Privacy Policy

At Ship Thesis Studio (“Ship Thesis”, “we”, “us”, or “our”), we recognize that startup founders and engineering teams share sensitive strategic plans, architectural designs, and proprietary concepts with us. We protect this trust through four institutional commitments:

• Data Minimization: We collect only the information strictly necessary to evaluate project feasibility, schedule discovery meetings, and engineer your application.
• Strict Confidentiality: Unreleased founder ideas, design wireframes, financial projections, and database structures are treated as privileged confidential material.
• Client Sovereignty: You retain complete ownership and control over your customer data, repository access, and production infrastructure.
• Transparent Processing: No hidden background telemetry, cross-site trackers, or surprise third-party integrations.

We collect and process personal data across distinct operational categories:

A. Information You Voluntarily Provide

• Discovery Call Scheduling: When booking a discovery call via our Cal.com integration, you submit your name, corporate email address, time zone, target platform (iOS, Android, Web), and notes regarding your product concept.
• Inquiries & Scoping Questionnaires: When reaching out via our contact form or direct email, we collect your name, email, company entity, and written project parameters.
• Project & Technical Assets: During active Discovery Sprints and MVP builds, Client may provide access to user journey wireframes, Figma designs, technical requirement documents, API documentation, and staging credentials.
• Invoicing & Billing Records: For statutory accounting and contract execution, we collect legal entity names, billing addresses, tax registration identifiers (e.g., GSTIN or VAT numbers where applicable), and payment contact details. Payment card credentials are tokenized directly by our PCI-compliant payment gateways and are never accessible to our servers.

B. Technical & Operational Information

• Standard Server Diagnostics: Like virtually all websites, our infrastructure automatically logs basic HTTP request headers (IP address, browser user-agent, referring URL, timestamp) solely to monitor server health, diagnose 404 errors, and mitigate DDoS attacks.
• Zero Invasive Profiling: We do not deploy fingerprinting scripts, behavioral trackers, or third-party marketing beacons (such as Meta Pixel, Google Ads remarketing, or LinkedIn Insight tags).

We process personal and project data strictly for legitimate business and contract performance purposes:

• Contract Performance: Delivering Discovery Sprints, designing user interfaces, writing clean source code, conducting automated testing, and deploying mobile builds to Client accounts.
• Direct Communication: Conducting scheduled video discovery calls, delivering weekly interactive sprint builds, and providing ongoing engineering updates via email or Slack.
• Financial Administration: Generating fixed-quote milestone invoices, processing receipts, and maintaining records in compliance with corporate taxation statutes.
• Security & Legal Compliance: Safeguarding our systems against fraudulent activities, protecting intellectual property rights, and fulfilling regulatory obligations.

As an engineering studio building AI-powered mobile apps and SaaS products, we adhere to strict AI governance:

• Zero Training on Client IP: We contractually configure all enterprise developer tooling (e.g., GitHub Copilot Enterprise, OpenAI API, Anthropic API) with zero-data-retention (ZDR) and no-training flags enabled.
• No Public Cloud Leakage: Client proprietary assets are isolated within dedicated repository workspaces and never contributed to open repositories without explicit authorization.

We engage industry-standard, SOC 2 and ISO 27001 audited service providers to facilitate infrastructure operations:

• Cal.com: Powers discovery meeting scheduling and calendar synchronization.
• Vercel Inc.: High-availability edge hosting, global CDN, and frontend serverless deployment.
• GitHub Inc. (Microsoft): Secure private source code version control, CI/CD automated test pipelines, and issue tracking.
• Stripe Inc. & Razorpay Software: Secure electronic invoice billing and payment processing under PCI-DSS Level 1 compliance.
• Resend Inc. & Google Workspace: Transactional notification delivery, discovery confirmations, and encrypted client correspondence.

Each subprocessor is bound by rigorous Data Processing Agreements (DPAs) requiring adherence to international privacy and security standards.

