (/clients/[slug]) protected by a project-specific access code
• Shop product purchases, workshop registrations, and 1-on-1 consultation bookings processed through Stripe Checkout
• Personal computer/device repair bench intake and business IT contract services in Hellertown and the Lehigh Valley
• Existing private National Night Out photo-delivery links (/p/[token])
• Communications, briefs, and project materials you send directly to us

See also our Copyright & Brand Ownership Notice for intellectual-property rules covering Project Relentless Design Studio, LLC, theProject., and okayhacker.

03.1 / Contact and inquiry information

Our contact form collects your name, email address, optional topic/subject selection, and message. The inquiry is persisted in Studio by theProject. before transactional email notifications are attempted via Resend. Bot protection sends a verification token to Cloudflare Turnstile; Cloudflare does not receive your message body.

03.2 / Client and project information

You may provide briefs, goals, copy, credentials, brand assets, comments, or approvals during a project. Client Preview itself does not create a permanent customer account; access is controlled by a project-specific access code and a scoped, seven-day signed HTTP-only session cookie.

03.3 / Workshop, event, and 1-on-1 consultation inquiries

When you register for a workshop, book a 1-on-1 working session, or inquire about a custom class for your school, library, or business, we collect attendee names, contact information, scheduling preferences, and any voluntary accessibility or equipment notes needed to host the session.

When you purchase physical goods in our Shop or reserve a paid seat or consultation slot on our Events page, our server requests a checkout session from Studio by theProject. and redirects you to Stripe Checkout.

• Payment credentials: Credit card numbers, debit card numbers, Apple Pay / Google Pay tokens, and bank details are collected and processed directly by Stripe under PCI-DSS compliance. Project Redefine never receives, processes, or stores raw payment card numbers.
• Order & fulfillment records: After checkout, Stripe and Studio record your name, email, billing/shipping address (when physical shipping is required), purchased SKU/variant or event ticket, transaction amount, and payment status for fulfillment, accounting, and tax compliance.

When you bring a personal laptop, desktop, workstation, storage drive, or mobile device to our Hellertown repair bench—or engage us for on-demand or monthly business IT support—we handle your hardware and systems under strict professional boundaries:

• Intake & diagnostic records: We record your contact details, device serial/model identifiers, reported symptoms, diagnostic findings, and parts/labor quotes.
• Minimum-necessary file access: Technicians access operating-system state, logs, or file structures strictly to perform the requested repair, OS recovery, malware cleanup, or data migration. We do not browse, copy, or inspect personal photos, documents, or correspondence unrelated to the work order.
• Temporary recovery images: If you ask us to recover or transfer data from a failing drive, any temporary staging copy held on encrypted bench storage is securely wiped once you confirm receipt of your recovered files (or after the agreed holding window).
• Business IT credentials: Administrative credentials, network diagrams, and workstation inventory shared under a B2B support contract are stored in encrypted credential vaults and accessed only by authorized studio personnel performing contracted work.

When the site loads, hosting, security, and analytics systems may process IP-derived location, device and browser details, referring page, requested URL, timestamps, performance metrics, and error diagnostics.

Client Preview processes a stable HMAC-hashed requester identifier (never storing your raw IP in the preview analytics record), access attempts, and view events for rate limiting and project feedback. Private National Night Out photo delivery records views, downloads, expiry, and removal status without exposing the bearer token to third-party analytics.

• Responding to inquiries and delivering web design, hosting, AI/ML consulting, and computer/IT repair services
• Fulfilling Shop orders, workshop tickets, and 1-on-1 consultation bookings
• Providing and securing Client Preview and private event-photo delivery
• Sending transactional messages related to an inquiry, order, repair ticket, or active project
• Detecting abuse, researching security threats, troubleshooting failures, and improving site performance
• Meeting legal, tax, accounting, safety, and recordkeeping obligations

Our own first-party operational measurements record public page paths, standard page-speed metrics, coarse referrer hostnames, campaign labels, foreground time and bounded scroll milestones. We also record allowlisted service, repair, consultation, phone/email and contact-form actions. Form completion is observed only after a successful response; names, contact details and message contents are not included in these measurements. A random, first-party, secure session cookie expires after 30 minutes. A separate random visitor cookie lasts at most 30 days to recognize an anonymous browser profile, not a verified person. Coarse device, browser and operating-system categories and approximate country/region may be recorded; full User-Agent headers are not retained. We do not collect raw IP addresses, full browser identifiers, private delivery paths, secret query strings or cross-device profiles through this system. Do Not Track and Global Privacy Control disable this collection. Raw observations expire after 30 days; deterministic aggregate metrics may be retained for 395 days. Synthetic verification is kept separate from visitor measurements.

Client Preview uses a secure, project-scoped HTTP-only session cookie after a valid access code is verified. Google Analytics (`gtag.js` / Google Tag Manager) and Vercel Analytics measure aggregate public-site usage when enabled.

Private National Night Out token routes (/p/[token]) and private Client Preview routes are excluded from public marketing analytics, use no-store cache controls, and are marked noindex. Sensitive query parameters are redacted before analytics events are dispatched.

