Privacy Policy

1. Introduction

AI Advisor Lab ("we," "our," or "us") is committed to protecting your privacy and personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website or use our services.

2. Information We Collect

2.1 Personal Information

• Contact Information: Name, email address, company name, phone number
• Professional Information: Job title, industry, company size, business requirements
• Communication Data: Messages, queries, and correspondence with our team

2.2 Technical Information

• Device Data: IP address, browser type, device information, operating system
• Usage Data: Pages visited, time spent, click patterns, session recordings
• Cookies: Session cookies, preference cookies (see Cookie Policy below)

3. How We Use Your Information

• Service Delivery: Provide AI advisory services and custom team generation
• Communication: Respond to inquiries, provide updates, and customer support
• Improvement: Enhance our services, website functionality, and user experience — using aggregated, anonymized usage metrics (counts and timings) only, never the content of your conversations, materials, or reports
• Legal Compliance: Meet legal obligations and protect our rights
• Marketing: Send relevant updates and promotional materials (with consent)

3.1 We Do Not Train AI Models on Your Content

Your content is never used to train, fine-tune, or improve any AI model — ours or a third party's. Your prompts, uploaded materials, conversations, and generated reports reach AI providers only through commercial API endpoints governed by terms that prohibit those providers from training on the data. Personal information is automatically redacted from content before it is transmitted to any AI provider.

If you supply your own AI provider API keys (available on Professional plans and above), your requests run under your own provider account and that provider's terms, which you control.

4. Data Sharing and Third Parties

4.1 Service Providers

Service	Provider	Purpose	Data Shared
AI Processing	Anthropic PBC (Claude API)	Advisory analysis, materials and image analysis, report generation	Your prompts, the relevant parts of uploaded materials and conversation, and images. Personal information is automatically redacted before transmission.
AI Research (Deep Research) & Image Generation	Google LLC (Gemini API)	Deep Research and image generation, when you enable them	Research topics and generation requests. Runs on platform credentials by default, or on your own key if you supply one.
AI Research (web)	Perplexity AI	General web research, when you enable it	Research queries only — never conversation history or uploaded materials
Payments	Stripe, Inc.	Subscription billing on paid plans	Billing identity and subscription data. Card details are entered into Stripe directly and never reach our servers.
External data sources (opt-in)	The public or commercial data APIs you enable under Data Ingestion	Retrieving reference data for your analysis	Only the derived search query or topic. No conversation history, no uploaded materials, no account identity.
Websites you ask us to analyze (opt-in)	The third-party website you name	Retrieving publicly-available pages so a report can state what was actually found	Ordinary public web requests identifying our platform and a contact address. None of your content is sent.
Cloud Infrastructure	Amazon Web Services (AWS), us-east-1	Hosting, storage, CDN, edge security (WAF)	Technical data, IP addresses, stored content
Analytics	Google LLC (Google Analytics 4)	Aggregate usage measurement	IP address, pseudonymous device/session identifiers. If you are in the European Economic Area, the United Kingdom or Switzerland, analytics is loaded only after you opt in via our cookie banner. Elsewhere, analytics is enabled by default and you may switch it off at any time using the same banner (“Reject All”, or by unticking Analytics), or by sending a Global Privacy Control (GPC) signal, which we honor automatically. Advertising and ad-personalization signals are disabled in every region.
Web Fonts	Google LLC (Google Fonts)	Typography delivery	IP address at time of font fetch
Bot Protection	Google LLC (reCAPTCHA v3)	Contact-form anti-abuse	IP address, device signals, interaction data
Payment Processing	Stripe, Inc.	Subscription billing and checkout	Name, email, billing details (card data handled by Stripe, PCI-DSS scope)
Identity / Authentication	Amazon Web Services (AWS Cognito)	Platform login, TOTP MFA, session tokens	Email, password hash, MFA secret
Email Services	Professional transactional-email providers	Platform and support notifications	Contact information, message metadata

Note on analytics/advertising cookies under CPRA: We do not sell personal information for money. If the narrow CPRA definition of "sharing" (cross-context behavioral advertising) applies to any analytics configuration, we disable that configuration and honor Global Privacy Control (GPC) browser signals where present.

5. Data Retention

Data Type	Retention Period	Purpose
Contact Form Data	24 months	Customer service, follow-up
Session Cookies	Browser session only	Website functionality
Analytics Cookies	2 years	Usage analysis
Platform account data	Life of the account, plus 30 days after a deletion request	Service delivery
Platform conversations, projects, uploaded materials and reports	365 days by default; an organization administrator can set 30 days to 7 years	Service delivery
Audit and governance records	7 years, in write-once storage (cannot be deleted early, including by us)	Regulatory and evidentiary obligations
Usage metrics	Aggregated and anonymized after 90 days	Capacity planning, billing accuracy
Operational and security logs	90 days	Security monitoring, troubleshooting
Communication Records	3 years	Legal compliance, support

6. Your Rights (GDPR & CCPA)

6.1 European Union Residents (GDPR)

If you are located in the European Union, you have the following rights:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate or incomplete data
• Erasure: Request deletion of your personal data
• Data Portability: Receive your data in a machine-readable format
• Object: Object to processing of your personal data
• Restrict Processing: Limit how we use your data
• Withdraw Consent: Withdraw consent for processing (where applicable)

6.2 California Residents (CCPA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA):

• Right to Know: Request disclosure of personal information we collect, use, disclose, and sell
• Right to Delete: Request deletion of personal information we have collected
• Right to Opt-Out: Opt-out of the sale of personal information (Note: We do not sell personal information)
• Right to Non-Discrimination: Equal service and pricing regardless of exercising privacy rights
• Right to Correct: Request correction of inaccurate personal information
• Right to Limit Use: Limit use and disclosure of sensitive personal information

Categories of Personal Information Collected: Contact information, professional information, internet activity, and inferences drawn from this information.

