Privacy Policy
What we collect, why we collect it, and the control you have over it.
Effective Date: October 4, 2026 | Last Updated: October 8, 2026
Introduction
AW3 Technology, Inc., a Delaware corporation ("AW3," "we," "us," or "our"), runs this website and the studio behind it. This policy explains what we collect, why, how long we keep it, and what you can make us do about it. It is written to meet the EU and UK General Data Protection Regulation (GDPR), the ePrivacy Directive, and the California Consumer Privacy Act (CCPA/CPRA).
For visitors in the European Economic Area and the United Kingdom, AW3 Technology, Inc. is the data controller for the processing described here.
Contact for privacy matters: will.schulz@aw3.tech (put "Privacy request" in the subject line)
1. What We Collect
1.1 What you give us
We only have what you type into a form or send us directly:
- Contact form (
/contact): your name, email address, company (optional), the nature of your enquiry, and your message. - Founder, investor and advisor intake forms: your name, email address, phone number, company, country, and your answers to the questions in the form — which may include details about your company, your project, your role, and, for the investor form, your investor status.
- Email, calls and scheduled meetings: whatever you choose to tell us. Meetings booked through our scheduling link are handled by Calendly, which collects the details you enter there under its own privacy policy.
We do not ask for and do not want special-category data (health, race, religion, political views, biometrics, sexual orientation), government identifiers, or payment card numbers through this website. Please do not send them through these forms.
1.2 What is collected automatically
- Server and platform logs. Our host records the usual request data, including IP address, user agent, requested URL and timestamp, for security, abuse prevention and debugging. These are standard hosting logs, kept short-term, and are not used to build a profile of you.
- Analytics — only with your consent. If you allow analytics, we record page views in our own database: the path you visited, the site that linked you, your coarse device type, browser and country, and how long the page was open and how far down it you read. Vercel Web Analytics and Speed Insights also record page views and loading performance. Nothing is stored in your browser — no cookie, no local storage. A visitor identifier is derived by hashing request data, including your IP address, which is never itself stored; that hash is rebuilt from scratch every day, so it cannot be reversed to identify you and cannot be followed from one day to the next. We use it to count pages and visits, not to build a profile of you.
- Chat — only with your consent. If you allow chat support, the AngelSend widget loads and stores a visitor ID in your browser so a conversation holds together across pages. Anything you type into the chat goes to AngelSend as our processor.
- Embedded content — only with your consent, or one click. The office map on the contact page is served by Google, and the newsletter sign-up box on the home page by Substack. Until you load them, nothing is requested from either, and your IP address is not shared with them.
- Newsletter. If you subscribe, your email address goes to Substack, which runs our newsletter and handles subscriptions under its own terms and privacy policy. Without embedded content allowed, the home page's sign-up form sends nothing until you submit it, and then takes you to Substack to confirm.
1.3 What we do not do
We do not buy personal data, we do not sell or share personal data (including as "sale" or "sharing" is defined under the CCPA/CPRA), we run no advertising or marketing trackers, and we do not use your data to train AI models. Our fonts are self-hosted, so loading a page makes no request to any font provider.
2. Why We Process It, and on What Legal Basis
| What | Why | Legal basis (GDPR Art. 6) |
|---|---|---|
| Contact and intake form submissions | To read your enquiry, assess a possible engagement, and reply | Art. 6(1)(b) steps taken at your request before a contract; Art. 6(1)(f) legitimate interest in handling enquiries |
| Ongoing correspondence with clients, founders and investors | To run the engagement | Art. 6(1)(b) performance of a contract |
| Server logs, rate limiting, abuse prevention | To keep the site up and safe | Art. 6(1)(f) legitimate interest in the security of our service |
| Analytics and performance measurement, including reading time and scroll depth | To see which pages are worth keeping and how fast they load | Art. 6(1)(a) consent |
| Chat support widget | So you can talk to us without leaving the page | Art. 6(1)(a) consent |
| Embedded third-party content (map, newsletter sign-up) | To show where the studio is, and let you subscribe without leaving the page | Art. 6(1)(a) consent |
| Studio admin sign-in | To let staff into the content admin | Art. 6(1)(f) legitimate interest in securing our own systems |
| Keeping records to defend or bring legal claims | Because we may have to | Art. 6(1)(f) legitimate interest; Art. 6(1)(c) where the law requires it |
Where processing rests on consent, you can withdraw it at any time — see Section 5 — and withdrawing does not affect anything we lawfully did beforehand.
