Privacy Policy.

We use the information we collect to:

• Respond to inquiries and provide requested services;
• Schedule and manage consultations and engagements;
• Send communications you have requested, and occasional updates about Not A Dev (you may opt out at any time — see Section 7);
• Operate, maintain, and improve the Site and our services;
• Comply with legal obligations and protect our rights and the rights of others;
• Analyze usage patterns to understand how visitors interact with the Site (analytics data only, processed in aggregate where possible).

We do not use your information for automated decision-making that produces legal or similarly significant effects.

Privacy law in the European Economic Area, United Kingdom, and similar jurisdictions requires us to identify the legal reason — called a "lawful basis" — for each type of data processing we perform. This section explains those bases in plain terms. If you are located outside these jurisdictions, we apply the same standards as a matter of practice.

When you contact us or submit a form, you are already providing a basis. Sending us your name, email, or inquiry is itself an act that establishes the legal grounds for us to respond — we are not required to ask for separate permission to reply to your own message.

We rely on the following bases:

• Contract performance — When you reach out about a service, submit a booking request, or otherwise initiate contact, processing your information to respond is necessary to potentially enter into or perform a contract with you. This is the primary basis for handling the data in your inquiry or form submission. No separate consent is needed — your act of reaching out establishes this basis.
• Legitimate interests — We have a genuine business interest in understanding how visitors use the Site (via aggregate analytics), following up on inquiries in a timely way, and maintaining records of client interactions. We rely on this basis only where our interests are not overridden by your privacy rights — for a small advisory practice with no data resale or advertising business, this standard is comfortably met.
• Consent — We rely on consent only for optional activities that go beyond what you would reasonably expect from a contact interaction: analytics cookies that track your behavior across the Site, and marketing emails if you subscribe to updates. Consent is freely given, specific, and can be withdrawn at any time without affecting the lawfulness of processing before withdrawal. Withdrawing consent does not affect our ability to respond to an inquiry you have already submitted.
• Legal obligation — In limited circumstances we may be required to process or retain certain data to comply with applicable law, such as tax record-keeping or responding to a lawful subpoena.

In practical terms: if you fill out our contact form, we process your data under contract performance and legitimate interests. If you accept analytics cookies, we process that data under consent. If you later withdraw cookie consent, we stop — but we can still process your earlier inquiry data.

We use the following categories of cookies and similar technologies:

• Strictly necessary cookies — required for the Site to function. These cannot be disabled.
• Analytics cookies — help us understand how visitors use the Site (e.g., a web analytics service). These are only set with your consent.
• Functionality cookies — remember your preferences (e.g., language settings). Set only with your consent.

When you first visit the Site, a cookie consent banner will ask for your preferences. You can accept all cookies, accept only strictly necessary cookies, or adjust your choices at any time by clicking "Cookie Preferences" in the site footer. You may also control cookies through your browser settings; disabling certain cookies may affect Site functionality.

We do not sell your personal information. We may share information in the following circumstances:

• Service providers — companies that help us operate the Site and our business (such as web hosting, email delivery, scheduling, and analytics providers), bound by obligations to protect your information and use it only as directed;
• Legal requirements — when required by law, subpoena, court order, or other legal process, or to protect the rights, safety, or property of Not A Dev or others;
• Business transfers — in connection with a merger, acquisition, reorganization, or sale of assets, in which case we will notify you as required by applicable law;
• With your consent — in any other circumstance where you have given us permission.

We require all third parties to respect the security of your personal information and to treat it in accordance with the law.

We retain personal information only as long as necessary for the purposes described in this Policy, to comply with legal obligations, resolve disputes, and enforce our agreements. When information is no longer needed, we delete or anonymize it. Analytics data is retained for no longer than 14 months, consistent with standard analytics provider defaults, after which it is aggregated or deleted.

Depending on your location, you may have the following rights regarding your personal information:

• Access — request a copy of the personal information we hold about you;
• Correction — request that we correct inaccurate or incomplete information;
• Deletion — request that we delete your personal information, subject to certain exceptions;
• Restriction — request that we restrict how we use your information;
• Portability — receive your information in a structured, machine-readable format (where applicable);
• Objection — object to processing based on legitimate interests;
• Withdraw consent — withdraw consent for consent-based processing at any time, without affecting the lawfulness of prior processing;
• Marketing opt-out — unsubscribe from marketing emails at any time via the unsubscribe link in the email or by contacting us.

To exercise any of these rights, contact us at info@notadev.ai. We will respond within the timeframe required by applicable law (typically 30–45 days). We may need to verify your identity before processing your request. You also have the right to lodge a complaint with a supervisory authority in your jurisdiction.

We do not sell personal information for monetary consideration. However, some state laws (including the California Consumer Privacy Act / CPRA and similar state statutes) define "sharing" broadly to include sharing data with analytics or advertising partners for cross-context behavioral advertising, even without payment.

If you are a California resident or a resident of another state with similar rights, you may opt out of the sharing of your personal information for such purposes by:

• Using the "Cookie Preferences" link in the footer to disable analytics and non-essential cookies;
• Contacting us at info@notadev.ai with the subject line "Do Not Share My Personal Information."

We do not discriminate against users who exercise these rights.

We implement commercially reasonable technical and organizational safeguards to protect your personal information against unauthorized access, disclosure, alteration, and destruction. These include access controls, encrypted transmission (HTTPS), and vendor security reviews.

However, no method of internet transmission or electronic storage is completely secure, and we cannot guarantee absolute security.

In the event of a data breach that affects your personal information and triggers notification requirements under applicable law, we will notify affected individuals and relevant authorities within the timeframes required by law. Maryland residents are covered by the Maryland Personal Information Protection Act (MPIPA).

The Site may contain links to third-party websites and tools that we do not own or control, including social media platforms and referenced resources. This Policy does not apply to those sites. We encourage you to review the privacy practices of any third-party site before providing personal information.

The Site is not directed to children under the age of 13, or the applicable minimum age in your jurisdiction. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, please contact us at info@notadev.ai and we will take steps to delete it.

Not A Dev is committed to making this Policy and the Site accessible to all users, including those with disabilities. If you experience barriers accessing this content or need this Policy in an alternative format, please contact us at info@notadev.ai and we will make reasonable accommodations.

We may update this Policy from time to time to reflect changes in our practices, technology, or applicable law. The "Last Updated" date at the top of this page reflects the most recent revision. For material changes, we will provide additional notice (such as a prominent notice on the Site or, where we have your contact information, direct notification) before the change takes effect.

Your continued use of the Site after the effective date of a revised Policy constitutes your acceptance of the changes.