Who this notice covers
Website contact-form inquiries are stored in a private Cloudflare database and delivered to FenixLore through Telegram. The form sends your name, email, optional company and message. Please do not include confidential client information.
This notice explains how [COMPANY NAME] LLC ("we," "us") handles personal information. It applies to:
- our website;
- people who contact us or work with us as prospects, clients, or vendors; and
- the limited access we have to a client's systems while we build or support their AI tools.
We build private AI systems for businesses. Those systems run on the client's own servers or in the client's own cloud account. This notice does not replace any contract we sign with a client.
Two roles: who decides what happens to the data
We act in one of two roles. The role depends on whose data it is.
A. Our client decides (we are a service provider or processor)
When we work inside a client's systems, the client decides why and how its data is used. We act only on the client's written instructions. This covers client files, emails, customer records, patient or matter records, transcripts, and anything else in the client's environment.
B. We decide (we are the controller or business)
For our own website, sales, billing, and correspondence, we decide how the information is used.
If you are a client's customer, patient, employee, or contact, your relationship is with that client. Please send requests about the client's files to the client. See section 11.
What we handle
| Category | Examples | Our role |
|---|---|---|
| Contact and inquiry details | Name, work email, company, phone, what you wrote in a message or form | We decide (controller) |
| Business correspondence and scheduling | Emails, call notes, meeting times, shared documents you send us | We decide (controller) |
| Billing and contract records | Invoices, payment status, signed agreements, tax records | We decide (controller) |
| Website and device data | IP address, browser type, pages requested, basic server logs | We decide (controller) |
| Marketing preferences | Whether you asked us to stop emailing you | We decide (controller) |
| Client business data | Files, email, CRM and industry-system records, scans, call transcripts, spreadsheets inside a client's environment | The client decides; we only access it for setup and support |
| Client credentials and access logs | Accounts the client issues to us; records of what we did | The client decides; we follow the client's instructions |
| Temporary working copies for a defined task | Only when the client's written project plan allows it. For example, a short data-cleanup job. Includes local history kept by AI coding tools while the task runs | The client decides; covered by our client agreements and, where it applies, a data protection agreement |
We do not ask for sensitive information through our website. Please do not put health, financial-account, or government ID details in the contact form.
Where the information comes from
- From you. When you fill in a form, send an email, book a call, or sign a contract.
- From your business. When your company gives us access to its systems for a project.
- From public business sources. Company websites, professional profiles, and similar pages, used to write relevant outreach to business contacts.
- From your browser. Standard technical data that any web server receives.
- From service providers. For example, a payment processor confirming a payment.
Why we use it
We use personal information to:
- answer your questions and schedule calls;
- scope, price, and deliver projects;
- set up, secure, and support AI systems in a client's environment;
- send invoices and keep financial records;
- keep our website and tools secure and working;
- send business updates, if you have not opted out (see section 8);
- meet legal duties and resolve disputes.
We do not use client data for marketing, profiling, resale, or model training. We do not combine client data with our own prospect lists.
When we disclose it
We do not sell personal information. We share it only in these cases, and only in categories:
- Service providers that help us run the business. Examples: email and calendar tools, document storage, accounting and payment tools, website hosting, and security tools. They may use the information only to provide their service to us.
- The client's own providers. In a client's environment, data may flow to the client's own cloud and AI model providers. The client has its own contract with those providers.
- Professional advisers. Lawyers, accountants, and insurers.
- Legal and safety reasons. To follow the law, respond to valid legal process, or protect rights and safety.
- Business changes. If we merge or sell the business, records may move to the new owner under terms at least as protective as this notice.
- With your direction. When you ask us to share.
A list of our current subprocessors and service providers is available on request at [email protected].
Artificial intelligence
This section explains how AI fits into our work.
No training on client data
Client data is never used to train or improve an AI model, by us or anyone else. We only configure models whose provider terms or account settings rule out training on the content sent to them.
Processing happens in the client's environment
The AI system runs on the client's servers or in the client's own cloud account. The index, the stored text, and the logs stay there. The client holds the contracts and accounts with its model and cloud providers.
Only the relevant passages go to a model
When someone asks a question, the system searches the client's private index first. It then sends only the few passages that matter to the model. It does not send whole files or the whole archive. This keeps each request small and limits what leaves the index.
