Privacy
Policy.

We collect the following categories of personal information:

• Information you provide directly: name, email address, company name, phone number, and message content when you fill in our contact form, subscribe to our newsletter, book a discovery call, or engage our services.
• Client engagement data: credentials, access tokens, analytics data, and marketing assets you share with us under a signed engagement in order for us to deliver services.
• Automatically collected data: IP address, browser type and version, device type, referring URL, pages visited, time spent, and interaction events (clicks, scroll depth), collected via cookies and similar technologies.
• Third-party platform data: when you authorise us to access platforms on your behalf (Google Search Console, Google Analytics, Google Ads, Meta Ads, WordPress, etc.), we access and process data from those platforms solely to provide the services you have requested.

We use personal information to:

• Respond to enquiries and provide the services you request;
• Deliver, maintain, and improve our automation systems and deliverables;
• Send transactional communications (account updates, service notifications, reports);
• Send marketing communications where you have opted in, with the ability to unsubscribe at any time;
• Analyse website traffic and user behaviour to improve our content and user experience;
• Comply with legal obligations, enforce our agreements, and protect our rights.

We do not sell personal information, and we do not use client engagement data to train public AI models.

Where GDPR applies, we rely on the following legal bases:

• Performance of a contract — to deliver services you have engaged us for;
• Legitimate interests — to operate our website, prevent fraud, and grow our business in a way that does not override your rights;
• Consent — for marketing emails, non-essential cookies, and optional features;
• Legal obligation — to meet tax, accounting, and regulatory requirements.

We use cookies and similar technologies to operate the site, remember preferences, analyse traffic, and measure marketing performance. These include:

• Strictly necessary cookies — required for the site to function;
• Analytics cookies — Google Analytics 4, which processes data in anonymised form;
• Marketing cookies — attribution and UTM tracking for campaign measurement.

Analytics and marketing cookies stay off unless you accept them in the cookie notice shown on your first visit. If you refuse, they are never loaded. You can also control cookies through your browser settings. Blocking some cookies may affect site functionality.

Page counts without cookies. Separately from cookies, we count page views for every visit so we know how much the site is used and which pages are read. Each page load adds one to a daily total, together with the address of the page (without anything after the question mark), the name of the website that referred you, any campaign tags on the link you followed, whether that link came from an advertisement, and whether you are on a phone, a tablet or a computer. We also keep a tally of how often the cookie notice is accepted, refused or left unanswered.

This count sets no cookie, stores nothing on your device and assigns you no identifier. Your IP address and browser details are not stored with it. The totals cannot be used to recognise you or to follow you from one visit to the next. Because the count identifies no one, it runs whether or not you accept cookies.

We share personal information only in the following circumstances:

• Service providers and sub-processors who help us operate our business, including cloud hosting (Google Cloud Platform, DigitalOcean), email delivery (Gmail/Google Workspace), analytics (Google Analytics), CRM and project management (ClickUp, Airtable), AI processing (Anthropic, OpenAI), and communication platforms. These providers are bound by contractual confidentiality and data-protection obligations.
• Platform integrations you authorise — when you connect a third-party account (e.g. Google Search Console, WordPress), data flows between that platform and our systems under your authorisation.
• Legal and safety — where required by law, court order, or to protect our rights, users, or the public.
• Business transfers — in the event of a merger, acquisition, or sale of assets, subject to the protections in this Policy.

We do not sell or rent personal information to third parties.

We are based in Canada, and the service providers we rely on may store and process data in the United States, the European Union, and other jurisdictions. Where personal information is transferred across borders, we rely on appropriate safeguards such as Standard Contractual Clauses and the privacy programs of the underlying providers.

We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, including legal, accounting, and reporting requirements. Contact-form submissions are typically retained for 24 months; active client engagement data is retained for the duration of the engagement plus 7 years for accounting and legal reasons; newsletter subscribers are retained until they unsubscribe.

Depending on your jurisdiction, you have the right to:

• Access the personal information we hold about you;
• Request correction of inaccurate or incomplete information;
• Request deletion of your personal information, subject to legal retention requirements;
• Object to or restrict certain processing activities;
• Withdraw consent at any time where processing is based on consent;
• Request a portable copy of your information;
• Lodge a complaint with a supervisory authority (in Canada, the Office of the Privacy Commissioner; in Quebec, the Commission d'accès à l'information).

To exercise any of these rights, email martin@botonomy.ai. We will respond within 30 days.

We implement technical and organisational safeguards to protect personal information, including encrypted transport (HTTPS/TLS), access controls, secret management, principle-of-least-privilege access for team members, and regular review of our third-party providers. No system is perfectly secure, and we cannot guarantee absolute security, but we work to protect data to the standard a reasonable provider in our sector would apply.

Our services are directed at businesses and not at children. We do not knowingly collect personal information from anyone under the age of 16. If you believe we have collected information from a child, please contact us and we will delete it.

Our website and services may link to or integrate with third-party platforms including X (Twitter), LinkedIn, Meta, Google, Anthropic, OpenAI, and others. Those platforms are governed by their own privacy policies. We are not responsible for the practices of third-party services, and we encourage you to review their policies before interacting with them.

We may update this Privacy Policy from time to time. Material changes will be posted on this page with an updated "Last updated" date. Continued use of our website or services after changes take effect constitutes acceptance of the updated Policy.

For any privacy-related question or request, contact: