The contact form
When you submit the contact form, it sends your name, your email address and what you wrote in the project brief — plus, only if you fill them in, which service you're interested in and your current website.
If you arrive from the health-check tool's "Send me this report" link, the form also shows a summary of that scan: the site address, its score and the issues it found. That summary travels to the form inside the page link itself — nothing is stored. It's only sent if you leave it attached; you can remove it before sending.
That information is sent directly to my email inbox via Resend (an email delivery service). It is not stored in a database. It is not logged anywhere beyond what Resend's transactional email infrastructure handles in transit. I read it and reply to it — that's the entire data flow.
Your email address is used only to reply to you. It is not added to any mailing list, shared with any third party, or used for any purpose beyond the conversation you initiated.
The form also has a honeypot field (invisible to you, visible to bots) and rate limiting to prevent abuse. These produce no stored data.