Privacy Policy

Introduction

Corduroy Technologies ("Corduroy," "we," "our," or "us") helps small and mid-sized businesses turn the data they already have into a clear plan and steady progress. Doing that well means handling sensitive business information, and we take that seriously.

The short version:

• Your data stays yours. We use it only to deliver the services you engage us for, and you can export or delete it.
• We never sell data, never combine one client's data with another's, and never use client data to train AI models.
• Connections to your business systems are read-only and under your control. You can disconnect at any time, and we delete the access tokens immediately.
• Each client's data lives in its own dedicated, encrypted storage in the United States.
• Meeting recordings and transcripts are opt-in.

The rest of this policy explains the details. It applies to our website, our platform, and our advisory services. Our Client Data Security Commitment describes the technical protections behind these promises.

Who this policy covers

We handle four kinds of information, and we treat each differently:

Our services are offered to businesses in the United States. They are not intended for consumers or for individuals acting outside a business context.

Information we collect

From website visitors

When you visit our website, we and our analytics providers automatically collect:

• Browser type, operating system, device type, and time zone
• IP address and approximate location derived from it
• Pages visited, links clicked, time on page, and how you navigate the site

From prospective clients and business contacts

We collect the information you give us when you book a call, fill out a form, or email us. This includes your name, business email, phone number, company, and role. We also get business contact information from professional data providers to reach businesses that may benefit from our services, and we record how you engage with our emails.

From platform users

We collect the minimum needed to run your account: your name, business email address, and access level. We also log sign-ins and activity in the platform for security and auditing.

From clients (Client-Provided Data)

This is the business information you share with us or connect to the platform. It can include:

• Financial records, such as accounting data from QuickBooks Online
• CRM, sales, and pipeline data, such as records from HubSpot
• Membership, booking, and operational data from industry systems
• Spreadsheets, documents, and reports you upload
• Notes, recordings, and transcripts from meetings you choose to share (see Meeting recordings and transcripts)
• Goals, plans, and progress updates you enter in the platform

Please don't upload Social Security numbers, payment card numbers, bank account numbers, or health information unless we've specifically agreed it's needed. Our services don't require them.

Connected systems and the Vault

Clients can connect business systems to Corduroy so we can work from current data rather than old exports. Today we support QuickBooks Online and HubSpot, and we plan to add more over time.

How connections work

• You authorize every connection. You grant access through the provider's own sign-in and permission screen (OAuth). Some providers use their own approval process instead.
• Access is read-only. We request only the permissions needed to read the data used in your engagement. We do not create, change, or delete anything in your systems.
• You can disconnect at any time. You can disconnect in the platform or by asking your advisor. You can also revoke access from the provider's side. When a connection ends, we revoke and delete the stored access tokens immediately.
• Credentials are protected. We never ask for or store your passwords to connected systems. We store access tokens encrypted and use them only to retrieve your data.

The Vault

All Client-Provided Data is stored in the Corduroy Vault. Each client gets its own dedicated, encrypted storage, separate from every other client, and access-authorized through proprietary and encrypted channels. The Vault is hosted on Amazon Web Services in the United States, in the US East (Northern Virginia) region by default. Other US regions are available on request.

We keep the original files and records you provide in the Vault. We also create derived information from them, such as summaries, extracted metrics, KPI figures, audit findings, and plan content. Derived information is stored with your data and is subject to the same protections. We keep non-sensitive information like task completion and logged activity in a separate database outside the Vault.

Meeting recordings and transcripts

Recording is always optional. In discovery interviews and check-ins, conversations with your advisor or your clients and customers can be recorded and transcribed. This helps us capture the context that numbers alone miss.

• Opt-in only. We record or transcribe a meeting only when you agree to it. We ask everyone in the meeting for consent before recording starts.
• Your choice of tools. You choose which note-taking or transcription tools are used, such as Zoom's built-in transcripts or other note-taking apps. You also choose which of their outputs, if any, are shared with Corduroy. Those tools are governed by their own privacy policies.
• Same protections as your other data. Shared transcripts and recordings are stored in your Vault. They are used only for your engagement and are covered by the same retention and deletion terms.
• You can stop at any time. You can withdraw consent for future recordings at any time and ask us to delete past ones.

How we use AI

We use large language models (LLMs) to help analyze your data, draft audits and plans, and summarize progress. Experienced advisors review the work before it reaches you.

• Controlled access. AI models never connect to your Vault directly. A controlled retrieval layer sends each request only the information needed for that specific task. The model's output is saved back to your Vault through the same layer.
• Enterprise API providers. We use models from established AI providers through their commercial APIs, not consumer chat products. Clients can request the current list.
• No training. Under the commercial terms we use, these providers do not use your data to train their models. Corduroy does not train or fine-tune any AI model on Client-Provided Data. Your data is used only as context for the request being processed.
• Provider retention. Under their standard terms, model providers may keep request data for a limited period for security and abuse monitoring, and then delete it. If you request zero data retention, we will route your engagement through API configurations where the provider does not retain request data. In that case, the request is discarded once the response is returned.
• Human oversight. AI output is a starting point. Your advisor reviews audits, plans, and recommendations before they are delivered to you.

