Privacy Policy

1.1 The Chief of Staff AI Assistant

(“Chief of Staff” or the “CoS Service”): a personal AI briefing assistant delivered through Telegram and other channels, which integrates with third-party services at the user's direction to produce daily briefings, draft email replies for the user's review, and propose calendar events for the user's review.

1.2 ADA Accessibility Services

(the “ADA Services”): automated WCAG accessibility reviews, remediation work, and recurring monitoring services performed for business clients under (a) the Clockwork Master Services Agreement for ADA Website Accessibility Review and Remediation (the “MSA”) or (b) the Clockwork Complimentary ADA Review Agreement (the “CRA”), including the no-fee review program operated under the CRA.

1.3 The Clockwork Website

the marketing and informational website at clockworkaipartners.com and its subdomains (the “Website”), including any contact, inquiry, or acceptance forms presented on the Website.

1.4 Outreach to Prospective ADA Clients

pre-engagement communications directed to businesses we have identified through publicly available sources, where we may provide a sample accessibility review and offer the recipient the opportunity to engage Clockwork formally under the CRA or MSA.

1.5 Relationship to Written Agreements

Where a written agreement between Clockwork and a client (including the MSA or the CRA) contains provisions governing the treatment of that client's information, those provisions control with respect to information processed under that agreement in the event of any conflict with this Policy. This Policy supplements, and does not replace, those agreements.

2.1 Information from Chief of Staff Users

Provided directly by the user:

• Account registration data: name, email address, time zone, and communication preferences.
• OAuth 2.0 authorization tokens for third-party services the user connects (Gmail, Google Calendar, Microsoft Outlook/365, fitness and biometric platforms). We never store passwords for any connected account.
• Messages and queries sent to the CoS Service via Telegram or other channels.
• Preferences and settings the user configures within the CoS Service.

Collected automatically from authorized third-party services: see Section 4 for a complete list of integrations, the scopes requested, and the uses made of the data retrieved.

2.2 Information from ADA Clients and Prospective ADA Clients

Clockwork collects the following information in connection with the ADA Services. The precise scope for any given engagement is further described in the applicable written agreement.

2.2.1 Complimentary Review Acceptance Data

When a representative of a business completes the electronic acceptance form for the Complimentary ADA Review program, Clockwork collects, per CRA §18.2:

• full legal name of the accepting individual;
• full legal name of the business entity and state of formation;
• business role or title of the accepting individual;
• principal business address of the business entity;
• business email address;
• the URL(s) the business has designated for the review;
• the accepting individual's affirmative authorizations (authorization to scan, agreement to be bound, and optional marketing opt-in); and
• timestamp and IP address of acceptance, for record-keeping and dispute resolution.

2.2.2 Scan Data

In performing an accessibility review (whether under the CRA, the MSA, or as a sample review accompanying pre-engagement outreach under §1.4), Clockwork collects:

• the URLs designated for review;
• publicly accessible page content at those URLs, including rendered HTML, DOM snapshots, and page state;
• screenshots of designated pages where applicable;
• scan outputs produced by Clockwork's automated accessibility tooling; and
• Clockwork's internal analysis metadata derived from the foregoing.

Scan access is rate-limited (no fewer than two seconds between page loads), respects the target site's robots.txt file, and is limited to publicly accessible portions of the site.

2.2.3 Paid Engagement Data

Where a client engages Clockwork for Remediation Services or Monitoring Services under the MSA, Clockwork may additionally receive:

• credentials provided by the client for access to the client's website code repository, CMS administrative interface, hosting account, or similar systems reasonably necessary to perform the services;
• code snapshots, configuration data, and content accessed or modified during the engagement; and
• review reports, remediation documentation, and other deliverables produced in connection with the engagement.

Clockwork accesses only such information as is reasonably necessary to perform the services specified in the applicable Statement of Work. Clockwork does not access a client's customer databases, patient records, financial records, or human resources records except where expressly authorized in writing. Client credentials are stored in encrypted form and destroyed within seven business days following completion or termination of the engagement, per MSA §13.4.

