Privacy Notice

Summary of Key Points

What personal information do we process? What you give us, what our website records automatically, and information about businesses that is already public (see Section 1).

Do we process any sensitive personal information? Not for our own purposes. One service is an exception we handle on a client’s behalf: our Hiring Assistant reads the CVs a client uploads, and a CV can reveal sensitive information such as age, health or ethnicity. We never use those characteristics, the client must confirm the candidates’ consent first, and each CV is deleted after 180 days or sooner on request (Section 11).

Do we collect any information from third parties? Yes. To find businesses that our services may help, we use information those businesses have made public: their listing on Google Maps (Google Places), their own website, the public domain registration record (WHOIS), the Google Ads Transparency Center, public review sites, and web search results. This is business information (a business’s name, address, phone number, website, reviews and ads, and an email address: the one the business publishes or, when it publishes none, a general address at its own domain such as info@ that a verification service confirms can receive mail), and it can include the name and role of an owner or manager where the business publishes it. We do not buy lists and we do not use data brokers.

Do you use artificial intelligence? For some things. Our first email to a business and any follow-ups are written from fixed templates filled in with what we measured on its website; no AI writes them. A person reads and approves the first email to each business before it is sent; follow-up emails may be sent automatically. AI software drafts our replies when a business writes back, and parts of the work we deliver; much of that work reaches your client portal without a person reading it first (Section 14).

Do we sell your information? No. We do not sell personal information or share it for cross-context behavioral advertising. You can tell us never to contact you at /do-not-sell.

Who else sees it? Only the service providers that run parts of our business for us, listed by name in Section 3.

How do you exercise your rights? Email privacy@cairnandflint.com, or use /do-not-sell to stop all contact. Section 8 explains each right.

1. What Information Do We Collect?

Information you give us

When you contact us, buy from us, or work with us, we collect what you choose to give us:

• Name, email address, and phone number
• Your business’s name, website address, and role
• What you write to us, and the answers you give in your client portal
• Material you upload for a service: page copy, photos and brand assets, documents for a knowledge audit, an export of your inbound email, CVs for the Hiring Assistant (Section 11)
• Billing details, which Stripe collects on its own payment page; we never see or store a card number

Information about businesses from public sources

We keep records of businesses that our services may help, built from information the business has made public:

• Google Maps listings (through the Google Places API): name, address, phone, website, category, rating and review count
• The business’s own website: what it publishes, including contact details, and how the site performs (speed, accessibility, structured data)
• Public domain registration records (WHOIS), as the registrar publishes them
• The Google Ads Transparency Center: whether the business runs search ads
• Public review sites and web search results about the business

These records are about businesses. They include a person only where the business itself publishes that person’s name, role, email address or phone number (for example, an owner listed on the website). When a business publishes no email address, we may try a general address at its own domain (such as info@ or contact@); we never make up an address from a person’s name. We check that an email address can receive mail before we use it, through an email-verification service (Section 3). We do not buy lists, we do not use data brokers, and we do not collect information about consumers or a business’s customers this way.

Information collected automatically

When you visit our website or client portal, our servers record your IP address, browser and device characteristics, the pages requested, referring URLs, and the time. We use it to run and secure the services. We count page views on our website with Vercel Web Analytics, which sets no cookies and does not identify individual visitors. We do not use advertising cookies, tracking pixels, or any other analytics service.

Information we do not collect

• Purchased lists, or data from data brokers or advertising networks
• Information from social media through pixels or similar tracking
• Precise geolocation
• Biometric data. Our video service uses a synthetic presenter; we do not create a likeness of a real person
• Payment card numbers (Stripe handles them)
• Information about children (Section 7)

2. How Do We Process Your Information?

• To provide the services you buy: producing and delivering the work, running your client portal, and the connections you make to your own accounts (Section 13)
• To find businesses we may be able to help, and to contact them: we review a business’s public presence (for example, its website’s speed and accessibility) and may send an email to the address the business publishes (or, when it publishes none, a general address at its own domain that a verification service confirms can receive mail), about a specific finding and what we offer, and, if there is no reply, follow-up emails (never more than three emails in all). Every such email says who we are, gives our postal address, and has an unsubscribe link. An unsubscribe or a do-not-contact request is kept permanently so we never contact that address again. We do not send text messages
• To communicate with clients: project updates, receipts, and support
• Administration: invoicing, tax records, and record-keeping
• Security and fraud prevention: protecting our systems and yours
• Legal obligations: complying with law and lawful requests

We do not use personal information for:

• Targeted advertising or retargeting
• Selling or renting it
• Profiling consumers
• Sharing with data brokers or advertising platforms

3. When and With Whom Do We Share Your Personal Information?

We share personal information only with the service providers below, who process it for us under their own security commitments; in a merger, sale or financing (a successor is bound by this Notice); to comply with law; or to protect our rights.

Subprocessor List

We do not share personal information with advertising networks or data brokers. Social media platforms receive only what a client asks us to publish to the client’s own accounts (Ayrshare and the connections in Section 13). Material additions to this list are announced as described in Section 16.

