Legal Policy Updates

How to Read This Log

Each entry below identifies:

• Effective date — the date the change took effect
• Affected document(s) — which of the three canonical legal documents changed
• Change type — Material (changes that affect user rights, data practices, refund eligibility, or other substantive terms) or Non-material (typo corrections, stylistic clarifications, formatting)
• Summary — a plain-language description of what changed

This log is append-only. Historical entries are preserved as a permanent record; they are not removed or rewritten when superseded by later changes. If a specific past version of any document is needed, contact legal@cairnandflint.com.

Privacy Notice v2.7 — Our Emails Say They Were Sent by AI

Effective date: October 16, 2026

Affected documents: Privacy Notice (v2.6 → v2.7; the summary and Section 14)

Change type: Material

Summary: Each email we send to a business we contact about our services (the first email, any follow-ups, and our replies) now says under its signature that it was sent by AI, that a person checks every first email before it goes out, and that follow-ups may be sent automatically. The summary says so, and Section 14 quotes the sentence. Nothing else changed: the emails are still written from fixed templates filled in with what we measured, and a person still approves the first email to each business. The previous version is kept at /privacy/v2-6.

Email notice: Material changes are sent by email to the clients active when the version takes effect. Who they are is confirmed against our production records before each publication of this log.

Terms of Service v2.8 — Our Email Providers, Named Truly

Effective date: October 15, 2026

Affected documents: Terms of Service (v2.7 → v2.8; Section 9)

Change type: Material

Summary: Section 9 named Resend and Zoho as our email providers. We no longer use Zoho, and nothing we hold is sent to it; our email goes through Google Workspace (our mailbox) and Resend. Section 9 now names those two. Nothing else changed. The previous version is kept at /terms/v2-7.

Email notice: Material changes are sent by email to the clients active when the version takes effect. Who they are is confirmed against our production records before each publication of this log.

Privacy Notice v2.6 — What Each Service Provider Receives, Stated in Full

Effective date: October 15, 2026

Affected documents: Privacy Notice (v2.5 → v2.6; Sections 3 and 14), and the Do Not Sell or Share page (v1.1 → v1.2)

Change type: Material

Summary: We checked every outside service our systems send personal information to against the list in Section 3. Six rows said less than the service receives, and they now say it in full: Resend also sends our newsletter to the people who sign up for it and the emails the law requires (answers to privacy requests, unsubscribe confirmations, breach notices); Telegram alerts to our operator can carry short excerpts of a message or call and the last four digits of a caller’s number; Anthropic receives the emails businesses and clients send us when it drafts a reply (Section 14 now says so too); the demo pages we build load Google’s web fonts, so a visitor’s IP address reaches Google; Stripe receives a tax ID when one is given; and Meta’s Ad Library is searched by a business’s name. Twilio is added: it carries an emergency text about our own systems to our operator, with no client or business data. The previous version is kept at /privacy/v2-5. The Do Not Sell or Share page said every marketing email we send carries a one-click unsubscribe link; that is true of every email our mail system sends, not of an offer a person at the studio sends by hand, and v1.2 says so. Its previous version is kept at /do-not-sell/v1-1.

Email notice: Material changes are sent by email to the clients active when the version takes effect. Who they are is confirmed against our production records before each publication of this log.

Refund Policy v3.6 — Every Exception Named; When a Build Begins

Effective date: October 15, 2026

Affected documents: Refund Policy (v3.5 → v3.6; Sections 1, 2 and 3)

Change type: Material

Summary: Section 1 called the audit accuracy guarantee the one exception to “no refund after that”. There are three: that guarantee, an annual plan cancelled mid-year (its months after the current one are refunded pro rata, Section 4), and the refunds in Section 8. Section 1 now names all three. Section 2 said a build’s fee stops being refundable when you approve the concept; no such step exists. It now stops being refundable when we start the build: at payment or, where the build needs things from you first, once you have supplied them and a person at the studio has approved them to start. Section 3 now states that the daily reminders about an unspent credit stop after twenty. The previous version is kept at /refund/v3-5.

Email notice: Material changes are sent by email to the clients active when the version takes effect. Who they are is confirmed against our production records before each publication of this log.