2.3 Information from Website Visitors

When a person visits clockworkaipartners.com or any subdomain, we may collect:

• contact or inquiry form submissions (name, email, message content, and any information the visitor chooses to include);
• technical information about the request (IP address, user-agent, referring URL, request timestamp, approximate location derived from IP);
• cookie and similar technology identifiers, as described in Section 3; and
• aggregated, non-identifying server-log statistics about how the Website is accessed.

We do not knowingly direct the Services to children under the age of 13, and we do not knowingly collect personal information from children under the age of 13. See Section 12.

2.4 Information about Prospective ADA Clients (Pre-Engagement Outreach)

When Clockwork identifies a business as a candidate for ADA outreach, we may collect from publicly available sources or scan as described in §2.2.2:

• the business's name, public website URL, principal place of business, and industry or category signals;
• publicly listed business contact channels (general business email address, phone number, contact form URL);
• the name and publicly listed business role of the principal contact, where available from the business's own website or from a public business directory;
• a sample accessibility review (scan data per §2.2.2) performed against the business's public website to inform the outreach communication; and
• records of any outreach communication sent and any response received.

Clockwork uses pre-engagement information solely to evaluate the prospect, send outreach communications, and follow up if the prospect engages. Pre-engagement information is retained per §7.2 below.

2.5 Technical and Service Operation Data (All Services)

• Service usage logs: timestamps of briefings delivered, features used, scan cycles performed, and error events.
• Telegram chat identifiers (chat ID) used to route messages to the correct CoS user.
• Device type and operating system information for smart-home and similar integrations authorized by a CoS user.
• Audit-log records of administrative actions taken on Clockwork systems relating to client information.

3.1 Essential cookies

The Website may set short-lived essential cookies required for normal page operation (for example, session continuity during form submission). These cookies do not track visitors across sites and are not used for advertising.

3.2 Server logs

Standard hosting-provider server logs capture request metadata as described in §2.3. Server logs are retained per §7.3.

3.3 Fonts

The Website uses Playfair Display and Inter typefaces, which are fetched from Google Fonts at build time and self-hosted from the same origin in production. Visitor browsers do not contact Google Fonts servers when rendering Website pages.

3.4 Future analytics

If Clockwork later adds privacy-respecting analytics or other tracking technologies to the Website, this Section 3 will be updated and the change disclosed in §14.

4.2 Microsoft 365 (Outlook and Calendar)

Clockwork may integrate with Microsoft 365 for users who use Outlook for email and calendar. Where requested, Clockwork uses the narrowest Microsoft Graph scopes consistent with the user-sign-off workflow described in §4.1 (drafts staged, events proposed for approval). The same no-sale, no-advertising, no-training, and limited- human-access commitments described in §4.1 apply equally to Microsoft 365 data.

4.3 Garmin Connect

Data retrieved. With explicit OAuth 2.0 authorization, Clockwork retrieves from the Garmin Connect API:

• daily summary (steps, distance, calories, active and intensity minutes);
• sleep data (duration, stages, score);
• heart rate (resting heart rate, HRV status, stress levels);
• Body Battery metrics; and
• recent activity summaries.

Clockwork does not access GPS location data, raw accelerometer data, or any data beyond what is listed above.

Use. Garmin data is retrieved once per briefing cycle and processed by Anthropic's API to generate a plain-language wellness summary in the user's briefing. Raw Garmin responses are cached in encrypted form for up to 24 hours to avoid redundant API calls. Summarized briefing output (not raw biometric values) may be stored for up to 90 days.

Revoking access. A user may disconnect the Garmin integration at any time by using the /disconnect_garmin command or by revoking access in Garmin Connect account settings. Upon disconnection, Clockwork stops retrieving new data and deletes cached Garmin data within seven days.