4. Is Your Information Transferred Internationally?

Our servers and operations are in the United States. Some subprocessors in Section 3 route data through other countries. If you are outside the United States, your information is processed in the United States and wherever those subprocessors operate. For residents of the EEA, UK or Switzerland, we rely on appropriate safeguards, including standard contractual clauses where applicable.

5. How Long Do We Keep Your Information?

• Records of businesses from public sources: while the business may still be a fit for our services, and deleted on request
• Unsubscribe and do-not-contact records: permanently, so we never contact that address again
• Documents uploaded for a knowledge audit: deleted 30 days after the audit report is released to your client portal. If they also make up a knowledge base you bought from us, they are kept for it, and deleted 30 days after your last subscription with us ends instead. Either way they are deleted after 12 months with no activity on your account if that comes first: signing in to your client portal, emailing us, supplying material, using an assistant we run for you, or a paid renewal each count as activity and start the 12 months again. A person can hold them past these dates only with a stated reason, reviewed every 90 days
• CVs uploaded to the Hiring Assistant: deleted 180 days after upload, or sooner on request
• Connected-account tokens: until you disconnect, the engagement ends, or the provider revokes them (Section 13)
• Engagement and communication records: the engagement plus 7 years
• Transactional records (invoices, payments): 7 years
• Security and access logs: our server’s access log (IP address, browser, page and time), 14 days; our application’s activity log, 90 days, and its error records, 2 years; sign-in attempts, 1 day; records of compliance actions, 2 years

When we no longer need information, we delete or anonymize it. Information in backups is isolated from use until the backup expires.

6. How Do We Keep Your Information Safe?

• Encryption in transit: every page and connection uses HTTPS (TLS 1.2 or newer), and every connection our systems make to a service provider, including our mail servers, is encrypted and checks the provider’s certificate; we never fall back to an unencrypted connection
• Encryption at rest: contact names, email addresses and phone numbers in our database are encrypted (AES-256-GCM) wherever we keep them as someone’s contact details: business and client records, newsletter sign-ups, messages left in our website chat, call bookings, referral partners, records of the emails we send, alerts and purchases. An email address or phone number written inside those records, or in the details you give us for a service, is encrypted where it stands. Where we need to find an address we use a one-way fingerprint of it, never the address itself. Documents, CVs and connected-account tokens are encrypted with a key bound to their own client, so one client’s material cannot be read as another’s
• Messages and files are encrypted too: the words people send us and we write for them (messages, call transcripts, replies, drafts, your ghostwriting material) are encrypted in our database, and the files we keep for you (your uploads and exports, the work we hold for you, your data export) are encrypted on our servers. Backups and stored media are encrypted before they leave our server
• Logs keep no contact details: our application logs and activity records replace every email address with its domain only and every phone number with a placeholder
• Uploaded files are treated as data, never run, and are scanned for malware
• Access controls: two-factor authentication on business systems where supported; a single operator holds access
• Monitoring and updates: logging and alerting (Section 12); dependencies kept current

No transmission or storage is 100% secure. If a breach affects your personal information, we will notify you and the relevant authorities within the time the law requires (72 hours to supervisory authorities under the GDPR where feasible; 30 to 60 days under U.S. state laws), describing what happened, what data was affected and what we are doing about it. A person at the studio writes and sends these notices; no automated system does.

7. Do We Collect Information From Minors?

No. Our services are for businesses and we do not knowingly collect information from anyone under 18. If we learn we have, we delete it. Tell us at privacy@cairnandflint.com.

8. What Are Your Privacy Rights?

Depending on where you live, you may have these rights. We honor them for everyone where practical:

• Know and access what we hold about you, and get a copy
• Correct it
• Delete it, subject to legal retention
• Portability: a copy in CSV or JSON
• Opt out of contact: use /do-not-sell or the unsubscribe link in any email
• Opt out of sale or sharing: we do not sell or share personal information for advertising; the same page records your choice
• Withdraw consent where we rely on it
• Non-discrimination for using any of these rights

How we handle requests

• Email privacy@cairnandflint.com with the right you want to use. A person at the studio reads and answers every request by hand; no automated system tracks it.
• We confirm your identity first, usually by a confirmation sent to the email address the request is about.
• The person handling your request answers within 30 days (GDPR) or 45 days (CCPA and similar U.S. laws), and tells you if an extension the law allows is needed.
• If we refuse a request, we say why. Appeal to legal@cairnandflint.com with “Privacy Appeal” in the subject; a person answers appeals within 60 days.
• There is no charge.

9. Controls for Do-Not-Track Features

There is no settled standard for browser Do-Not-Track signals, so we do not respond to them. We do not track you across other websites in any case.

10. Our Role as Both Data Controller and Data Processor

Controller. We decide how information is used for our website, our inquiries and clients, and the business records we keep for finding and contacting businesses (Section 1).