3. Who Receives It
We do not sell your personal information. We share it only with the processors and partners below, each under a contract that limits them to our instructions:
| Recipient | Role | Where |
|---|---|---|
| Vercel Inc. | Website hosting, serverless functions, request logs, image storage; Web Analytics and Speed Insights (consent only) | United States, global edge |
| Neon Inc. | Managed PostgreSQL database holding form submissions, site content and our own analytics counts | United States (AWS us-east-1) |
| AngelSend | Chat widget and chat transcripts (consent only) | United States |
| Google LLC | Map embed on the contact page (consent or one-click load only) | United States |
| Substack Inc. | Newsletter sign-up embed (consent or one-click load only) and newsletter subscriptions | United States |
| Calendly LLC | Scheduling, if you book a call | United States |
| Resend | Transactional email — studio admin sign-in links | United States |
We may also disclose information where we are legally required to, where it is needed to establish, exercise or defend legal claims, or as part of a merger, acquisition or sale of assets — in which case we will tell you before your data becomes subject to a different policy.
4. Cookies and Device Storage
We use as little as the site can function with.
Strictly necessary — always on, no consent required (ePrivacy Art. 5(3)):aw3_consent— stores your own cookie choices for six months, so we do not ask again on every page.aw3_session— only ever set for signed-in studio staff using the content admin. It is HTTP-only, SameSite=Lax, and expires after 30 days.
- Analytics (our own measurement, plus Vercel Web Analytics and Speed Insights): nothing at all is stored on your device — no cookie, no local storage. The visitor hash is computed on the server and rebuilt daily.
- Chat support (AngelSend): a lasting visitor ID in your browser's local storage.
- Embedded content (Google Maps, Substack): whatever the provider sets once you load its frame, plus your IP address.
On your first visit, nothing optional runs. Accepting and refusing are each a single click, nothing is pre-ticked, and refusing costs you no functionality other than the feature you refused. You can reopen the choice at any time via Cookie settings in the site footer; when you withdraw a consent we clear the device storage that vendor left behind and reload the page so its code stops running.
Because we run no advertising trackers and nothing optional loads without consent, we do not currently respond to browser "Do Not Track" or Global Privacy Control signals; a GPC signal would have nothing to opt out of, as we do not sell or share personal data.
5. Your Rights
If you are in the EEA or UK, you have the right to:
- Access — get a copy of the personal data we hold about you.
- Rectification — have inaccurate or incomplete data corrected.
- Erasure — have your data deleted, where no overriding obligation or legal claim requires us to keep it.
- Restriction — have us pause processing while a dispute about it is resolved.
- Portability — receive the data you gave us in a structured, machine-readable format.
- Object — object to processing based on legitimate interests, including profiling (we do not profile).
- Withdraw consent — at any time, via Cookie settings in the footer, with no detriment.
- Not be subject to automated decision-making — we do not make decisions about you by automated means.
How to exercise them: email will.schulz@aw3.tech. We will reply within one month, as GDPR Art. 12(3) requires, and will tell you if we need an extension for a complex request. We may ask for enough information to be confident you are who you say you are — no more than that. Exercising a right is free unless a request is manifestly unfounded or excessive.
Complaints: you can lodge a complaint with your national data protection supervisory authority — in the UK, the Information Commissioner's Office (ico.org.uk); in the EEA, the authority in your country of residence or workplace. We would appreciate the chance to resolve it first.
6. How Long We Keep It
| Data | Retention |
|---|---|
| Contact enquiries that do not lead to an engagement | 24 months from the last contact, then deleted |
| Intake form submissions that do not lead to an engagement | 24 months from submission, then deleted |
| Records relating to an active or past engagement | For the engagement, then up to 7 years, for tax, accounting and limitation-period reasons |
| Chat transcripts | Per AngelSend's retention; we keep only what we copy into the enquiry record |
| Analytics | Page-view rows carrying a daily, non-reversible visitor hash: 14 months, then deleted. No IP address, and no identifier that outlives the day it was made |
| Server and security logs | Short-term, as retained by our hosting provider |
| Studio admin accounts and sessions | While the person has access; sessions expire after 30 days and expired ones are deleted automatically |
| Your cookie choice | 6 months, after which we ask again |
You can ask us to delete your data sooner, and we will unless we are required to keep it.
7. International Transfers
We are based in the United States and our processors are mainly US-based, so personal data from the EEA or UK is transferred to the United States. Those transfers rely on the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum where applicable), together with the technical measures described in Section 8, or on a processor's certification under the EU-US Data Privacy Framework where it has one. You can ask us for details of the safeguards for any specific transfer.
EU and UK representative. AW3 Technology, Inc. has no establishment in the EEA or the UK. Where GDPR Art. 27 requires a representative for processing of this kind, we will appoint one and name them here. In the meantime, send any question or request directly to will.schulz@aw3.tech, which we monitor and which reaches the people who can act on it.
8. Security
Traffic is encrypted in transit with TLS. The database is managed, access-controlled and encrypted at rest. Admin access is limited to an allowlist of studio staff, uses single-use sign-in links rather than passwords, and sessions are stored server-side so access can be revoked. Admin session tokens and sign-in links are only ever stored as hashes. We apply the response headers appropriate for a site of this kind and keep dependencies current.
If you believe you have found a vulnerability, email will.schulz@aw3.tech with "Security" in the subject line; we will not pursue good-faith research that gives us reasonable time to fix the issue.
No system is perfectly secure. If a breach affects your personal data and is likely to present a risk, we will notify the relevant supervisory authority within 72 hours as GDPR Art. 33 requires, and notify you directly where Art. 34 requires it.
9. Children
This site is aimed at founders, operators and investors. It is not directed to children, and we do not knowingly collect personal data from anyone under 18. If you believe a child has sent us personal data, write to will.schulz@aw3.tech and we will delete it.
10. California Privacy Rights (CCPA/CPRA)
This section is our notice at collection for California residents, and applies in addition to the rest of this policy.
Categories we collect, using the CCPA's own labels:
| Category (Cal. Civ. Code § 1798.140(v)) | What, specifically | Source | Why | Disclosed to |
|---|---|---|---|---|
| Identifiers | Name, email, phone, IP address | You; automatically | To answer you, run an engagement, keep the site secure | Hosting, database and email providers |
| Customer records (§ 1798.80(e)) | Company, role, signature on an agreement | You | To run an engagement | Hosting, database and email providers |
| Commercial information | Services enquired about, engagement history | You; generated by us | To assess and run an engagement | Hosting and database providers |
| Internet or network activity | Page views, reading time, scroll depth, performance timings, referring page, browser and device type | Automatically, with your consent | To see what is worth keeping and how fast it loads | Database and analytics providers |
| Geolocation | Coarse, country-level, inferred from IP | Automatically | Security, and aggregate analytics | Hosting and analytics providers |
| Professional or employment information | Your role, firm, fund, mandate, investor type | You | To assess a possible engagement | Hosting and database providers |
| Inferences | None. We draw no inferences and build no profiles. | — | — | — |
Sensitive personal information. We do not collect sensitive personal information as the CPRA defines it, and we have nothing to limit. Our forms do not ask for government identifiers, precise geolocation, account credentials, racial or ethnic origin, religious or philosophical beliefs, union membership, health, sex life or sexual orientation, genetic or biometric data, or the contents of your mail, email or texts other than what you choose to write to us. Please do not send any of it.
We do not sell or share personal information, as "sell" and "share" are defined by the CCPA/CPRA, and we have not in the preceding twelve months. We do not knowingly sell or share the personal information of anyone under 16. We use no cross-context behavioural advertising.
Your California rights: to know what we collect, use and disclose; to access a copy; to correct inaccurate information; to delete; to opt out of sale or sharing (there is nothing to opt out of); to limit the use of sensitive personal information (we collect none); and not to be discriminated or retaliated against for exercising any of them. We will not deny you a service, charge you a different price or give you a lesser quality of service because you exercised a right.
Making a request: email will.schulz@aw3.tech. You may use an authorised agent, who must provide written permission signed by you, and we may still contact you to confirm it. We will verify your identity in proportion to the sensitivity of what you are asking for — usually by confirming control of the email address we hold. We respond within 45 days and may extend once by a further 45 days, telling you why.
Appeals: if we refuse a request, you can appeal by replying to our decision or emailing will.schulz@aw3.tech with "Appeal" in the subject line. We will review and respond in writing within 45 days, with our reasons. If we deny the appeal you may contact the California Attorney General.
11. Other US State Privacy Rights
If you live in a US state with a comprehensive consumer privacy law — including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Minnesota, Maryland, Tennessee, Indiana, Kentucky and Rhode Island — you have broadly the same rights set out in Sections 5 and 10: to confirm whether we process your data and access it, to correct it, to delete it, to obtain a portable copy, and to opt out of targeted advertising, sale, and profiling with legal or similarly significant effects.
We do none of those last three. We do not sell personal data, we run no targeted advertising, and we do not profile anyone.
Exercise any of these rights at will.schulz@aw3.tech. We respond within 45 days and may extend once where the law allows. You may appeal a refusal using the process in Section 10; several of these laws require us to offer one, and we offer it to everyone. If we deny your appeal, you may complain to your state Attorney General.
Where a state requires us to honour an opt-out preference signal such as Global Privacy Control, we do. As explained in Section 4, a signal reaches us with nothing to act on, because we neither sell nor share data nor advertise.
12. Third-Party Links
Pages here link out to other sites — portfolio companies, our scheduling tool, social accounts. This policy does not cover them, and we do not control what they collect. Read their policies before handing them anything.
13. Changes
We will post any update here and move the "Last Updated" date. If a change materially affects how we use data you have already given us, we will take reasonable steps to tell you directly, and where the change needs consent we will ask again.
14. Contact Us
AW3 Technology, Inc. 1 Ferry Building, Ste 201, San Francisco, CA 94111, United States
Privacy enquiries and data subject requests: will.schulz@aw3.tech — please put "Privacy request" in the subject line so we can route it quickly and start the response clock.
General contact: aw3.tech/contact