HomePrivacy
What we collect, and what we don’t
This page covers two separate things, because they are governed differently: this website, and the platform an organization runs on. The short version is that the website measures how people use it and nothing else, and the platform sends nothing anywhere we have not listed.
Version 1.1 · 2 October 2026
This website
One analytics tool, no advertising, and a signal we honour
Microsoft Clarity
We use Microsoft Clarity to understand how people move through this site: pages visited, clicks, scrolling, and anonymized session replays of those interactions. It sets cookies in your browser and Microsoft processes the data under its own terms. It is the only analytics on this site.
We honour your browser’s opt-out. If your browser sends Global Privacy Control — the universal opt-out signal Colorado’s Privacy Act requires us to respect — or the older Do Not Track header, Clarity is never loaded and no recording starts. There is no banner to dismiss, because there is nothing to consent to once you have already said no.
No advertising, no tracking pixels
There are no advertising networks, no conversion pixels, no social trackers and no data brokers on this site. We do not sell personal information and we do not share it for cross-context behavioural advertising — under any definition, in any state.
If you ask for a walkthrough
The email address you type into the walkthrough field is passed to Calendly so it can prefill the booking form, and to us so we can reply. It is not added to a marketing list. If you email us instead, we hold that message and our reply.
Cookies
The cookies Microsoft Clarity sets, and nothing else. This site has no login, no advertising cookies and no cross-site identifiers. Blocking cookies for this domain costs you nothing on it.
The platform
For an organization deciding whether to trust us with its data
Almost always we are the processor and our customer is the controller: the organization decides what its assistant may answer from, what it keeps and for how long, and who may see what. The full document is linked below; this is what matters most in it.
Card and bank numbers never reach storage
Payment card numbers, Social Security numbers and bank routing numbers are removed from inbound text before it is stored, embedded, sent to a model, or written to an audit event — validated by checksum rather than guessed at. Only the redacted text is ever written.
No training on customer data
We do not train or fine-tune models on customer data, and we use model providers under API terms that exclude inputs from training. Which model provider answers for an organization is set by us, not by the organization.
A published list of who else touches it
Hosting, model providers, speech-to-text and email — each named, with which are optional. Nothing goes to a third party that is not on that list. A new category of subprocessor gets 30 days’ notice and the customer may object.
Retention the customer sets
Per channel, in days. When a period expires the content is replaced rather than the row deleted, so reporting does not change when conversations age out. Two things are never removed: the audit trail, because it is hash-chained and a rewrite would be detectable, and the customer’s own records replica.
Stated plainly: what we do not have
No SOC 2 or ISO 27001 report, and no completed third-party penetration test. Backups rely on our hosting provider’s managed database. We would rather you read that here than discover it in a security review.
Read the full privacy policy — data flows, the complete subprocessor table, retention, security and where data is processed.
If you are a member of the public
You used a chat window, called a number, or sent a form
We are not the organization you contacted
They decide what is kept and for how long, and they hold the relationship with you. We run the software behind it. To see, correct or delete what is held about you, ask them — they are the ones who can act. If you cannot reach them, write to us and we will route it and tell you we have.
You are always told it is software
The chat window discloses it before your first message and the phone assistant says it is automated. It answers only from information that organization has approved, and when nothing approved answers your question it says so and offers a person rather than guessing.
It will not discuss your account until you prove it is yours
Naming an account or parcel number is not enough; you have to match something the record already holds. Get it wrong and it will not tell you whether the number even exists.
Your rights, and texts
Your rights to know, correct, delete, opt out of sale or sharing (we do neither) and not be treated differently for asking come from your own state or national law — the Colorado Privacy Act, the CCPA in California, or your own. Exercise them with the organization you contacted.
Reply STOP to any text message and it stops immediately.
Contact
A person, not a form
Privacy questions, a request we should route, or a security concern: [email protected], or 469-200-0048. We acknowledge within two business days.
We revise this page when what we do changes — not when what we intend changes. The version and date are at the top.