During a 1-on-1 AI/ML readiness audit or custom automation engagement, any spreadsheets, sample documents, or workflow descriptions you share with us are treated as confidential client material. We never use client project data to train public foundational AI models. When a scoped workflow integrates an external model or API provider, the written project scope specifies the provider, data retention/zero-retention settings, and security boundaries before deployment.

Do not enter confidential, regulated, or sensitive personal information into any public educational demo or unencrypted general comment field.

Project information is used internally and with carefully selected infrastructure providers only as needed to perform the agreed work. Client Preview is a presentation and approval surface; it is not a general customer portal, cloud drive, or multi-tenant user-account product.

Public editorial media, Client Preview artwork, and National Night Out photos are managed through controlled Studio media storage. This website does not provide anonymous public file uploads or open file-sharing buckets.

National Night Out private delivery uses bearer-style QR links. Treat a private link as sensitive. Expired, invalid, removed, or unavailable links all return the same neutral unavailable response without leaking storage metadata.

Our community programming and introductory workshops may involve students and families. A parent, guardian, school, library, or authorized organization must manage registration and provide any required information for a minor. Children should not independently submit personal information through the website.

We share limited information only with infrastructure and service providers required to operate the studio and deliver requested work:

• Vercel for web hosting, edge delivery, and aggregate performance analytics
• Studio by theProject. (`studio.bytheproject.com`) and its configured database/media storage for CMS content, commerce catalog, Client Preview, and inquiry persistence
• Stripe for payment processing on Shop and Event checkouts
• Resend for transactional email delivery
• Cloudflare Turnstile for bot and spam verification on public forms
• Google Analytics for public-route traffic measurement
• Law enforcement, courts, or advisers when legally required or necessary to investigate and prosecute malicious or unlawful activity

We do not sell personal information as a product, rent contact lists, or run third-party behavioral advertising pixels on this website.

We retain inquiries, order records, repair tickets, project records, access logs, and media only as long as reasonably needed for the purpose collected, security, contractual commitments, backups, tax/accounting rules, dispute resolution, and legal obligations.

We use technical and organizational controls appropriate to the sensitivity of the data involved, including HTTPS/TLS everywhere, server-only service tokens, HMAC-signed Client Preview cookies, strict Content Security Policy (CSP) headers, rate limiting, fail-closed private routes, and least-privilege administrative access.

Our studio and affiliated cybersecurity brand okayhacker (https://okayhacker.com) conduct cybersecurity research and security-conscious development. We take the security and integrity of our networks, endpoints, client previews, private media tokens, and client systems seriously.

• Active research & forensic logging: Any unauthorized access attempts, vulnerability scanning, token or access-code enumeration, automated spam, payload injection, scraping, denial-of-service activity, or fraudulent transactions directed at our infrastructure can and will be actively researched, traced, and forensically recorded.
• Law-enforcement referral & prosecution: When we detect illegal actions, spam campaigns, or cyber attacks, we preserve all associated network logs, IP addresses, headers, cryptographic fingerprints, and payloads and work with federal, state, and international law-enforcement agencies, cybercrime task forces, and upstream network providers to enforce our rights, seek civil and criminal remedies, and support full investigation and prosecution.
• Exemption from deletion requests: Logs and indicators generated by malicious, abusive, fraudulent, or unlawful activity are retained for security defense and evidentiary purposes and are exempt from consumer privacy deletion requests to the fullest extent permitted by law.
• Good-faith security disclosure: If you are a security researcher acting in good faith and believe you have discovered a vulnerability without violating user privacy or disrupting service, contact dpo@bytheproject.com before public disclosure.

We are based in Hellertown, Pennsylvania, United States. If you access the site from outside the United States, your information may be processed in the United States and other jurisdictions where our infrastructure providers operate under applicable legal safeguards.

Depending on your jurisdiction, you may request access to, correction of, deletion of, or a copy of the personal information we hold about you, or object to certain processing. Send requests to dpo@bytheproject.com. We verify the identity and authority of the requester before acting on any data request.

Residents of U.S. states with comprehensive privacy laws may exercise applicable statutory rights through dpo@bytheproject.com. We do not discriminate against anyone for exercising a valid privacy right and do not sell personal information or share it for cross-context behavioral advertising.

Where GDPR, UK GDPR, or the Swiss FADP apply, our processing relies on performance of a contract (or pre-contractual steps at your request), legitimate interests (operating and securing our studio and services), legal obligations, or your consent. You may lodge a complaint with your local supervisory authority after contacting us.

Because we do not sell personal information or run cross-site behavioral advertising networks, browser Do Not Track (DNT) and Global Privacy Control (GPC) signals do not need to alter our baseline no-sale posture.

Links and embedded experiences from third-party platforms (such as GitHub, Stripe Checkout, or linked client websites) are governed by those organizations’ own terms and privacy policies.

We update this policy as our services, security practices, or legal obligations evolve. The revision date in the masthead identifies the current version in effect.

For privacy requests, data questions, or coordinated security disclosures, email dpo@bytheproject.com or reach us through our contact page.

Project Relentless Design Studio, LLC (d/b/a theProject. & okayhacker)
Hellertown, Pennsylvania, United States