4.4 Other Fitness and Biometric Platforms

The CoS Service may offer similar integrations with Oura Ring, Whoop, Apple HealthKit, Fitbit, Polar, and other wearable or biometric platforms. Each integration is user-initiated under OAuth 2.0 or an equivalent consent mechanism, is narrowly scoped to the data needed to produce the user's briefing, and is subject to the same no-sale, no-advertising, no-training, and 90-day summarized-retention limits described above.

4.5 AI Inference Provider (All Services)

Clockwork uses large language models provided by Anthropic PBC (“Anthropic”) to process content for the purposes described in this Policy, including (a) priority scoring, summarization, and draft generation for Chief of Staff users and (b) classification and plain-English remediation guidance for ADA Services.

Content transmitted to Anthropic's API is processed under Anthropic's then-current commercial terms. As of the Last Updated date of this Policy, those terms provide that customer inputs and outputs are not used to train Anthropic's models absent the customer's opt-in, and Clockwork has not opted in to any such training use. Clockwork does not use client data to train any artificial intelligence models, does not sell client data, and does not contribute it to any third-party training dataset.

6.1 Service Providers

We engage third-party vendors who process information on our behalf under written confidentiality and data-protection obligations. Current service providers include Anthropic (AI inference), Amazon Web Services or Google Cloud (hosting, compute, and database infrastructure), Telegram (message delivery for the Chief of Staff Service), Cloudflare (Website and customer-dashboard hosting and content delivery), and standard business-operations providers (for example, transactional email delivery, document execution, and accounting). These providers may use information only to provide their services to Clockwork.

6.2 Third-Party APIs at User Direction (Chief of Staff)

Where a user connects a third-party account, Clockwork retrieves data from that service as authorized by the user. The user's interaction with that third party is also governed by the third party's own privacy policy.

6.3 Legal Requirements

Clockwork may disclose information where required by law, subpoena, court order, or other legal process, or where it believes in good faith that disclosure is necessary to protect rights, property, or safety. Where legally permitted, Clockwork will provide prompt notice to the affected client or user before complying, so that the client or user may seek a protective order or other appropriate relief at its own expense.

6.4 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of assets, personal information may be transferred to the successor. Clockwork will notify affected users and clients before their information becomes subject to a different privacy policy.

6.5 Aggregated and Anonymized Data

Clockwork may publish and share aggregated and anonymized data that does not identify any individual, client, user, or website (for example, statistics on accessibility-finding prevalence across scans), consistent with MSA §7.4 and CRA §8.4.

7.1 Chief of Staff

Email, calendar, and biometric data retrieved from connected services is processed in memory and is not stored beyond the current briefing cycle, except for summarized briefing output retained for up to 90 days. Raw Garmin and other wearable responses are cached in encrypted form for up to 24 hours. Conversation logs are retained for up to 30 days. OAuth 2.0 access tokens are stored encrypted and deleted immediately upon account disconnection. Account and preference data is retained for the duration of the subscription plus 30 days following cancellation.

7.2 ADA Services

Engaged clients (CRA or MSA executed): Scan outputs, screenshots, and review reports are retained for up to 12 months following delivery of the applicable review report, after which they are deleted or aggregated into non-identifying form, except where the client expressly requests longer retention to support Monitoring Services, consistent with MSA §13.5 and CRA §8.3. Records of a client's electronic acceptance of the CRA are retained for up to two years for record-keeping and dispute-resolution purposes. Credentials provided by MSA clients are destroyed within seven business days following completion or termination of the engagement.

Non-engaged prospects (no CRA, no MSA, no reply, no report request): Where Clockwork has performed a sample accessibility review accompanying pre-engagement outreach to a prospect, and the prospect does not engage with Clockwork in any of the foregoing ways within 12 months of the most recent outreach communication, Clockwork deletes the scan output, screenshots, and AI analysis derived from that prospect's website. Clockwork may retain a non-identifying record that the prospect's URL was scanned (URL plus date) for up to 36 months for internal pipeline analytics, after which that record is deleted as well.

7.3 Website

Contact-form and inquiry records are retained for up to 24 months following the last interaction, after which they are deleted or aggregated into non-identifying form. Server logs are retained for up to 90 days.