Terms of Service v2.7 — The Term of a Retainer Product

Effective date: October 14, 2026

Affected documents: Terms of Service (v2.6 → v2.7; Sections 2 and 6)

Change type: Material

Summary: Version 2.6 said there was no minimum term. A website build with a retainer carries one term: twelve months starting the first full month of retainer after delivery, which is why a year can be paid at once. Section 2 now says so, and Section 6 says there is no notice period and that a retainer product carries that term; Section 6 also said website retainers were month-to-month with no contract, and now says they carry that term and are month-to-month after it. The contract value, the buyout and what happens when the retainer stops are unchanged. The previous version is kept at /terms/v2-6.

Email notice: Material changes are sent by email to the clients active when the version takes effect. Who they are is confirmed against our production records before each publication of this log.

Refund Policy v3.5 — The Term of a Retainer Product

Effective date: October 14, 2026

Affected documents: Refund Policy (v3.4 → v3.5; Sections 4 and 7)

Change type: Material

Summary: Sections 4 and 7 said there was no minimum term. They now state the one term of a retainer product, as the Terms do: twelve months starting the first full month of retainer after delivery. Nothing else changed. The previous version is kept at /refund/v3-4.

Email notice: Material changes are sent by email to the clients active when the version takes effect. Who they are is confirmed against our production records before each publication of this log.

Privacy Notice v2.5 — Both Email-Checking Services Named

Effective date: October 14, 2026

Affected documents: Privacy Notice (v2.4 → v2.5; Section 3)

Change type: Material

Summary: Section 3 said MillionVerifier would receive email addresses only if we switched to it. We use it: it checks, in bulk, the business email addresses of businesses we could not reach earlier, while Bouncer checks an address at the time we find it. Both are now listed, each with what it receives. The previous version is kept at /privacy/v2-4.

Email notice: Material changes are sent by email to the clients active when the version takes effect. Who they are is confirmed against our production records before each publication of this log.

Privacy Notice v2.4 — Every Provider That May Carry Our Traffic; Encryption Everywhere

Effective date: October 14, 2026

Affected documents: Privacy Notice (v2.3 → v2.4; Sections 3 and 6)

Change type: Material

Summary: Section 3 now lists the host of our standby server, a second hosting provider that keeps our encrypted backups and would serve our application only if our main server failed (we name it in the list once confirmed), and says how our traffic is routed: our server is reached directly at DigitalOcean, our website through Vercel, and Cloudflare stores our files and runs DNS without carrying our traffic. Section 6 now says that every connection our systems make, including to our mail servers, is encrypted and checks the other side’s certificate with no unencrypted fallback, and that the messages, transcripts, replies and drafts in our database and the files we keep for you are encrypted, with backups and stored media encrypted before they leave our server. The previous version is kept at /privacy/v2-3.

Email notice: Material changes are sent by email to the clients active when the version takes effect. Who they are is confirmed against our production records before each publication of this log.

Terms of Service v2.6 — Cancelling an Annual Plan

Effective date: October 13, 2026

Affected documents: Terms of Service (v2.5 → v2.6, Section 6)

Change type: Material

Summary: Section 6 now names the annual plans (a monthly service paid a year at once, twelve months for the price of ten, and services that renew yearly); version 2.5 named the annual option for website retainers only. It also says what cancelling an annual plan does: the month you are in is kept and the service ends at the end of it (a website we host comes down unless you have bought it out, and your records are kept), and the rest of what you paid for the year is refunded pro rata once a person approves it. Version 2.5 said nothing about it. Nothing else changed. The previous version is kept at /terms/v2-5.

Email notice: Material changes are sent by email to the clients active when the version takes effect. Who they are is confirmed against our production records before each publication of this log.

Refund Policy v3.4 — Annual Plans Cancelled Mid-Year

Effective date: October 13, 2026

Affected documents: Refund Policy (v3.3 → v3.4; Sections 4 and 9)

Change type: Material

Summary: Section 4 said part of a period is never refunded. It now says that of a monthly period, and adds the annual plan: cancel at any time in writing, the current month is kept, the service ends at its end, and the rest of the year’s payment is refunded pro rata (one twelfth for each whole month after the current one) to your original payment method once a person approves it. Section 9 says that refund, like the audit accuracy refund, is issued by our system at the moment a person approves it. The previous version is kept at /refund/v3-3.

Email notice: Material changes are sent by email to the clients active when the version takes effect. Who they are is confirmed against our production records before each publication of this log.

