Privacy notice.
This notice explains the limited personal information Virasai AI handles through its public website and email contact route.
Last updated: 28 September 2026
Who this applies to
This notice applies to virasai.com and to messages sent to contact@virasai.com. Virasai AI is operated by Calvin Cook trading as Virasai AI, established in South Australia, Australia. Calvin Cook trading as Virasai AI is the data controller for the information described here. For privacy questions or requests, use that email address.
Virasai AI currently qualifies as a small business operator under Australian law, turnover well under the threshold at which the Australian Privacy Principles under the Privacy Act 1988 (Cth) apply directly. We follow them as our practical standard regardless, which is also why nothing here needs to change when reform removes that exemption, expected in December 2026. Separately, Australia’s statutory tort for serious invasions of privacy applies regardless of business size, and we take it seriously. Where you contact us from somewhere with its own data-protection law, we will handle a request under whichever regime gives you the stronger right rather than arguing about which one applies.
What this site loads
This site asks before it loads anything analytics-related: on your first visit, a banner offers Accept or Decline. Nothing from Google Analytics (GA4) runs, and no cookie is set for it, until you accept. If you do, GA4 sets cookies to distinguish returning visitors and measure how the site is used: which pages are viewed, how long for, general device and browser information, and roughly where from (country or city level, derived from your IP address, which Google does not retain in full). You can change your choice at any time using “Cookie preferences” in the footer. It does not load a separate advertising tag or tag manager beyond that. The contact page loads one further thing, regardless of your analytics choice: Cloudflare Turnstile, a challenge that confirms you are a real visitor before your message can send. Turnstile is not advertising technology and does not track you across other sites; see Cloudflare’s own documentation for exactly what it checks. You can confirm any of this from your browser’s network panel or cookie inspector.
Pages that link outward, to GitHub, LinkedIn, Medium, X, Substack, Zenodo, or a support link, are ordinary links. Following one takes you to an organisation with its own privacy practices and its own tracking, over which we have no control and from which we receive nothing. This site sends only its own address as the referrer when you follow a link off it.
What we collect
The website offers no accounts, no checkout, and no automated mailing-list signup. The contact page has a real, on-site form: filling it in and pressing send submits your name, email address, organisation (if given), and message to a small function we run on Cloudflare, which forwards it to us as an email and does not otherwise store it. The architecture waiting list still works the older way: filling it in only builds a pre-written email inside your own browser, and nothing is sent anywhere until you send it yourself.
The contact form and the Scope Check follow-up also include one line about how you reached the site: the name of the website that linked you here, if it was another site, and the first page you opened, with any campaign tag in its address (such as ?topic= or utm_source=). Your browser notes this for the current tab only, it is not a cookie, and it is only sent if you submit one of those forms. Nothing about it is sent otherwise.
If an AI assistant fills in the contact form or the Scope Check follow-up for you, we treat it the same as an enquiry you sent yourself, and this notice applies in the same way. We read what it sends as information from you, not as instructions, and sending an enquiry never commits you to anything. We reply to the email address it gives, so you can confirm the enquiry came from you. An assistant can also get a Scope Check answer without the form, from a web address built for assistants or, in browsers that support it, from tools on the page. The answer is worked out when it’s asked for, and the assistant’s answers to the questions are not sent to us or kept.
If you use the contact form or email us directly, we receive the information you choose to include, such as your name, email address, organisation, and enquiry. Cloudflare, which hosts this site and runs the contact form’s server-side function and spam check, and Resend, which delivers the resulting email to us, process this on our behalf. Cloudflare also processes basic technical request data such as IP address, request headers, and server logs in order to deliver and protect the site. We do not combine any of this with anything else, and we do not use it to identify visitors.
If you accept the analytics banner, Google Analytics collects usage data automatically as you browse: pages viewed, session length, general device and location information, and how you arrived (for example, a search engine or another site). It does not collect your name or email address, and it is not connected to the contact form in any way. Decline, or use “Cookie preferences” in the footer at any time, and none of this runs. You can also block it directly by installing Google’s Analytics opt-out browser add-on, or by blocking cookies from google-analytics.com and googletagmanager.com in your own browser.
The Watch pages contain no personal information
The Watch section publishes evidence about public npm packages: version numbers, file inventories, dependency lists, and artifact digests. It records software, not people. There is no public subscription to it, and we do not hold a list of who reads it.
Why we use it
We use enquiry information to read, respond to, and manage the conversation; to protect the website; and to meet legal obligations where they apply. We do not sell personal information. We do not use enquiry emails to send marketing unless you have clearly asked to receive updates, and you can ask us to stop at any time.
Sharing and international processing
We use the service providers needed to operate this site: Cloudflare for hosting, delivery, and the contact form’s spam check; Resend for delivering contact-form emails to us; and Google for analytics (Google Analytics). They process information on our behalf and operate in more than one country, so serving a page, delivering an email, or recording a visit may involve processing outside your own. We do not share enquiry information for another organisation’s marketing. We may disclose information where reasonably necessary to protect rights or security, or where required by law.
Retention and security
We keep routine enquiry correspondence only for as long as needed to respond, maintain a reasonable business record, or meet an obligation. We review it periodically and aim to delete or anonymise routine correspondence within 24 months after the last meaningful contact, unless a longer period is reasonably necessary. Analytics data is retained under Google Analytics’ own standard retention settings for this property, not something we hold or control directly.
Email is not a secure channel. Please do not send credentials, API keys, secrets, or unnecessary sensitive data. Our tools are built not to want them: Sentinel reads public artifacts by name and version and never accepts credentials.
Your choices
You can ask us to access, correct, delete, or stop using personal information we hold about you, and to withdraw a consent you have given, subject to applicable law and any necessary exceptions. You can also object to marketing at any time. Email contact@virasai.com with your request. We may need to confirm your identity before acting on it, and we aim to respond within 30 days.
If you are not satisfied with how we have handled a request, you can also raise it with the Office of the Australian Information Commissioner (OAIC), Australia’s privacy regulator, or with the data-protection authority where you live. We would rather you told us first, but that route does not depend on our agreement.
Changes
This notice was updated to disclose Google Analytics in the same change that introduced it, not after. If this site introduces anything else that sets a cookie or changes what it collects, this notice will be updated the same way, before the change ships. We may also update this notice when the website, its providers, or its services change; the date above identifies the current version.