Processor. When we handle information on a client’s behalf (the visitors to a website we host for them, the callers their AI receptionist answers, the candidates whose CVs they upload, the email in a mail export they give us), the client is the controller and we act on their instructions. If you are one of those people, contact the client business directly; if you contact us instead, a person at the studio forwards your request to them.

11. Information Collected During Engagements

What we collect depends on the service. We ask for it in your client portal when that service needs it, and only for what we cannot see publicly.

• Websites: page copy, photos, brand assets and business details
• Ghostwriting: notes, transcripts or recordings of your voice sessions, which may mention other people
• Knowledge audit and knowledge base: your internal documents and, for the knowledge base, interviews with your people. Documents are encrypted to your account, read as data, and deleted on the schedule in Section 5
• Inbound email drafting: an export of your inbound mail that you upload. Attachments are dropped unopened
• AI receptionist: the calls it answers for you, with their transcripts
• Reviews and local search: your reviews and listing data, read through the connections you choose to make (Section 13) or an export you upload

The Hiring Assistant and CVs (sensitive information)

A CV can reveal sensitive personal information about the candidate (for example, age, ethnicity, religion, health or disability). We handle it this way:

• The client uploads each CV and must first confirm that the candidate agreed to it being processed. Without that confirmation the CV is refused.
• CVs are encrypted to the client’s account and kept apart from every other client’s.
• We do not use protected characteristics to rank or screen anyone. A hiring requirement based on one is refused.
• Each CV is deleted 180 days after upload, or sooner when the client or the candidate asks.

12. Monitoring, Security Logging, and Intellectual Property Enforcement

We log access to our own application (our client portal and back office): the server’s access log (IP addresses, browsers, timestamps), the administrative actions taken in it, and unusual access patterns, such as probes of addresses that do not exist, which we block. We use these logs to protect our systems, investigate problems, enforce our rights and meet legal obligations, and keep them for the periods in Section 5. This does not cover the client websites we host: Vercel serves those and keeps its own request logs (Section 3). A person may keep a specific record longer for an active investigation or legal matter; if that limits a deletion request of yours, the person answering it tells you.

13. Connected Accounts (OAuth)

Some services let you connect one of your own accounts to your client portal so that we can read what a report needs or so that you can publish what we draft with one click. You choose each connection; none is required to buy from us.

• Storage: access and refresh tokens are encrypted at rest with a key bound to your account. They are never shown to anyone, never written to logs, and never shared.
• Use: only for the purpose shown when you connect, only for your account, and nothing is posted or sent without your click. Data obtained from Google APIs is used only to provide those features to you, is not used for advertising, is not sold, is not read by a person except with your permission, for security, or as the law requires, and is not used to train AI models. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
• Retention: until you disconnect, your engagement ends, or the provider revokes access.
• Disconnecting: disconnect in your client portal, or remove our access in your account’s own settings (for Google, myaccount.google.com/permissions). When you disconnect in the portal we ask the provider to revoke the grant and destroy the stored tokens; nothing can be read or posted after that. Microsoft offers no per-grant revocation, so for Outlook we destroy the tokens and you can also remove the app in your Microsoft account.

14. Artificial Intelligence and Automated Processing

The first email we send to a business, and any follow-ups, are written from fixed templates filled in with the findings we measured on its website; no AI writes them. A person at Cairn & Flint reads and approves the first email to each business before it is sent. Follow-up emails may be sent automatically, without a person reading each one. AI software drafts our replies when a business writes back to us (some of them may be sent without a person reading each one) and parts of the work we deliver. Much of the work we deliver reaches your client portal without a person reading it first: it must pass automated checks (for example, that every figure carries its source), and a person sees it first when a check flags it or when the product needs a person’s release. The AI providers we use are Anthropic and OpenAI (Section 3). Text sent to them for drafting can include the business facts and client material that the draft is about.

We use automated rules to sort the business records in Section 1, for example by how well a business fits what we offer and whether its website has problems we fix. This sorts businesses, not consumers, and it decides only whom we might contact; a person checks the first message to any business.

We do not make decisions with legal or similarly significant effects on anyone by automated means alone. Prices are published or set by a person, and every proposal is approved by a person. In the Hiring Assistant, the software suggests a ranked shortlist for the client; the client makes every hiring decision, and protected characteristics are never used.

15. Corporate Structure and Privacy Contact

Cairn and Flint Studio LLC, a New Mexico limited liability company, is the controller under this Notice. We have not appointed an EU or UK representative; EU and UK residents may contact us directly.

16. Do We Make Updates to This Notice?

Yes. Each version states its number and effective date, every earlier version stays available, and each change is listed at /legal/updates. For a material change (new categories of data, new recipients, new uses, changes to your rights or to retention), we also email our active clients.

17. How Can You Contact Us About This Notice?

18. How Can You Review, Update, or Delete Your Data?

Email privacy@cairnandflint.com to see, correct or delete the information we hold about you, or use /do-not-sell to stop all contact. Section 8 explains how we handle each request.