How we use information

Client-Provided Data is used only to deliver the services you engage us for:

• Analyzing performance and producing your audit
• Building and updating your 90-day plan, KPIs, and dashboards
• Coaching, check-ins, and advisor review of your progress
• Keeping your data current and flagging gaps

We do not use Client-Provided Data for advertising, for marketing to anyone, or for any purpose unrelated to your engagement.

From time to time we may want to use your information for marketing and trend-related data to be shared with the public. We will not use your information or data in this respect without your express written permission.

Website, prospect, and platform-user information is used to:

• Operate, secure, and improve our website and platform
• Understand how visitors use our site
• Respond to inquiries, schedule calls, and send information about our services (you can opt out of marketing emails at any time)
• Manage accounts and access permissions
• Detect and prevent fraud, abuse, and security incidents
• Comply with legal obligations

Sharing and service providers

Access to Client-Provided Data is limited to:

• Authorized Corduroy personnel working on your engagement. They are bound by confidentiality obligations, and every access is logged.
• Service providers that process data on our behalf under contractual confidentiality and security obligations. None of them may use your data for their own purposes.

We use service providers in these categories:

• Cloud hosting and storage. These run our website, platform, database, and the Vault, all within the United States.
• AI model providers. They process Client-Provided Data sent as task context through their commercial APIs (see How we use AI).
• Sales and marketing tools. We use them for our own outreach and scheduling. They handle prospect and contact information only, never Client-Provided Data.
• Website analytics. These handle website usage data only.

Clients can request a current list of the service providers that handle Client-Provided Data by emailing privacy@corduroytech.ai. We will notify clients before adding a new provider that will handle their data.

Apart from these providers, we disclose information only when you direct us to, when the law requires it, to protect rights and safety, or as part of a merger or acquisition. In an acquisition, this policy would continue to apply to your data.

No sale, no combining, no training

These commitments apply to all Client-Provided Data:

• We never sell, rent, or trade it.
• We never combine one client's data with another's. This covers anonymized or aggregated forms too, including benchmarks.
• We never use it to train or fine-tune AI models. That includes our own models and anyone else's.

We would change any of these only with a client's explicit written agreement, and only for that client's data.

Security

We protect Client-Provided Data with the following technical and organizational safeguards:

• Dedicated, isolated storage for each client
• Encryption in transit and at rest
• Role-based access with multi-factor authentication for Corduroy staff
• Short-lived, logged access to individual files
• An audit trail of uploads, retrievals, and access events

Our Client Data Security Commitment describes these protections in detail. If we confirm a security incident involving your data, we will notify you within 72 hours and provide a written incident report.

Retention, deletion, and return of data

We keep Client-Provided Data only for the length of your engagement. When it ends, we delete it.

During your engagement

You can delete any original file or record from your Vault at any time. Deleting an original does not change audits, plans, metrics, or other information already derived from it. You can ask us to review or remove derived information too. You can request a full export of your data at any time.

When your engagement ends

1. All platform access and system connections end, and stored access tokens are deleted.
2. Your Vault data is removed from active systems. We keep a secured archive offline for 30 days.
3. During those 30 days, we can deliver a full copy of your data to a secure destination you choose.
4. After 30 days, the archive is permanently deleted, and we confirm the deletion in writing.

Other information

We delete platform-user accounts when a client removes the user or the engagement ends. We keep website and prospect information only as long as it is useful for the purposes described here, and you can ask us to delete it sooner. We may keep limited records longer, such as security logs, invoices, and contracts, when the law requires it or to protect against fraud and security threats.

Cookies and analytics

Our website uses cookies and similar technologies to work properly and to help us understand how visitors use it. We currently use:

• Google Analytics. Measures traffic and page usage.
• HubSpot tracking. Connects website visits to inquiries and email engagement from our own outreach.
• Microsoft Clarity. Records anonymized interaction data, such as clicks, scrolling, and session replays, to help us improve usability. It is configured to mask text that visitors type.
• Calendly. Powers call scheduling.

We may test other analytics tools and will update this list when we adopt them. We do not use cookies on the website for third-party advertising. Analytics are not used inside client Vault data.

You can block or delete cookies in your browser settings. You can also use Google's opt-out browser add-on for Google Analytics. Some site features may not work without cookies.

Your choices and rights

Depending on the state where you live, you may have the right to:

• Access the personal information we hold about you
• Correct information that is inaccurate
• Delete your personal information
• Receive a portable copy of your information
• Opt out of marketing communications

To exercise any of these rights, email privacy@corduroytech.ai. We will verify your request and respond within the time the law requires. We will not treat you differently for exercising your rights.

Marketing emails

Every marketing email we send includes an unsubscribe link. You can also email us to be removed from our outreach lists.

If your information is in a client's data

Your information may be included in data a Corduroy client shares with us, for example as a customer, member, or employee of that business. In that case, please contact that business directly, because it controls the data. If you contact us, we will forward your request to the client and help them respond.

Clients

Clients can export, correct, or delete their data, disconnect systems, and manage user access at any time. Use the platform or contact your advisor.

Children

Our website and services are for businesses. They are not directed to children, and we do not knowingly collect personal information from anyone under 16.

Changes to this policy

We will update this policy as our services change, such as when we add new connected systems or service providers. We will post each change here and update the date at the top. If a change materially affects how we handle Client-Provided Data, we will notify clients directly before it takes effect.

Contact us

Questions about this policy or our data practices can go to:

Corduroy Technologies
privacy@corduroytech.ai