Legal
Data statement.
Every engagement starts with an export of your records. This is what happens to it, in writing, and it is incorporated by reference into every engagement agreement we sign.
The principle
Client data is used for the engagement it was sent for and nothing else. We do not keep it beyond the work, sell it, train on it, or share it. Everything below is how we make that true.
1. What we ask for
A structured export of records your team already keeps, typically twelve to twenty-four months of quotes, invoices, orders, routing, contracts, or the equivalent for your business. We ask for the minimum needed to size the opportunities in scope. We never ask for credentials, and we never connect to your systems. Nothing is installed on your side.
2. How it arrives
By encrypted transfer to a workspace that exists only for your engagement. We do not accept client records by email, and if a file arrives that way we delete it and ask for it again through the transfer link.
3. Where it lives
In an isolated, access-controlled workspace, encrypted at rest and in transit, that holds one client’s records and no one else’s. Access is limited to Justin Jarvinen and, where an engagement needs it and you have agreed in writing, a named contractor bound by the same confidentiality terms.
4. How it is used
To find, size, and test the opportunities in the signed scope, and to build the mechanism you have chosen to build. Analysis is run by our own tooling and by AI models. Where a third-party model provider is used, it is accessed only through commercial or enterprise services whose terms prohibit training on your data, configured for the shortest data retention that service allows. We name the providers in your engagement agreement. Your records are never used to train any model, ours or anyone else’s, and never inform work for another client.
5. What is not done with it
It is not sold, licensed, shared, benchmarked, aggregated with other clients’ data, or used to market to you or anyone else. Findings are not published or referenced, even anonymized, without your written approval. The four companies shown on our Work page are there because they are ours or because the client approved it.
6. How long it stays
Records are deleted from the engagement workspace within thirty days of the engagement closing, whether it closed with a build or with a written reason to stop, unless you ask us in writing to keep them for a defined further period. Deletion covers working copies, intermediate outputs, and backups on their normal cycle, and we confirm it to you in writing.
7. What you keep
Everything. The Opportunity ID, the mechanism we build, its source and documentation, and the records themselves remain yours. On request we will return or destroy any copy at any point during the engagement.
8. If something goes wrong
If we become aware of unauthorized access to your records, we tell you within seventy-two hours with what we know, what we have done, and what we recommend, and we cooperate with any notification you are required to make.
9. Your rights and ours
You may audit our handling of your records on reasonable notice. We may refuse an engagement, or stop one, if the records offered would require us to break this statement, for example data we are not permitted to process. This statement is incorporated into every engagement agreement and, where it is stricter than the agreement, this statement controls.
Last updated September 23, 2026