Privacy Notice

Summary of Key Points

What personal information do we process? What you give us, what our website records automatically, and information about businesses that is already public (see Section 1).

Do we process any sensitive personal information? Not for our own purposes. One service is an exception we handle on a client’s behalf: our Hiring Assistant reads the CVs a client uploads, and a CV can reveal sensitive information such as age, health or ethnicity. We never use those characteristics, the client must confirm the candidates’ consent first, and each CV is deleted after 180 days or sooner on request (Section 11).

Do we collect any information from third parties? Yes. To find businesses that our services may help, we use information those businesses have made public: their listing on Google Maps (Google Places), their own website, the public domain registration record (WHOIS), the Google Ads Transparency Center, public review sites, and web search results. This is business information (a business’s name, address, phone number, website, published email address, reviews and ads), and it can include the name and role of an owner or manager where the business publishes it. We do not buy lists and we do not use data brokers.

Do you use artificial intelligence? Yes. The messages we send and the work we deliver are drafted by AI software. A person checks the first email we send to a business, and every piece of work we deliver, before it goes; follow-up emails may be sent automatically (Section 14).

Do we sell your information? No. We do not sell personal information or share it for cross-context behavioral advertising. You can tell us never to contact you at /do-not-sell.

Who else sees it? Only the service providers that run parts of our business for us, listed by name in Section 3.

How do you exercise your rights? Email privacy@cairnandflint.com, or use /do-not-sell to stop all contact. Section 8 explains each right.

1. What Information Do We Collect?

Information you give us

When you contact us, buy from us, or work with us, we collect what you choose to give us:

• Name, email address, and phone number
• Your business’s name, website address, and role
• What you write to us, and the answers you give in your client portal
• Material you upload for a service: page copy, photos and brand assets, documents for a knowledge audit, an export of your inbound email, CVs for the Hiring Assistant (Section 11)
• Billing details, which Stripe collects on its own payment page; we never see or store a card number

Information about businesses from public sources

We keep records of businesses that our services may help, built from information the business has made public:

• Google Maps listings (through the Google Places API): name, address, phone, website, category, rating and review count
• The business’s own website: what it publishes, including contact details, and how the site performs (speed, accessibility, structured data)
• Public domain registration records (WHOIS), as the registrar publishes them
• The Google Ads Transparency Center: whether the business runs search ads
• Public review sites and web search results about the business

These records are about businesses. They include a person only where the business itself publishes that person’s name, role, email address or phone number (for example, an owner listed on the website). We check that a published email address can receive mail before we use it, through an email-verification service (Section 3). We do not buy lists, we do not use data brokers, and we do not collect information about consumers or a business’s customers this way.

Information collected automatically

When you visit our website or client portal, our servers record your IP address, browser and device characteristics, the pages requested, referring URLs, and the time. We use it to run and secure the services. We count page views on our website with Vercel Web Analytics, which sets no cookies and does not identify individual visitors. We do not use advertising cookies, tracking pixels, or any other analytics service.

Information we do not collect

• Purchased lists, or data from data brokers or advertising networks
• Information from social media through pixels or similar tracking
• Precise geolocation
• Biometric data. Our video service uses a synthetic presenter; we do not create a likeness of a real person
• Payment card numbers (Stripe handles them)
• Information about children (Section 7)

2. How Do We Process Your Information?

• To provide the services you buy: producing and delivering the work, running your client portal, and the connections you make to your own accounts (Section 13)
• To find businesses we may be able to help, and to contact them: we review a business’s public presence (for example, its website’s speed and accessibility) and may send an email to an address the business publishes, about a specific finding and what we offer, and, if there is no reply, follow-up emails (never more than three emails in all). Every such email says who we are, gives our postal address, and has an unsubscribe link. An unsubscribe or a do-not-contact request is kept permanently so we never contact that address again. We do not send text messages
• To communicate with clients: project updates, receipts, and support
• Administration: invoicing, tax records, and record-keeping
• Security and fraud prevention: protecting our systems and yours
• Legal obligations: complying with law and lawful requests

We do not use personal information for:

• Targeted advertising or retargeting
• Selling or renting it
• Profiling consumers
• Sharing with data brokers or advertising platforms

3. When and With Whom Do We Share Your Personal Information?

We share personal information only with the service providers below, who process it for us under their own security commitments; in a merger, sale or financing (a successor is bound by this Notice); to comply with law; or to protect our rights.

