Privacy

Privacy policy

This site collects very little, and this page says exactly what.

Last updated 6 September 2026

In short

No cookies

This site sets no cookie of any kind.
No third-party tracking

No analytics service, no advertising, no embedded widgets. The only outside request is for the web fonts.
Anonymous usage statistics

A random identifier that lives in your tab and disappears when you close it. Your IP address is never stored — only your country.
Opt out with one switch

Turn on Do Not Track or Global Privacy Control and the site records nothing at all.
Your enquiry stays with us

The contact form writes to our own database. It is used to reply to you, and never sold, shared or added to a list.

What we collect, and why

Website usage

We record which pages are viewed, how far they are read, and whether the interactive demo is used, so that we can see what works on the site. This is anonymous: the identifier is random, lives only in your browser tab, and is gone when you close it. We cannot recognise you when you come back, and we cannot join two visits together.

We never store your IP address, your browser’s user-agent string, or anything you type. Your IP address is used once, at the edge, to derive a two-letter country code, and then discarded.

Our basis for this is our legitimate interest in understanding how the site is used. If you would rather not be counted, turn on Do Not Track or Global Privacy Control in your browser and nothing is recorded.

Your enquiry

The contact form asks for your name, your email address and your message. A phone number and a hospital or organisation are optional. A checkbox lets you mark the message as a request for pilot access.

We use what you send to reply to you and, for a pilot request, to judge whether a pilot at your site is realistic. It is written to our own database, not to a form service, and it is not sold, shared or added to a marketing list. Nothing is emailed onward automatically: a person reads it. Mail to [email protected] is delivered through Google Workspace, our mail provider.

Our basis for this is our legitimate interest in responding to you. We keep enquiries while we are dealing with them, and delete yours on request.

Your rights

Under UK GDPR you can exercise any of the following by writing to [email protected]. We respond within the statutory deadline.

Access: Ask what personal data we hold about you and get a copy.
Correction: Ask us to correct anything that is wrong or incomplete.
Deletion: Ask us to delete what we hold about you.
Objection: Object to our processing. For website statistics the opt-out is immediate: turn on Do Not Track or Global Privacy Control.

One limitation: we cannot find you in the website statistics, because nothing in them identifies you. A request about that data can only be answered with this page. Your enquiry email is different — that we can find, and delete. You can also complain to the Information Commissioner’s Office at ico.org.uk.

Who we are

The data controller is APEC International Ltd, registered in England and Wales, company number 14087239.

Registered office 84 Uxbridge Road, Suite 3, Second FloorEaling, London, EnglandW13 8RA

Questions about this page or your data: [email protected]. That address reaches a person.

Not yet published

The following will be added here once confirmed:

Our ICO registration number.
A retention period for website usage statistics. Rows are currently kept until one is set.
The data-centre region of the usage database.

The technical detail Every storage key, every event type, every limit — from the code that runs.

Browser storage

Keys this site can write to browser storage
Key	Where	What it holds	When written
apec.sid	sessionStorage	A random identifier for this tab, also used as the visitor identifier.	On your first page view, unless you have opted out.
apec-theme	localStorage	The word light or dark.	Only if you use the light/dark toggle.
apec.vid	localStorage	A persistent visitor identifier.	Never. The code that could write it is not called anywhere on this site.

Event types the endpoint accepts

This is the complete allow-list. Anything not on it is discarded before it reaches the database.

Every event type, when it fires, and what it carries
Event	Fires when	What it carries
page_view	A page loads	Page title, the hostname of the referring site, light or dark mode.
section_view	A section is 35% visible	The section's name.
scroll_depth	You first pass 25, 50, 75 or 100% of the page	Which threshold.
click	You click a link or labelled control	The element's label and the path it points to.
outbound_click	You click a link to another site	The element's label and the destination URL.
page_exit	The tab is hidden or closed	Engaged time and furthest scroll depth.
theme_toggle	You switch light/dark	Which one.
nav_open	You open the menu on a small screen	Nothing.
demo_view	The demo scrolls into view	The demo case identifier.
demo_point	You click on the demo vessel	Whether it landed on the vessel, first or second click, distance from the centreline.
demo_measure	A demo measurement completes	The measurement values in pixels and how long it took.
demo_reset	You reset the demo	The demo case identifier.
demo_case_change	Reserved	Not emitted by the current build.
demo_layer_toggle	Reserved	Not emitted by the current build.
form_start	You first touch the contact form	Whether the pilot box is ticked. No field value.
form_submit	A submission succeeds	Pilot or enquiry. No field value.
form_error	A submission fails	Pilot or enquiry, a reason code, the HTTP status. No field value.

Every stored row also carries

Time: Server clock when the batch arrives.
Path: The page path, no query string.
Session id: The random value from sessionStorage.
Country: Two letters, resolved by Cloudflare at the edge. The IP address itself is never written.
Device: Phone, tablet or desktop, from viewport width.
Viewport: Width and height in CSS pixels.
Time zone: The IANA name your browser reports.
Referrer: The origin you arrived from, never the full URL.

Limits at the edge

Batch: At most 50 events per request.
Body: Requests over 32 KB are rejected.
Rate: More than 400 events from one session in an hour are discarded.
Type: Any event type not on the list is dropped.

Where it goes

Events are batched in your tab and sent to /api/events on this domain, a Cloudflare Pages Function that writes one row per event into a Cloudflare D1 database. If the request fails, the events are dropped and nothing is retried.

Append ?debug=events to any URL on this site to watch every event it captures, live.

If this page and the code ever disagree, the code is what runs — tell us and we will correct the page. Changes are reflected here with a new date.