Privacy Policy

This Privacy Policy describes how Pivotmark — a fractional Chief AI Officer (CAIO) and AI strategy consulting practice — collects, uses, retains, and protects the personal information you share with us through this website. It applies to the information you submit directly (such as questions you send through the /contact discovery form and the time-slot you book through /schedule) and to information we collect automatically when you browse the site (such as basic server logs).

If you become a Pivotmark client, a separate engagement-specific data processing addendum (DPA) and statement of work will govern the information you share under that engagement and will take precedence over this page for that material.

When you submit the /contact discovery form, we collect the fields you provide — typically your name, work email, company, role, company-size band, and a short description of the AI outcome you want to advance. We store this submission in our internal lead-tracking system so the founder can review it before scheduling any session.

When you book a working session through /schedule, we collect the fields the scheduling flow asks for — typically your name, work email, the company you represent, and contextual notes about the outcome you want to discuss — together with the time-slot you select. We use this to confirm and host the session, and to send you a calendar invitation and any pre-read material that is relevant to it.

When you browse this site, our hosting provider records standard server logs — the page you requested, the response status, your IP address (truncated), and the user-agent your browser sent. We use these logs for security, abuse detection, and aggregate traffic measurement. We do not place third-party advertising trackers, retargeting pixels, or session-replay scripts on this site.

Information you submit through /contact or /schedule is used only to evaluate fit, schedule and host a working session, follow up with you about it, and — if you proceed — set up the engagement. We do not sell, rent, or share submitted information with third parties for their own marketing purposes.

Server logs are used to keep the site dependable, detect abuse, and produce aggregate traffic statistics. We do not attempt to reconstruct individual browsing profiles from log data, and we do not use log data to make automated decisions about you.

To operate this site we rely on a small set of third-party processors acting on our instructions: a hosting provider for site delivery and logs, a scheduling provider that powers /schedule, and an email-delivery provider for our follow-up messages. Each of these processors receives only the data needed to perform its role and is bound by contractual obligations to protect that data.

We do not embed third-party advertising networks, analytics services tied to advertising, or social-media tracking pixels on this site.

Contact-form submissions, scheduling records, and the notes from a working session are retained for up to 24 months unless you ask us to delete them sooner — you can reach us at the address listed under "Contacting us" below to request deletion. Engagement deliverables produced for active clients are retained for the duration of the engagement and for the post-engagement archive window set out in the engagement-specific DPA.

Server logs are rotated according to our hosting provider’s standard retention window and are not used to build long-lived profiles of individual visitors.

You can ask us to confirm whether we hold information about you, provide a copy of it, correct it, or delete it. The fastest way to start that conversation is the same channel you used to send the original submission — reply to our follow-up email, or send a fresh message through /contact referencing the original. We respond within a reasonable window to every verified request.

Questions about this policy or about how your information is handled can be sent to pivotmark-2@polsia.app, or submitted through the /contact form on this site. If you are not satisfied with our response, you may also raise the matter with the data-protection authority in your jurisdiction.