How this website handles visitor data.
Last updated: July 31, 2026
This policy covers corveil.com — the marketing website you are reading right now. That includes our documentation at /docs and our pitch deck at /pitch, which are built separately from the main site and load a different set of third-party resources. Where they differ, this policy says so.
It does not describe the Corveil gateway product. Corveil is deployed inside your own environment or as managed SaaS, and the analytics described below are not part of it — the product does not load Google Analytics. For how the product handles customer data, including its subprocessors, see the Trust Center.
We use Google Analytics 4 to measure how this website is used.
The marketing pages of this site — including this one, the Trust Center, and the home and campaign pages — load Google Analytics 4 (measurement ID G-2MHZK8EQLN). We use it to understand which pages and campaigns are working. We do not sell visitor data.
Neither our documentation at /docs nor our pitch deck at /pitch loads Google Analytics. The documentation loads no external resources at all; the pitch deck loads the third-party resources described in the next section.
| What Is Sent | When | Data Processed |
|---|---|---|
| Page views | On each marketing page you open | The page viewed and your navigation within the site, the referring URL, approximate location derived from your IP address, and device/browser characteristics reported by your browser. |
| Form submissions | When you submit a form | An event recording that a submission happened (waitlist_signup, or contact_form_submit from the contact page) and which page or campaign it came from. Your email address is not sent to Google. |
Loading Google Analytics means your browser contacts Google-operated hosts. The following are permitted by this site’s Content Security Policy for analytics:
www.googletagmanager.comwww.google-analytics.comregion1.google-analytics.comanalytics.google.comwww.google.comstats.g.doubleclick.netOne of these, stats.g.doubleclick.net, belongs to Google’s advertising network rather than its measurement infrastructure. Your browser contacts it when Google Analytics’ advertising features are enabled on our property. The opt-out and blocking options below apply to it as they do to the rest.
Google processes this data as described in Google’s Privacy Policy. You can opt out of Google Analytics across all sites by installing the Google Analytics Opt-out Browser Add-on, or by blocking the hosts listed above with your browser or an extension. Blocking them does not affect your ability to use this website.
Requests your browser makes to other companies while loading this site.
Google Fonts. The marketing pages and the pitch deck at /pitch load a stylesheet from fonts.googleapis.com and font files from fonts.gstatic.com. Both are operated by Google and are separate from Google Analytics: they receive your IP address and browser user agent when the page loads, before you interact with anything, and blocking Analytics does not stop them. This data is handled under Google’s Privacy Policy. Our documentation at /docs serves its fonts from our own servers and makes no request to Google.
jsDelivr. Our pitch deck at /pitch loads its presentation framework from cdn.jsdelivr.net, a third-party content delivery network. Like Google Fonts, it receives your IP address and browser user agent when that page loads, before you interact with anything. This data is handled under jsDelivr’s Privacy Policy. No other page on this site loads it.
Video. Videos on this site are served from our own servers. We do not currently embed a third-party video player, so no video provider receives your data.
Links to other sites. Some pages link out to services we do not run — for example, our demo booking page is hosted by Google Calendar. Those sites receive your data only if you choose to follow the link, and their own privacy policies apply once you do.
What we store when you use a form on this site.
The contact and early-access forms on this site ask for your email address. When you submit one, we record the following:
| Data | Why We Collect It |
|---|---|
| Email address | To reply to you and to send a confirmation of your submission. |
| Which form you used | To know which page or campaign your message came from. |
| Submission time | To order and de-duplicate submissions. |
| IP address and browser user agent | To detect and rate-limit automated abuse of the form. These two fields are kept for abuse review only and are not included in exports of form submissions. |
Form submissions are handled on our behalf by Resend, which delivers email, and by our internal customer relationship management system, which records your submission so we can follow up. Resend sends two messages — your confirmation and a notification to our own team. Our customer relationship management system may in turn post a notification of your submission, including your email address, to our internal Slack workspace. Only your email address, which form you used, and the submission time are passed on to any of these — the IP address and user agent stay with us. We do not sell this information or share it with advertisers.
How long we keep it. Every form submission — from the contact page and from campaign pages alike — is stored together in a single file, and that includes the IP address and user agent described above. We do not currently delete these records on a fixed schedule: we keep them while we may still need to follow up with you. Nothing removes them automatically, so if you want your information deleted, ask us using the address below and we will delete it.
On the marketing pages, Google Analytics sets two cookies to distinguish visitors and sessions: _ga and _ga_2MHZK8EQLN, each with roughly a two-year expiry. Blocking Analytics or installing the opt-out add-on prevents further collection but does not delete cookies already stored in your browser — you can clear those through your browser settings. Google describes both in its Analytics cookie usage documentation. We set no advertising cookies of our own. The other third parties named above — Google Fonts and jsDelivr — only serve static assets and do not set cookies through this site.
This site also uses your browser’s local storage for two interface preferences. Neither contains information about you, neither is transmitted to us, and both can be cleared through your browser settings:
corveil_preview_pricing — on the marketing pages, controls whether an in-development page is shown to you.vitepress-theme-appearance — on the documentation pages at /docs, remembers whether you chose the light or dark theme.fonts.googleapis.com and fonts.gstatic.com separately; pages stay readable and fall back to your system fonts.cdn.jsdelivr.net, but unlike the font hosts it supplies the code that runs the deck, so /pitch will not display without it. Every other page on this site is unaffected.Questions about this policy, or requests to access or delete information we hold about you.
security@corveil.com