Subprocessor List

We do not share personal information with advertising networks, data brokers, or social media platforms. Material additions to this list are announced as described in Section 16.

4. Is Your Information Transferred Internationally?

Our servers and operations are in the United States. Some subprocessors in Section 3 route data through other countries. If you are outside the United States, your information is processed in the United States and wherever those subprocessors operate. For residents of the EEA, UK or Switzerland, we rely on appropriate safeguards, including standard contractual clauses where applicable.

5. How Long Do We Keep Your Information?

• Records of businesses from public sources: while the business may still be a fit for our services, and deleted on request
• Unsubscribe and do-not-contact records: permanently, so we never contact that address again
• Documents uploaded for a knowledge audit: deleted 30 days after the audit closes
• CVs uploaded to the Hiring Assistant: deleted 180 days after upload, or sooner on request
• Connected-account tokens: until you disconnect, the engagement ends, or the provider revokes them (Section 13)
• Engagement and communication records: the engagement plus 7 years
• Transactional records (invoices, payments): 7 years
• Security and access logs: 90 days to 2 years, by category

When we no longer need information, we delete or anonymize it. Information in backups is isolated from use until the backup expires.

6. How Do We Keep Your Information Safe?

• Encryption in transit: every page and connection uses HTTPS
• Encryption at rest: contact names, email addresses and phone numbers in our database are encrypted (AES-256-GCM); documents, CVs and connected-account tokens are encrypted with a key bound to their own client, so one client’s material cannot be read as another’s
• Uploaded files are treated as data, never run, and are scanned for malware
• Access controls: two-factor authentication on business systems where supported; a single operator holds access
• Monitoring and updates: logging and alerting (Section 12); dependencies kept current

No transmission or storage is 100% secure. If a breach affects your personal information, we will notify you and the relevant authorities within the time the law requires (72 hours to supervisory authorities under the GDPR where feasible; 30 to 60 days under U.S. state laws), describing what happened, what data was affected and what we are doing about it.

7. Do We Collect Information From Minors?

No. Our services are for businesses and we do not knowingly collect information from anyone under 18. If we learn we have, we delete it. Tell us at privacy@cairnandflint.com.

8. What Are Your Privacy Rights?

Depending on where you live, you may have these rights. We honor them for everyone where practical:

• Know and access what we hold about you, and get a copy
• Correct it
• Delete it, subject to legal retention
• Portability: a copy in CSV or JSON
• Opt out of contact: use /do-not-sell or the unsubscribe link in any email
• Opt out of sale or sharing: we do not sell or share personal information for advertising; the same page records your choice
• Withdraw consent where we rely on it
• Non-discrimination for using any of these rights

How we handle requests

• Email privacy@cairnandflint.com with the right you want to use.
• We confirm your identity first, usually by a confirmation sent to the email address the request is about.
• We respond within 30 days (GDPR) or 45 days (CCPA and similar U.S. laws), and tell you if we need an extension the law allows.
• If we refuse a request, we say why. Appeal to legal@cairnandflint.com with “Privacy Appeal” in the subject; we answer appeals within 60 days.
• There is no charge.

9. Controls for Do-Not-Track Features

There is no settled standard for browser Do-Not-Track signals, so we do not respond to them. We do not track you across other websites in any case.

10. Our Role as Both Data Controller and Data Processor

Controller. We decide how information is used for our website, our inquiries and clients, and the business records we keep for finding and contacting businesses (Section 1).

Processor. When we handle information on a client’s behalf (the visitors to a website we host for them, the callers their AI receptionist answers, the candidates whose CVs they upload, the email in a mail export they give us), the client is the controller and we act on their instructions. If you are one of those people, contact the client business directly; if you contact us instead, we will forward your request to them.

11. Information Collected During Engagements

What we collect depends on the service. We ask for it in your client portal when that service needs it, and only for what we cannot see publicly.