Sensitive Personal Information (Cal. Civ. Code §1798.140(ae)): We do not collect government identifiers, precise geolocation, account credentials for third-party accounts, genetic or biometric data, health or sexual-orientation information, or the contents of private communications through this website. If such information is ever submitted through the contact form or platform, we treat it as Sensitive PI and do not use it for inferring characteristics.

Your Privacy Choices / Do Not Sell or Share My Personal Information: AI Advisor Lab does not sell personal information for money. We do not "share" personal information for cross-context behavioral advertising as defined under the CPRA. You can submit a privacy request at privacy@aiadvisorlab.ai or via our contact form. We honor Global Privacy Control (GPC) signals as an opt-out preference where applicable.

To exercise your CCPA/CPRA rights, email privacy@aiadvisorlab.ai or info@aiadvisorlab.ai. You may also designate an authorized agent to act on your behalf.

7. Cookie Policy

7.1 Essential Cookies

These cookies are necessary for the website to function and cannot be disabled:

• Session Management: Keep you logged in and maintain preferences
• Security: Protect against cross-site request forgery (CSRF)
• Load Balancing: Ensure optimal performance

7.2 Analytics Cookies (Optional)

These cookies help us understand how visitors use our website:

• Usage Tracking: Pages visited, time spent, user flows
• Performance Monitoring: Page load times, error rates
• Feature Usage: Which features are most popular

8. International Data Transfers

Your personal information may be transferred to and processed in countries other than your own, including the United States. We ensure compliance with GDPR Articles 44-49 through the following appropriate safeguards:

• Standard Contractual Clauses (SCCs): We use the European Commission's approved SCCs (Decision 2021/914/EU) with all third-country processors
• Adequacy Decisions: Where available, we rely on European Commission adequacy decisions under GDPR Article 45
• Supplementary Measures: Additional technical and organizational measures as recommended by EDPB guidelines, including:
  • End-to-end encryption in transit and at rest
  • Pseudonymization and data minimization techniques
  • Regular assessment of third-country legal frameworks
  • Data localization where legally required
• Transfer Impact Assessments: Regular evaluation of transfer risks and safeguard effectiveness under GDPR Article 35
• Data Subject Rights: Full exercise of GDPR Chapter III rights regardless of processing location

Primary Transfer Destinations: United States (AWS us-east-1), with data processing agreements ensuring GDPR compliance standards.

9. Data Security

We implement layered technical and organizational measures to protect your information:

• Encryption in transit: TLS 1.2 minimum with TLS 1.3 supported, enforced at the load balancer for every public endpoint.
• Encryption at rest: AES-256 on S3, DynamoDB and RDS. Platform project content and the identity, audit, token, usage and tenant-metadata stores are encrypted under customer-managed AWS KMS keys with automatic annual rotation; audit records are additionally held in write-once storage under a compliance-mode retention lock.
• Authentication: AWS Cognito with RS256-signed JWTs; multi-factor authentication enforced platform-wide since April 5, 2026, with an authenticator app (TOTP) as the required factor and SMS available as an additional enrolled factor; passwords require at least 12 characters across four character classes; httpOnly and Secure session cookies with a SameSite policy, so session tokens cannot be read by page scripts.
• Edge security: AWS WAF on the application load balancer — rate limiting, IP-reputation blocking and exploit-probe rules, plus the AWS Managed Rule Groups (Common, Known Bad Inputs, SQL Injection), all in active blocking mode. Specific thresholds and rule tuning are deliberately not published, because doing so would help an attacker calibrate beneath them.
• Tenant isolation: Three-layer enforcement (database partition keys, application-level tenant checks, runtime assertions) with audit logging of cross-tenant access attempts. The tenant identity is always derived from your verified sign-in, never from anything the browser supplies. This separation is enforced by the application within shared cloud infrastructure — it is not a dedicated cloud account, database or encryption key per customer; dedicated tenancy for regulated workloads is available by separate agreement.
• Audit logging: SHA-256 tamper-evident audit chain for privileged actions and notification delivery; CloudWatch log retention.
• Monitoring & response: CloudWatch alarms, GuardDuty, documented Incident Response Plan aligned with NIST SP 800-61; 72-hour GDPR Art. 33 breach-notification commitment.
• Compliance alignment: Controls mapped to SOC 2, NIST CSF 2.0, OWASP ASVS L2, and AWS Well-Architected. We hold no certification of our own — not SOC 2 Type II, ISO 27001, ISO/IEC 42001, HIPAA or PCI DSS. Our cloud provider holds such certifications for the infrastructure layer, which is not the same as certification of this service. We do not offer a Business Associate Agreement, so the platform should not be used for protected health information. We will undertake a formal audit where a customer's procurement process requires it.
• Resilience limits: Recovery relies on point-in-time recovery and object versioning rather than a separate backup vault, and there is no cross-region disaster recovery — a prolonged failure of the us-east-1 region would cause an outage.
• Data minimization: We collect only what is needed and redact PII before passing queries to AI sub-processors where feasible.

10. Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in our practices or legal requirements. We will notify you of any material changes by:

• Posting a notice on our website
• Sending an email to registered users
• Updating the "Last Updated" date at the top of this policy

11. Contact Information

12. Trademarks

All third-party trademarks referenced on this site are the property of their respective owners; any such references are nominative fair-use and do not imply endorsement, sponsorship, or affiliation.

13. Supervisory Authority

If you are not satisfied with our response to your privacy concerns, you have the right to lodge a complaint with your local supervisory authority. For EU residents, you can find your local authority at: https://edpb.europa.eu/about-edpb/members_en