Permissions come along
Where the source system allows it, the assistant respects the permissions already set in that system. A person should only get answers drawn from content they could already open. The client reviews and owns those settings.
Logging
The client's environment can keep records of who asked what. The client controls those logs and how long they are kept.
Models can be wrong
AI output can be incomplete or incorrect. People should check important answers against the source. Our systems show where an answer came from so that checking is possible.
Our own use of AI tools
We may use AI tools for our own internal work, such as drafting. We also use AI coding assistants to help build and debug the connectors and code we write for clients. We use them only on plans where the provider does not train on what we send. They see code, settings, field names, made-up sample data, and error messages with record contents removed. Live client data never goes into them. Our client agreements describe this in detail. We do not put client data into public consumer chat tools.
Choices and rights
You may ask us to:
- tell you what personal information we hold about you;
- correct it;
- delete it; or
- give you a copy.
Write to [email protected]. We may ask for details to confirm who you are. If you use an agent, we may ask for proof that you allowed it. We will not treat you worse for making a request.
We reply within the time the law requires, and in most cases within 45 days. If we cannot do what you ask, we will say why. If you disagree, reply and ask us to review the decision. If you are still not satisfied, you may contact your state attorney general. [CONFIRM WITH ATTORNEY: appeal wording and any state-specific rights.]
Some requests cannot be fully met. For example, we may need to keep tax and contract records, or information needed to defend a legal claim.
How long we keep it
| Category | How long |
|---|---|
| Website inquiries that do not lead to work | Up to 24 months after the last contact, then deleted |
| Prospect and correspondence records | Up to 24 months after the last contact |
| Client contracts, invoices, and tax records | At least 7 years, or as the law requires |
| Marketing opt-out record | Kept while needed to honor your request |
| Website server logs | Up to 90 days |
| Client credentials we hold during a project | Removed or revoked when the project or support period ends |
| Client business data | We do not store it on our systems. It stays with the client. Where a written project plan allows temporary working copies, they are kept to the minimum, protected, and deleted no later than 10 business days after the task is complete or at the end of the project, whichever is first, including local history from AI coding tools |
[CONFIRM WITH ATTORNEY: all periods above.] Backups of our own systems may keep records for a short time after deletion, until they roll off on a normal schedule.
Requests about a client's data
If your information sits in a client's files, the client is in charge of it. Please send your request to that client.
If you send it to us, we will not act on the client's data ourselves. We will pass the request to the client, unless the law or the contract does not allow it, and we will help the client respond if it asks. Our agreements with clients say we will assist with these requests.
Security
We use safeguards that fit the size and sensitivity of the information. They include:
- multi-factor sign-in on our accounts;
- encrypted devices and encrypted connections;
- least-privilege access: we ask clients for narrow, logged, revocable credentials, and we use them only for the agreed work;
- no local copies of client data unless a written project plan allows it, and then only on encrypted devices, never on removable media or personal cloud-sync folders, and deleted after the task ends;
- AI coding tools used only under commercial no-training terms, with client data kept out of them unless the client's project plan allows it;
- separate work accounts, and prompt removal of access when work ends;
- reviews of the tools and providers we use.
No system is perfectly secure. If we learn of a problem that affects your information, we will tell the affected client or you, as the law and our contracts require.
Where information is handled
We handle our own business records in the United States. Client data stays where the client puts it, usually in a United States server or cloud region the client chooses. Ask us for our provider list and locations at [email protected].
Legal scope
[COMPANY NAME] LLC is a North Carolina limited liability company. Our services are for businesses and organizations.
We do not rely on a blanket exemption for business-to-business contacts. We handle the information in this notice with care, whether or not a particular state law covers it. A data processing addendum is available to clients on request, and a business associate agreement can be signed where the law requires one and we could access protected health information.
Nothing here claims that we meet any particular legal standard or certification. Each client decides what its own rules require.
Changes to this notice
We may update this notice. We will change the "Last updated" date at the top. If a change is material, we will tell active clients by email and post a notice here before it takes effect.
Contact
[COMPANY NAME] LLC
[STATE ADDRESS]
Email: [email protected]