Privacy Policy

What This Policy Covers. This Policy applies to personal data we collect: (a) through the Website; (b) through our conversational or chat interface; (c) through direct communication channels including email and WhatsApp; (d) in the course of negotiating, entering into, and performing client engagements; and (e) through our billing, invoicing, and payment processes.

What This Policy Does Not Cover. This Policy does not apply to:

Our Role. In respect of the data described in Section 1.1, we act as the data controller (or "business" under United States state privacy legislation). In respect of the data described in Section 1.2.1, we act as a data processor (or "service provider").

Sensitive Personal Data. We do not seek, and ask that you do not provide, special category or sensitive personal data — including data revealing health, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, sexual orientation, or criminal records. Where such data is provided unsolicited, we will delete it promptly unless retention is required by law.

Legitimate Interests Assessment. Where we rely on legitimate interests, those interests are: operating and growing a lawful professional services business; securing our systems and preventing fraud; recovering amounts properly due to us; defending ourselves against claims; and understanding how our Website is used in order to improve it. We have assessed in each case that these interests are not overridden by your rights and freedoms. You may object to such processing as described in Section 10.

No Automated Decision-Making. We do not carry out automated decision-making producing legal or similarly significant effects concerning you, nor do we engage in profiling for such purposes.

No Sale of Personal Data. We do not sell personal data, and we have not sold personal data in the preceding twelve (12) months. We do not share personal data for cross-context behavioral advertising in a manner constituting a "sale" or "share" under the California Consumer Privacy Act as amended, except to the extent that the operation of third-party advertising cookies may be construed as such, in which case you may exercise the opt-out right described in Section 11.

No Processing of Children's Data. Our Services are directed exclusively at businesses and at adults. We do not knowingly collect personal data from any person under sixteen (16) years of age. If we become aware that we have collected such data, we will delete it without undue delay. If you believe a child has provided us with personal data, please contact us using the details in Section 15.

Chat Interface on Our Website. Our Website may make available a conversational or chat interface for the purpose of answering questions about our Services and qualifying inquiries.

What We Collect Through It. We may collect and retain the content of your messages, the timestamps of the conversation, and associated technical data as described in Section 2.2.

Third-Party Model Providers. Where the interface uses an artificial intelligence model, the content of your messages may be transmitted to a third-party model provider for the sole purpose of generating a response. Such providers process the data under their own terms and privacy policies, and we select providers that contractually commit not to use business API inputs to train their models. Transmission may involve transfer to servers located outside your country of residence, including in the United States.

DO NOT SUBMIT SENSITIVE INFORMATION. Please do not submit through the chat interface any password, credential, API key, payment card number, bank account detail, government identification number, health information, or confidential material belonging to you or to a third party. The chat interface is not a secure channel for such information.

Outputs Are Not Binding. Responses generated by the interface are informational only. They do not constitute a binding offer, quotation, representation, warranty, or professional advice, and do not bind the Company, as set out in Section 14.4 of the Terms of Service.

AI Tools in Our Production Workflow. We use artificial intelligence tools internally as part of our production workflow, including for code generation, code review, content structuring, and quality assurance. Where client material is processed through such tools, we use enterprise or business-tier services that contractually exclude the use of inputs for model training, and we remain bound by the confidentiality obligations in Section 15 of the Terms of Service.

We Do Not Disclose Personal Data To: data brokers, list rental services, or any third party for the purpose of that party's own independent marketing.

Public Blockchain Disclosure. Where you elect to settle an invoice using digital assets, you acknowledge that the transaction — including the sending address, receiving address, amount, asset, and timestamp — is recorded on a public, permanent, and immutable distributed ledger that is visible to anyone worldwide. This record is outside our control and cannot be deleted, amended, or erased by us or by any other party. Any right of erasure you may hold under applicable law cannot be exercised in respect of on-chain data.

Cross-Border Processing. We are established in the United States and operate internationally. The provision of our Services necessarily involves the transfer, storage, and processing of personal data in multiple jurisdictions, including jurisdictions outside your country of residence and outside the European Economic Area and the United Kingdom.

