Privacy Policy

Last updated: [DATE]

ROY — Technology Consultation (“Roy,” “we,” “us,” “our”), operated by [legal entity name], explains here how we collect, use, disclose, and protect information when you use consult-with-roy.com, the AI concierge, and related services — including access through third-party AI assistants via our connector (together, the “Service”). By using the Service you agree to this Policy; if you disagree, do not use the Service.

1. Controller & contact

The controller is [legal entity name], [address]. Questions or requests: [[email protected]].

2. Information we collect

• Identity & contact you provide: name, email, and optionally phone and company (during magic-link verification or in conversation).
• Conversation data: your messages, the concierge’s replies, and generated summaries/notes.
• Files you upload: documents and their extracted text/summaries, used to answer your questions.
• Account/session data: verification tokens, session IDs, and thread/conversation IDs.
• Technical & usage data: IP address, device/browser info, and interactions, via our hosting and analytics providers.
• Connector data: when you link a third-party AI assistant (e.g., ChatGPT, Claude, Gemini) through our connector, the scopes you authorize and requests made through that connection.

Please do not submit special-category (sensitive) personal data; we do not intentionally collect it.

3. How we use information

To provide, operate, and secure the Service and verify identity; to remember your context across sessions and let Roy follow up personally; to maintain interaction, task, and meeting records in our CRM; to communicate with you (e.g., magic-link emails); to analyze and improve the Service; and to comply with law and enforce our Terms. We do not sell your personal information, and we do not use your conversations to train third-party foundation models.

4. Legal bases (EEA/UK)

Performance of a contract / steps at your request; our legitimate interests in operating and improving the Service and following up on inquiries; your consent (e.g., certain analytics), which you may withdraw; and legal obligations.

5. Service providers / sub-processors

We share data with vendors that process it on our behalf: Cloudflare (hosting, edge compute, operational database, storage, security/analytics); Notion (CRM system of record); OpenAI (AI processing and semantic-memory/file storage used to generate responses and recall context); our email provider [Resend/Postmark/SendGrid] (verification/notification email); and analytics [Google Analytics, Cloudflare Web Analytics]. These providers act on our instructions. Where you connect a third-party AI assistant, data flows to that platform under its own terms and your authorization.

6. International transfers

Providers may process data in the United States and elsewhere; where required we rely on appropriate safeguards such as Standard Contractual Clauses.

7. Retention

Operational data (sessions, tokens, transcripts) is kept only as long as needed and may be pruned. CRM records (profile, interaction summaries, tasks, meetings) are retained for service continuity and legitimate business records unless you request deletion. We also retain data as required by law.

8. Your rights

Subject to your location, you may access, correct, delete, port, restrict, or object to processing, and withdraw consent. California residents (CCPA/CPRA) may request to know, delete, and correct personal information and to opt out of “sale”/“sharing” — which we do not do. Contact [[email protected]]; we will verify and respond within applicable timeframes. You may also complain to your supervisory authority.

9. Cookies

Strictly necessary cookies for authentication/session security, and — subject to consent where required — analytics cookies. Control cookies via your browser.

10. Security

Signed, HTTP-only session cookies, encryption in transit, OAuth 2.1 with PKCE for connector access, and scoped access controls. No method is completely secure.

11. Children

The Service is not directed to children under 16 (or the local age of digital consent) and we do not knowingly collect their data.

12. Third-party links & assistants

Third-party sites and AI assistants are governed by their own privacy practices.

13. Changes

We may update this Policy and will post the revised “Last updated” date, notifying you where appropriate.

14. Contact

[legal entity name], [address], [[email protected]].

See also our Terms of Service.