Privacy Notice v2.3 — Encryption Everywhere We Keep Contact Details; Our Service Providers, Stated Truly

Effective date: October 13, 2026

Affected documents: Privacy Notice (v2.2 → v2.3; Sections 3, 5 and 6)

Change type: Material

Summary: Version 2.2 said the contact details in our database are encrypted, and some were not: newsletter sign-ups, messages left in our website chat, records of the emails we send, alerts and purchases held them in plain text. They are now encrypted (AES-256-GCM) wherever we keep them, including those already stored; we look an address up by a one-way fingerprint, never the address itself; and our logs and activity records no longer keep any email address or phone number. Section 3’s list of service providers now names every outside service our systems send personal information to, for what each actually does: Ayrshare, which publishes a client’s approved social posts, replaces Buffer, which we do not use; Zoho, which we no longer use, is removed, and Google Workspace is named for our business mailbox and the mailboxes our emails to businesses are sent from; OpenAI and ElevenLabs also transcribe voice notes; the AI receptionist’s providers (Deepgram, Anthropic, ElevenLabs) are named; Vercel also hosts the client websites we build; Cloudflare also runs DNS; and the platforms a client connects are listed. Section 5: documents uploaded for a knowledge audit are deleted after 12 months with no activity on your account, and any activity (signing in to your portal, emailing us, supplying material, using an assistant we run for you, a paid renewal) starts the 12 months again; version 2.2 counted from our last contact with you. The previous version is kept at /privacy/v2-2.

Email notice: Material changes are sent by email to the clients active when the version takes effect. Who they are is confirmed against our production records before each publication of this log.

Terms of Service v2.5 — Who Does What, Said Plainly

Effective date: October 10, 2026

Affected documents: Terms of Service (v2.4 → v2.5, Sections 6, 7, 9 and 23)

Change type: Material

Summary: When you cancel a subscription in writing, a person at the studio stops it renewing in Stripe (version 2.4 read as if a system did). We have no consulting or hourly rate: version 2.4 said changes beyond your order’s scope were billable at one. Asking for changes to a website build before you accept it is free, and work your order does not include is a separate purchase at its published price or at a written quote you accept before that work starts. Where a breach at one of our providers affects your personal information, a person at the studio notifies you as the Privacy Notice states. Section 23 now names the data we keep and points to the Privacy Notice’s retention schedule. Nothing else changed. The previous version is kept at /terms/v2-4.

Email notice: Material changes are sent by email to the clients active when the version takes effect. Who they are is confirmed against our production records before each publication of this log.

Privacy Notice v2.2 — What Is Automated, What a Person Does, How Long Logs Are Kept

Effective date: October 10, 2026

Affected documents: Privacy Notice (v2.1 → v2.2; the summary and Sections 1, 2, 5, 6, 8, 10, 11, 12 and 14); and the Do Not Sell or Share page (v1.0 → v1.1, kept at /do-not-sell/v1-0)

Change type: Material

Summary: Our first email to a business and any follow-ups are written from fixed templates filled in with what we measured, not by AI, and they carry no line saying AI wrote them (version 2.1 said every email did). A person reads and approves the first email to each business before it is sent; our system now holds every first email until a person has. AI drafts our replies and parts of the work we deliver, and much delivered work reaches your portal without a person reading it first (version 2.1 said a person checks every deliverable). When a business publishes no email address we may use a general address at its own domain, such as info@, once a verification service confirms it can receive mail; we never make up an address from a person’s name. Documents uploaded for a knowledge audit are now deleted 30 days after the audit report reaches your portal (until now, nothing started that clock before you ended service with us or 12 months passed without contact). Our logs cover our own application only, not the client websites we host; the server’s access log is kept 14 days, the activity log 90 days, and its error records, which were kept with no end date, are now deleted after 2 years. Breach notices, answers to emailed privacy requests, appeals and forwarded requests are handled by a person, by hand. On the Do Not Sell page: only marketing emails carry a one-click unsubscribe link (version 1.0 said every email did). The previous version is kept at /privacy/v2-1.

Email notice: Material changes are sent by email to the clients active when the version takes effect. Who they are is confirmed against our production records before each publication of this log.

Refund Policy v3.3 — The Audit Guarantee, and Who Issues a Refund

Effective date: October 10, 2026

Affected documents: Refund Policy (v3.2 → v3.3; Sections 1, 2, 8, 9, 10 and 11)

Change type: Material

Summary: The policy now states its one exception to “no refund after that”: the audit accuracy guarantee in Section 5 of our Legal Terms (if any finding in a paid Website Audit is wrong, the audit is free). It says that delays, refunds for undeliverable services, notices and the issuing of refunds are done by a person, by hand; only the audit guarantee’s refund is issued by our system, at the moment a person approves it. The current version is the one applied to a refund request, and a person applies an earlier version to a purchase made under it when you ask (version 3.2 said earlier purchases keep their version, which nothing in our system did). The monitoring section now covers only our own application. The previous version is kept at /refund/v3-2.