Transfer Safeguards. Where we transfer personal data from the European Economic Area, the United Kingdom, or any other jurisdiction imposing transfer restrictions, we implement appropriate safeguards, which may include: (a) the European Commission's Standard Contractual Clauses, together with the UK International Data Transfer Addendum where applicable; (b) an adequacy decision of the relevant authority; (c) reliance on a derogation permitted by applicable law, including where the transfer is necessary for the performance of a contract with you; or (d) equivalent contractual protections with our sub-processors.

Acknowledgment of Risk. You acknowledge that the legal frameworks governing data protection and government access to data differ between jurisdictions, and may not offer protections equivalent to those available in your own jurisdiction.

Copy of Safeguards. You may request further information about the specific safeguards applied to transfers of your personal data by contacting us using the details in Section 15.

What Cookies Are. Cookies are small text files placed on your device by a website. We may also use similar technologies including local storage, pixels, tags, and software development kits.

Consent. Where required by applicable law, including in the European Economic Area and the United Kingdom, we place non-essential cookies only after obtaining your consent through our cookie banner. Consent is not bundled: you may accept some categories and reject others, and rejecting is as easy as accepting.

Withdrawing Consent. You may withdraw or modify your cookie consent at any time through the cookie preference control available on the Website. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Browser Controls. You may also configure your browser to block or delete cookies. Note that blocking strictly necessary cookies may impair the functioning of the Website.

Do Not Track and Global Privacy Control. Our Website does not currently respond to browser "Do Not Track" signals, as no uniform standard has been adopted. We do, however, honor the Global Privacy Control (GPC) signal as a valid opt-out of sale and sharing where applicable law so requires.

Retention Principle. We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, to comply with our legal and regulatory obligations, to resolve disputes, and to enforce our agreements.

Deletion and Anonymization. At the end of the applicable retention period, we delete personal data or irreversibly anonymize it so that it can no longer be associated with any individual.

Backups. Data may persist in routine encrypted backup and archival systems for a limited period following deletion from active systems. Such data remains subject to this Privacy Policy and is deleted in the ordinary course of backup rotation.

On-Chain Data. As set out in Section 5.3, data recorded on a public blockchain cannot be deleted and is retained permanently by the network, outside our control.

Our Measures. We implement commercially reasonable technical and organizational measures designed to protect personal data against unauthorized access, disclosure, alteration, loss, and destruction. These include: encryption of data in transit using industry-standard transport layer security; access controls on a least-privilege and need-to-know basis; multi-factor authentication on administrative accounts; credential management practices; confidentiality obligations imposed on all personnel and subcontractors; and periodic review of our security practices.

NO ABSOLUTE GUARANTEE. NO METHOD OF ELECTRONIC TRANSMISSION OR STORAGE IS ENTIRELY SECURE. WHILE WE APPLY REASONABLE SAFEGUARDS, WE CANNOT AND DO NOT GUARANTEE THE ABSOLUTE SECURITY OF ANY PERSONAL DATA, AND ANY TRANSMISSION IS AT YOUR OWN RISK.

Your Responsibilities. You are responsible for maintaining the confidentiality of any credentials you hold, for securing the email account through which you correspond with us, and for promptly notifying us of any suspected compromise.

Breach Notification. In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority and, where required by applicable law, affected individuals, without undue delay and in accordance with applicable statutory timeframes.

Post-Handover Security. Following handover of any deliverable, the security, patching, monitoring, credential management, and access control of that deliverable and its hosting environment are the exclusive responsibility of the client, as set out in Section 16.8 of the Terms of Service.

Available Rights. Where the EU or UK General Data Protection Regulation applies to our processing of your personal data, you hold the following rights:

How to Exercise. Submit your request to the email address in Section 15, stating clearly which right you wish to exercise and providing sufficient information for us to identify you and locate the relevant data.

Verification. We may request additional information to verify your identity before acting on a request. This is a security measure to ensure personal data is not disclosed to any person who has no right to receive it.