• Websites: page copy, photos, brand assets and business details
• Ghostwriting: notes, transcripts or recordings of your voice sessions, which may mention other people
• Knowledge audit and knowledge base: your internal documents and, for the knowledge base, interviews with your people. Documents are encrypted to your account, read as data, and deleted 30 days after the audit closes
• Inbound email drafting: an export of your inbound mail that you upload. Attachments are dropped unopened
• AI receptionist: the calls it answers for you, with their transcripts
• Reviews and local search: your reviews and listing data, read through the connections you choose to make (Section 13) or an export you upload

The Hiring Assistant and CVs (sensitive information)

A CV can reveal sensitive personal information about the candidate (for example, age, ethnicity, religion, health or disability). We handle it this way:

• The client uploads each CV and must first confirm that the candidate agreed to it being processed. Without that confirmation the CV is refused.
• CVs are encrypted to the client’s account and kept apart from every other client’s.
• We do not use protected characteristics to rank or screen anyone. A hiring requirement based on one is refused.
• Each CV is deleted 180 days after upload, or sooner when the client or the candidate asks.

12. Monitoring, Security Logging, and Intellectual Property Enforcement

We log server access (IP addresses, user agents, timestamps), administrative actions, and unusual access patterns across our systems and the websites we host, and we may place small, non-functional markers in sites we build to detect copying. We use these logs to protect our systems, investigate problems, enforce our rights and meet legal obligations. They are kept 90 days to 2 years, longer only for an active investigation or legal matter, and we tell you if a deletion request is limited by one.

13. Connected Accounts (OAuth)

Some services let you connect one of your own accounts to your client portal so that we can read what a report needs or so that you can publish what we draft with one click. You choose each connection; none is required to buy from us.

• Storage: access and refresh tokens are encrypted at rest with a key bound to your account. They are never shown to anyone, never written to logs, and never shared.
• Use: only for the purpose shown when you connect, only for your account, and nothing is posted or sent without your click. Data obtained from Google APIs is used only to provide those features to you, is not used for advertising, is not sold, is not read by a person except with your permission, for security, or as the law requires, and is not used to train AI models. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
• Retention: until you disconnect, your engagement ends, or the provider revokes access.
• Disconnecting: disconnect in your client portal, or remove our access in your account’s own settings (for Google, myaccount.google.com/permissions). When you disconnect in the portal we ask the provider to revoke the grant and destroy the stored tokens; nothing can be read or posted after that. Microsoft offers no per-grant revocation, so for Outlook we destroy the tokens and you can also remove the app in your Microsoft account.

14. Artificial Intelligence and Automated Processing

The emails we send to businesses, and the work we deliver to clients, are drafted by AI software. A person at Cairn & Flint checks the first email to a business before it is sent, and every deliverable before it is delivered. Follow-up emails may be sent automatically, without a person reading each one; every email says it was written with AI. The AI providers we use are Anthropic and OpenAI (Section 3). Text sent to them for drafting can include the business facts and client material that the draft is about.

We use automated rules to sort the business records in Section 1, for example by how well a business fits what we offer and whether its website has problems we fix. This sorts businesses, not consumers, and it decides only whom we might contact; a person checks the first message to any business.

We do not make decisions with legal or similarly significant effects on anyone by automated means alone. Prices are published or set by a person, and every proposal is approved by a person. In the Hiring Assistant, the software suggests a ranked shortlist for the client; the client makes every hiring decision, and protected characteristics are never used.

15. Corporate Structure and Privacy Contact

Cairn and Flint Studio LLC, a New Mexico limited liability company, is the controller under this Notice. We have not appointed an EU or UK representative; EU and UK residents may contact us directly.

16. Do We Make Updates to This Notice?

Yes. Each version states its number and effective date, every earlier version stays available, and each change is listed at /legal/updates. For a material change (new categories of data, new recipients, new uses, changes to your rights or to retention), we also email our active clients.

17. How Can You Contact Us About This Notice?

18. How Can You Review, Update, or Delete Your Data?

Email privacy@cairnandflint.com to see, correct or delete the information we hold about you, or use /do-not-sell to stop all contact. Section 8 explains how we handle each request.