Email notice: Material changes are sent by email to the clients active when the version takes effect. Who they are is confirmed against our production records before each publication of this log.

Terms of Service v2.4 — Audit accuracy guarantee; half to start for builds

Effective date: October 10, 2026

Affected documents: Terms of Service (v2.3 → v2.4, Section 5)

Change type: Material

Summary: Two additions, both in your favour. First, an audit accuracy guarantee: if any finding in a paid Website Audit is wrong, the audit is free — tell us which finding and, once we confirm it, we refund what you paid for the audit in full (a refunded audit no longer carries its credit toward a rebuild). Second, for a website build you pay half at checkout and the other half only when you have seen the finished work and approved it in your client portal; asking for changes is free, and the work is yours to use once that payment goes through. Nothing else changed. The previous version is kept at /terms/v2-3.

Email notice: Material changes are sent by email to the clients active when the version takes effect. Who they are is confirmed against our production records before each publication of this log.

Terms of Service v2.3 — Case Studies

Effective date: October 10, 2026

Affected documents: Terms of Service (v2.2 → v2.3, Section 2)

Change type: Material

Summary: The Terms now say plainly that, unless you opt out, we may describe the results we measured for your business (for example, a change in search ranking, website traffic or leads) as a case study — never your private data, and naming your type of business and city rather than your business unless you give us separate written permission. You can opt out at checkout (a question beside the Terms checkbox, or a box in our store) or at any time later in your client portal or by email. Nothing else changed. The previous version is kept at /terms/v2-2.

Email notice: Material changes are sent by email to the clients active when the version takes effect. Who they are is confirmed against our production records before each publication of this log.

Terms of Service v2.2 and Refund Policy v3.2

Effective date: October 10, 2026

Affected documents: Terms of Service (v2.1 → v2.2, Section 2); Refund Policy (v3.1 → v3.2, Section 7)

Change type: Material

Summary: The ownership terms now say what the buyout and the term mean, in the same words as our store, our FAQ and our process page. There is no minimum term. The contract value is two build fees plus twelve months of retainer (ten months with the annual prepay, which covers all twelve). The term is the twelve retainer months after delivery. Before it completes, the buyout is one build fee plus the retainer for each month not yet covered, so it goes down as months are covered; when it completes, the code and deliverables are yours, free, and the retainer is optional for upkeep. “Lead data” means the leads captured during the engagement. If the retainer stops and ownership has not been bought out, the product is taken down. Nothing else in either document changed. The previous versions are kept at /terms/v2-1 and /refund/v3-1.

Email notice: Material changes are sent by email to the clients active when the version takes effect. Who they are is confirmed against our production records before each publication of this log.

Privacy Notice v2.1 — Which Emails a Person Checks

Effective date: October 9, 2026

Affected documents: Privacy Notice (v2.0 → v2.1; the summary, Section 2 and Section 14). Version 2.0 is kept at /privacy/v2-0

Change type: Material

Summary: Version 2.0 said we may send one email to a business and that a person approves every message before it is sent. Version 2.1 says what we actually do: a person checks the first email we send to a business, and every piece of work we deliver; if there is no reply, follow-up emails may be sent automatically, never more than three emails in all, and every email says it was written with AI.

Email Notice for Terms of Service v2.1 and Refund Policy v3.0

Date recorded: October 9, 2026

Affected documents: Terms of Service v2.1 and Refund Policy v3.0 (both effective October 6, 2026); neither document’s text changes

Change type: Record of a decision (no document changed)

Summary: Both changes listed below for October 6, 2026 were material, and material changes are sent by email to the clients active when they take effect. Who they are is confirmed against our production records before each publication of this log. This entry is the record of that rule.

Privacy Notice v2.0 — Calendly Removed From the Subprocessor List

Effective date: October 9, 2026

Affected documents: Privacy Notice (v2.0, Section 3; no version change)

Change type: Non-material

Summary: Calendly (booking calls; name, email and booking answers) is removed from the subprocessor list in Section 3. Our website no longer offers call booking through Calendly, so it receives no personal information from us. No other provider was added or changed.

