Privacy, in plain language — without the dark patterns.

When you submit a contact form or start a brief, we collect your name, email address, and message. That data goes into our brief intake system, where the editor on duty reads it. It is not shared with a marketing platform, a CRM vendor, or an advertising network. It is read by a person and used to respond to you.

The Concierge chatbot on this site processes your messages in memory only. Transcripts have a one-hour TTL — after that they are deleted from the session and not stored anywhere. We do not log chatbot conversations to a database, and the model (Qwen 32B, self-hosted in Michigan) does not retain them. What you type to the Concierge is gone within the hour.

We collect server logs in the standard format — IP addresses, request paths, HTTP status codes, timestamps. We use these to monitor for abuse and to diagnose infrastructure issues. They are not used for analytics, are not shared with third parties, and are rotated on a standard schedule.

When our operators do work for you, they handle whatever data you put in front of them — inboxes, ledgers, CRM records, call recordings, customer data, financial statements. That data belongs to you. We process it on your instructions and for no other purpose.

Every operator assigned to a client engagement signs our standard confidentiality agreement before they touch the workstream. The section editor who reviews the work is bound by the same agreement. Data that appears in the editorial review cycle — a sample of calls, a portion of a ledger — is handled under the same confidentiality terms as the underlying work.

For clients who are subject to GDPR, we operate as a data processor under Article 28. We will sign a Data Processing Agreement on request; our standard DPA is available from the editor on duty. We do not rely on Standard Contractual Clauses for transfers to the Philippines — the Philippines has an adequacy-equivalent framework under the Data Privacy Act of 2012 and NPC issuances, which we comply with.

You have the right to request access to data we hold about you, to correct inaccuracies, to request deletion (subject to our legal retention obligations), and to receive an export in a machine-readable format. Email [email protected] with your request. We respond within five business days, Manila time.

GDPR-specific rights: if you are based in the EU, you additionally have the right to restrict processing, to object to processing, and to lodge a complaint with your supervisory authority. Our Data Protection Officer function is handled by Andre Lazaro; the contact is the same address above.

CCPA-specific rights: if you are a California resident, you have the right to know what personal information we collect, to delete it, and to opt out of any sale. We do not sell personal information, so the opt-out is already in effect. To exercise your other rights, use the same email address.

We set one cookie: a session cookie for the Concierge chatbot, created only when you open it. It holds the session identifier so the chatbot remembers your conversation within the browser tab. It is set with SameSite=Lax and does not persist beyond the browser session. It is not a tracking cookie. No third-party cookies are set on this site.

If you never open the chatbot, no cookie is set at all.

If we make a material change to this policy — adding a new sub-processor, changing retention periods, or adding any form of tracking — we will email every active client thirty days before the change takes effect. The email will describe exactly what changed. Changes will not apply retroactively to engagements that predate the effective date of the revision.

Typographical corrections and clarifications that do not change the substance of the policy take effect on publication without prior notice. The effective date at the bottom of this page reflects the date of the last material change.