We take code and credential security seriously. We enforce strict institutional engineering safeguards:

• Zero Hardcoded Secrets Policy: We strictly prohibit hardcoding API keys, database connection strings, or cloud tokens in source code. All runtime secrets are managed via encrypted environment variables or dedicated secret managers (e.g., Doppler, AWS Secrets Manager, 1Password Secrets).
• Least-Privilege Access: Access to Client Git repositories, Apple Developer teams, and cloud staging accounts is granted only to assigned project engineers and revoked immediately upon project offboarding.
• Encryption Standards: All website traffic is secured using TLS 1.3 encryption. Workstation drives are fully encrypted (FileVault / BitLocker) with mandatory hardware multi-factor authentication (MFA).
• Pre-Commit Git Auditing: Repositories employ pre-commit scanning tools to prevent accidental secret or credential leakage.

We retain personal data only for as long as required to accomplish the legitimate business purposes outlined in this policy:

• Inquiries & Discovery Calls: Unconverted lead records and exploratory project notes are archived and permanently purged after twenty-four (24) months.
• Client Project Deliverables: Completed deliverables and documentation are retained during the active development period, 30-day warranty, and any subsequent Care retainer period.
• Financial Invoices & Accounting: Statutory financial records and milestone invoices are retained for seven (7) years in accordance with tax and corporate governance laws.
• Credential Offboarding: Client credentials and temporary administrative access tokens are securely purged within seven (7) business days of final project sign-off.

This section provides disclosures required under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), and extends to residents of Virginia, Colorado, Connecticut, Utah, and other US states with comprehensive privacy legislation:

• No Sale or Sharing: We do not sell personal information, nor do we share personal information for cross-context behavioral advertising. We have not sold or shared any personal information in the preceding twelve (12) months.
• Right to Know / Access: You have the right to request disclosure of the specific pieces and categories of personal information we have collected about you.
• Right to Delete: You may request deletion of personal information collected from you, subject to legal and statutory recordkeeping exceptions.
• Right to Correct: You have the right to request correction of inaccurate personal information maintained by us.
• Non-Discrimination: We will never discriminate against you, alter service pricing, or deny services for exercising any of your statutory privacy rights.

To exercise your California or US privacy rights, email hello@shipthesis.com with the subject “CCPA Data Request.”

For visitors and clients situated in the European Economic Area (EEA), the United Kingdom, or Switzerland, processing of personal data is governed by the General Data Protection Regulation (GDPR) and UK Data Protection Act 2018:

• Lawful Bases: We process data based on: (a) performance of a contract to deliver software engineering; (b) our legitimate interests in operating and securing our studio; (c) compliance with legal obligations; and (d) your consent when voluntarily submitting inquiries.
• Data Subject Rights: You hold the right to access, rectify, erase, restrict processing, object to processing, and request data portability for your personal data.
• International Data Transfers: Where data is transferred internationally, we ensure appropriate safeguards including standard contractual clauses (SCCs) approved by the European Commission.
• Supervisory Authority: You have the right to lodge a complaint with your local data protection supervisory authority if you believe our processing violates applicable law.

We reject the modern surveillance web. Our website is engineered with a zero-tracking philosophy:

• No Third-Party Advertising Cookies: We do not place ad-retargeting cookies or tracking pixels on your machine.
• Essential Session Storage Only: We use only strictly necessary local storage items required to maintain user UI state or embed our Cal.com booking modal.
• No Cookie Banner Clutter: Because we do not run non-essential advertising or tracking cookies, we do not subject you to intrusive cookie consent modals.
• Do-Not-Track (DNT) Signals: Our website respects universal opt-out and Do-Not-Track signals transmitted by modern browsers.

The data controller responsible for personal data processed under this Privacy Policy is:

Ship Thesis Studio
Data Governance & Privacy Officer
Email: hello@shipthesis.com
Web: shipthesis.com

We respond to all verified privacy, data access, and deletion requests within thirty (30) business days without cost or penalty.