Refund Policy v3.1

Effective date: October 9, 2026

Affected documents: Refund Policy (v3.0 → v3.1)

Change type: Material

Summary: One rule now covers every purchase: work begins when delivery begins, and there is no refund after that. Products delivered at payment are credited toward a website build. A purchase that waits on your inputs gives you 3 full business days; after that the payment becomes a credit you can spend for 30 days, with one reminder each business day at 07:30 your time until you finish or ask us to stop, and a credit left unused for 30 days is kept by the studio on a person’s decision, never the system’s. Builds are non-refundable from concept approval. A full refund is available on a written request within 24 hours of paying and before delivery begins, or on studio negligence. The previous version is kept at /refund/v3-0.

Terms of Service v2.1 and Refund Policy v3.0

Effective date: October 6, 2026

Affected documents: Terms of Service (v2.0 → v2.1); Refund Policy (v2.0 → v3.0)

Change type: Material

Summary: Our checkout now asks you to agree to the Terms of Service, by version, before you pay, and we record the version and the time against your payment; the Terms say so. The minimum terms the Terms and the Refund Policy listed (6 months for LinkedIn ghostwriting, 3 months for Local SEO and Knowledge Infrastructure Tier 3, 12 months for website retainers) and the 30-day cancellation notice are removed, because our billing never applied them: subscriptions are month-to-month and can be cancelled at any time, running to the end of the period already paid. The Refund Policy is rewritten to describe how purchases actually work: no deposits or booked calls, no automatic refunds (a person decides every refund), a full refund before we start work, and, for services that need your inputs, a 72-business-hour window after which your payment becomes a credit that never expires. Its ownership section now matches the ownership terms in the Terms of Service. The previous versions are kept at /terms/v2-0 and /refund/v2-0.

Privacy Notice v2.0, Terms of Service v2.0, and a Do Not Sell Page

Effective date: October 6, 2026

Affected documents: Privacy Notice (v1.1 → v2.0); Terms of Service (v1.0 → v2.0); Do Not Sell or Share (new, v1.0)

Change type: Material

Summary: Both documents were checked against how our systems actually work, and corrected where they were wrong. The Privacy Notice now says that we do use public business information (Google Maps listings, business websites, domain records, the Google Ads Transparency Center, review sites and web search) to find and contact businesses; lists every service provider that processes personal information for us; describes the accounts clients can connect (the permissions requested, how tokens are stored and revoked); explains how CVs uploaded to our Hiring Assistant are handled; states that the messages we send and the work we deliver are drafted by AI and approved by a person; names our cookieless page-view counting; and removes the text-messaging section, as we do not send text messages. The Terms of Service now describe the services as the published catalogue, state the ownership terms shown on our store, describe orders as the product page and checkout (or an accepted proposal) rather than a signed agreement, state that taxes are calculated at checkout, and no longer say that our checkout asks you to tick the key acknowledgments (it does not). A new Do Not Sell or Share page lets anyone stop all contact from us. The previous versions are kept at /privacy/v1-1 and /terms/v1-0.

Privacy Notice v1.1 — SMS/A2P 10DLC Section Added

Effective date: April 24, 2026

Affected documents: Privacy Notice (v1.0 → v1.1)

Change type: Material

Summary: Added a dedicated section (new Section 13) covering text messaging (SMS) communications, including consent collection, opt-out procedures, and a carveout confirming that SMS originator opt-in data and consent are not shared with any third parties. Added mobile phone numbers and SMS opt-in consent records as a new category of personal information in Section 1. Added Quo (formerly OpenPhone) to the subprocessor list in Section 3 as the SMS and business-phone infrastructure provider. Renumbered prior Sections 13–17 to 14–18 to accommodate the new section. This update aligns the Privacy Notice with CTIA guidelines and The Campaign Registry (TCR) A2P 10DLC carrier-registration requirements.

Initial Publication

Effective date: April 22, 2026

Affected documents: All three — Privacy Notice v1.0, Terms of Service v1.0, Refund Policy v2.0

Change type: Initial publication

Summary: Initial launch of the studio’s legal documents. Privacy Notice and Terms of Service published at v1.0. Refund Policy published at v2.0 (internal v1.0 was a pre- launch draft not published publicly). All three documents are self-hosted, drafted by the studio, and subject to independent attorney review after launch.

Questions About Changes

If you have questions about any change listed in this log, or about how a change might affect an active engagement, contact legal@cairnandflint.com. Active clients may also raise questions through their usual engagement communication channel.