7.4 Deletion on Request

A user, client, or prospect may request deletion of personal information at any time by contacting privacy@clockworkaipartners.com, subject to legal, tax, audit, and dispute-resolution retention obligations, and subject to backup copies that will be overwritten in the ordinary course of Clockwork's backup rotation and not accessed for any other purpose.

8.1 Safeguards

Clockwork maintains commercially reasonable administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, use, disclosure, alteration, or destruction. At minimum, these safeguards include:

• encryption at rest using AES-256 or a comparable standard;
• encryption in transit using TLS 1.2 or higher (TLS 1.3 where supported);
• storage of authentication credentials and API tokens in encrypted form, never in plaintext;
• role-based access controls limiting access to personnel with a need to know;
• multi-tenant database architecture with row-level security for per-user data isolation (Chief of Staff);
• audit logging of administrative actions; and
• secret-token verification for webhook endpoints.

8.2 Security Incident Notification

Clockwork will notify affected users and clients of any confirmed unauthorized access to, or unauthorized disclosure of, their personal information without undue delay, and in any event within 72 hours of Clockwork's confirmation of the incident (consistent with MSA §13.8), with available information about the nature and scope of the incident and any remedial steps taken or planned. Clockwork will also comply with breach-notification obligations imposed by applicable law, including the New York Stop Hacks and Improve Electronic Data Security Act (SHIELD Act) and analogous state laws.

8.3 No system is completely secure

Despite these safeguards, no data transmission over the internet or storage system can be guaranteed to be 100% secure.

9.1 Transactional Communications

Clockwork may send transactional electronic communications relating to the Services, including service delivery (briefings, review reports), account notices, scheduled or requested outputs, billing notices, agreement-related notices, and responses to inquiries. Transactional communications are necessary to operate the Services and cannot be opted out of while a user or client relationship is active.

9.2 Marketing and Outreach Communications

Clockwork sends marketing communications to recipients who have affirmatively opted in (including through the marketing-communications checkbox on the CRA acceptance form, CRA §15.3, or equivalent consent obtained on the Website) and pre-engagement outreach communications to prospective ADA clients identified per §2.4. Marketing and pre-engagement outreach communications are sent in compliance with the federal CAN-SPAM Act (15 U.S.C. § 7701 et seq.), including a clear sender identification, a physical postal address, and a functioning unsubscribe mechanism in every commercial message. A recipient may opt out at any time by clicking the unsubscribe link in any commercial communication or by emailing privacy@clockworkaipartners.com. Opting out has no effect on the delivery of transactional communications or on any Service the recipient is receiving.

10.1 HIPAA

The ADA Services are limited to review and remediation of publicly accessible portions of a client's website and are not intended to involve access to, storage of, transmission of, or processing of Protected Health Information (“PHI”) as defined under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), consistent with MSA §13.9 and CRA §8.6. Clockwork is not a “business associate” of any ADA client under HIPAA, and nothing in this Policy or in the agreements governing the ADA Services is intended to create a business-associate relationship. Clients are solely responsible for ensuring that no PHI is included in the pages or administrative interfaces made available to Clockwork.

10.2 GLBA and Financial Privacy

The ADA Services are not intended to involve access to, storage of, transmission of, or processing of nonpublic personal information (“NPI”) as defined under the Gramm-Leach-Bliley Act (“GLBA”) or under any analogous state financial privacy law (including Regulation P, the FTC Safeguards Rule, and the New York Department of Financial Services Cybersecurity Regulation at 23 NYCRR Part 500), consistent with MSA §13.10 and CRA §8.6. Clockwork is not a “service provider” of any ADA client within the meaning of GLBA or those regulations. Clients are solely responsible for ensuring that no NPI is included in the pages or administrative interfaces made available to Clockwork.

10.3 Separate Written Addendum Required

Any engagement that would involve Clockwork's access to PHI, NPI, or other regulated data categories requires a separate written addendum or business-associate agreement executed by both parties in advance of any such access.