Timeframe. We will respond within one (1) month of receipt of a valid request. This period may be extended by up to two (2) further months where the request is complex or where we have received multiple requests, in which case we will inform you of the extension and the reasons for it within the initial month.

Cost. Requests are handled free of charge. Where a request is manifestly unfounded, excessive, or repetitive, we may charge a reasonable administrative fee or decline to act, stating our reasons.

Applicability. This Section applies to residents of California, Virginia, Colorado, Connecticut, Utah, Texas, and other states that have enacted comprehensive consumer privacy legislation, to the extent such legislation applies to us.

Rights. Subject to verification and to statutory exceptions, you may have the right to: (a) know the categories and specific pieces of personal information we have collected about you, the categories of sources, the business purposes for collection, and the categories of third parties to whom it is disclosed; (b) request deletion of personal information we have collected from you; (c) request correction of inaccurate personal information; (d) opt out of the sale or sharing of personal information and of targeted advertising; (e) limit the use and disclosure of sensitive personal information; and (f) not be subjected to unlawful discrimination for exercising any of these rights.

Non-Discrimination. We will not deny you Services, charge you a different price, provide a different level or quality of Service, or suggest that we will do any of these things, because you exercised a privacy right.

Sale and Sharing. As stated in Section 3.14, we do not sell personal information. To the extent that the operation of third-party advertising cookies may constitute a "sale" or "share," you may opt out through our cookie preference control or by transmitting a Global Privacy Control signal.

Authorized Agents. You may designate an authorized agent to submit a request on your behalf. We will require written proof of authorization and may require you to verify your own identity directly.

Appeals. Where we decline to act on your request and the law of your state provides an appeal mechanism, you may appeal our decision by writing to the address in Section 15 with the subject line "Privacy Request Appeal." We will respond to the appeal within the statutory period and, if the appeal is denied, will provide information about how to contact your state Attorney General.

Shine the Light. California residents may request information regarding our disclosure of personal information to third parties for those parties' direct marketing purposes. We do not make such disclosures.

External Links. The Website may contain links to third-party websites, platforms, and resources. We do not control, and are not responsible for, the privacy practices, content, or security of any such third party.

Independent Policies. Each third-party service maintains its own privacy policy, which governs your interaction with it. We encourage you to review those policies before providing personal data to any third party.

No Endorsement. The inclusion of any link or reference does not constitute endorsement, certification, partnership, or affiliation.

Right to Amend. We may update this Privacy Policy from time to time to reflect changes in our practices, our technology, applicable law, or regulatory guidance.

Notification. We will post the updated Policy on the Website with a revised "Last Updated" date. Where changes are material, we will provide more prominent notice, which may include a notice on the Website or a direct communication to active clients.

Effective Date of Changes. Changes take effect upon publication. Your continued use of the Website or continued engagement of our Services following publication constitutes acceptance of the updated Policy.

Review. We encourage you to review this Policy periodically.

Contact Details. For any question, request, or complaint relating to this Privacy Policy or to our processing of personal data:

Response. We aim to acknowledge all privacy correspondence within five (5) business days and to resolve it within the timeframes set out in Sections 10.4 and 11.6.

Escalation. If you are dissatisfied with our response, you retain the right to lodge a complaint with your competent supervisory authority or state Attorney General, as applicable. We would, however, appreciate the opportunity to address your concerns directly in the first instance.

Language. This Privacy Policy is drafted in the English language. Any translation is provided for convenience only. IN THE EVENT OF ANY DISCREPANCY, INCONSISTENCY, OR CONFLICT BETWEEN THE ENGLISH VERSION AND ANY TRANSLATION, THE ENGLISH VERSION SHALL PREVAIL.

Relationship to the Terms of Service. This Privacy Policy forms an integral part of our Terms of Service. In the event of conflict between this Policy and the Terms of Service on a matter of data protection, this Policy shall prevail in respect of that matter. All other matters are governed by the Terms of Service, including the governing law and dispute resolution provisions in Section 25 thereof.

Mandatory Local Law. Nothing in this Policy limits any right you hold under mandatory data protection law in your jurisdiction that cannot be derogated from by agreement.