Privacy Policy

Summary

ConsultantAI stores the project data you give us so it can produce consulting deliverables. We do not sell your data, and we do not use your project content to train third-party models. Content you upload is sent to the AI model providers listed below in order to generate output — that is the core function of the product, and it is the one place your content leaves our systems.

What we collect

• Account data. Your email address, name, company name, and a bcrypt-hashed password. We never store your password in a readable form.
• Project data. The business requirements, discovery answers, scope, tasks, deliverables, and slides created inside a project.
• Documents you upload. The file itself plus extracted text, chunked text used for retrieval, and vector embeddings used for search.
• Financial models. The assumptions you enter and the projections calculated from them.
• Marketing contact details. If you join the waitlist, submit feedback, or contact us, we store the email address and company you provide, plus the context you choose to include.
• Audit records. For sign-in and account activity we record the timestamp, your user ID, your email address, your IP address, and your browser user-agent string. These are used to investigate abuse and cannot be turned off.
• Usage analytics. A self-hosted analytics instance records which pages are visited and basic request metadata. It sets no cookies and creates no cross-site advertising identifiers. If you join the waitlist we record the domain part of your email address (for example “example.com”), not the full address.

How we use your data

• To operate the product: generate the deliverables, answers, and analyses you request.
• To authenticate you and keep your account secure.
• To send service emails you ask for, such as a waitlist confirmation.
• To detect and prevent abuse, including rate limiting on public endpoints.
• To respond to support requests and inbound email sent to our domains.

We do not use your content to train our own models, and we instruct our AI providers not to use your content for their training. See the subprocessors section for details.

Automated decision-making

Some analysis steps use a separate AI decision layer that can escalate work to human review instead of completing it automatically. This layer is currently disabled and does not run in our deployment. If it is ever enabled, it will:

• operate only as a recommendation alongside the main output, never as the sole basis;
• redact personal data fields before the packet is assessed;
• log the decision, its confidence, latency, and cost for review, without storing prompt text;
• be switchable off without a redeployment.

Subprocessors

Only OpenRouter receives your project and document content. The remaining providers receive data needed to operate the service around it.

OpenRouter routes each request to the specific model vendor configured for that task. Those vendors act as additional subprocessors for inference, and the model used varies by feature — for example, research tasks may use a web-search-capable model. Retention settings are controlled at the OpenRouter account level rather than in our application. We do not send a per-request instruction to suppress training or retention, so unless the account is configured for zero data retention, requests may be handled under the provider’s standard terms.

Data retention

• Project data is retained while your account is active so you can return to it. We do not currently publish a deletion schedule for inactive projects.
• Raw extracted document text is cleared from the document store after processing completes, once the processed chunks and embeddings exist. This runs automatically when the application starts rather than on a fixed schedule, so text persists until the next deployment.
• Generated exports carry an expiry timestamp of 24 hours. The download link stops being served after that, but the export record itself is not automatically deleted.
• Marketing contact details are retained until you ask us to remove them. Note that our email newsletter currently has no unsubscribe link; see Known gaps.
• Audit records (IP address, user agent, email) are retained indefinitely. They are not automatically pruned.

We have not implemented scheduled deletion jobs or a documented backup-rotation policy, so we make no claim about how long deleted data persists in backups. We would rather state that plainly than assert a retention period we cannot demonstrate.

Security

• Passwords are hashed with bcrypt. Data in transit uses TLS. Access to production systems is limited to the people who operate the service.
• Authentication uses signed access tokens. Tokens are not individually revocable: signing out clears the token from your browser but cannot invalidate it server-side before it expires, which is 24 hours.
• Public tools and authentication endpoints are rate limited per IP address.
• Uploaded files are served through time-limited signed links rather than public URLs.

No system is perfectly secure, and we cannot guarantee absolute security. If a breach affects your data we will notify you and any regulator as required by law.

Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to object to certain processing.

Today these requests must be handled by contacting us. The product does not yet offer self-service account deletion, project deletion, or data export. You can change your email address, company, and password yourself in Settings. If you are in the EEA or UK, you have the right to complain to your local data protection authority.

International transfers

Our infrastructure providers process data in countries other than your own. Where data is transferred internationally, providers are relied on under their own transfer mechanisms, such as standard contractual clauses.

Children

The service is not directed at children under 16 and we do not knowingly collect their personal data.

Changes

We may update this policy as the product or its providers change. The date at the top reflects the most recent revision. Material changes affecting how your data is used will be announced in the product.

Contact

For privacy questions or requests, email privacy@consultantai.online. See also our Terms of Service.

Known gaps

Published alongside this policy so that nothing here overstates what the product currently does. Items marked needs legal input also require counsel.

• No legal entity is named. This policy does not identify a registered company, address, or data-controller role. Needs legal input.
• No self-service deletion or export. Account deletion, project deletion, and data export are not implemented.
• No email unsubscribe. Newsletter sends currently have no unsubscribe mechanism, and affected recipients must email us to be removed.
• No scheduled retention enforcement. Audit logs and export records grow indefinitely; no deletion job runs.
• Personal data in server logs. Waitlist submissions currently include name, email, and company in Vercel server logs.
• Tokens are not revocable. A stolen token remains valid until it expires (24 hours) because there is no server-side session to revoke.
• No enforcement of AI-provider retention. Retention depends on OpenRouter account configuration; the application does not request per-request suppression of training or retention.