Privacy Policy

1. Information we collect

Information you give us. When you request a diagnosis, contact us, or subscribe to our field notes, we collect what you enter: your name, email address, website address, and your message. When you become a client, we collect the contact details needed to run your account and invite your team to the portal.

Portal and app activity. When you use the portal or app we record the requests you submit, approvals and change requests you make, messages you send us, and basic account events (sign-ins, device type). We do not collect a password — sign-in is by emailed link or Google.

Your website. To care for a client site we access it with credentials you authorize (hosting, WordPress, DNS). We collect technical information about the site — uptime, performance, security posture, software versions, content structure — and keep backups where your plan includes them.

Automatically. Our marketing site uses Google Analytics 4 to understand how visitors use it (pages viewed, approximate location, device, referring site). Our hosting provider records standard server logs (IP address, request time, user agent) for security and reliability.

2. How we use it

• To deliver the Services: run diagnoses, respond to you, care for your site, build what you request, and show you what we did.
• To operate accounts: authenticate you, send sign-in links and invitations, and notify you when something needs your approval.
• To improve the Services and our marketing site, using aggregate analytics.
• To communicate: replies, reports, and — if you subscribed — our field notes. Every marketing email has an unsubscribe link.
• To protect the Services and our clients: detecting abuse, securing sites, keeping records we are legally required to keep.

We do not sell personal information, and we do not use client site data for advertising.

3. Automation and AI

Some of our work is performed by software we operate — including AI-assisted tooling — under the supervision of our engineers. For client sites, these tools work on a staging copy first, and no change reaches a live site without a human approval from you or from us. Actions taken on your behalf are logged in your portal. We do not train AI models on your data.

4. Who we share it with

We share information only with the providers we need to run the Services, each bound to process it on our instructions:

• Supabase — database, authentication, and real-time updates for the portal and app.
• Vercel — hosting for timberwright.ai and the portal.
• Google — analytics on the marketing site, and sign-in if you choose “Continue with Google”.
• Apple — distribution of the iOS app via the App Store and TestFlight.
• Your hosting and domain providers (for example SiteGround) — as required to care for your site.
• Email delivery providers for transactional email.

We may also disclose information when the law requires it, or to protect the rights, safety, or property of Timberwright, our clients, or others. If Timberwright is acquired or merges, information may transfer to the successor under this policy.

5. Cookies

The portal uses cookies strictly to keep you signed in and to remember preferences such as light or dark mode. The marketing site uses Google Analytics cookies. We do not use advertising cookies or cross-site tracking. You can clear or block cookies in your browser; the portal will not work without its sign-in cookie.

6. Retention

We keep account and portal data for as long as you are a client and for a reasonable period afterwards to close out work, meet legal obligations, and resolve disputes. Completed requests are archived in your portal (never deleted) so your history stays available to you. Marketing leads that do not become clients are deleted or anonymized within 24 months of last contact. Server logs are kept for up to 90 days.

7. Security

Portal data is isolated per client with database-level access controls, encrypted in transit and at rest by our providers, and reachable only through authenticated, invite-only accounts. Credentials for client sites are stored outside the portal database with restricted access. No system is perfectly secure; if we learn of a breach affecting your information we will notify you promptly.

8. Your rights and choices

You can ask us to access, correct, export, or delete the personal information we hold about you, and to stop marketing email at any time. Portal seats can be removed on request. Depending on where you live (including the EU/UK under GDPR and California under the CCPA/CPRA) you may have additional rights, including the right to object to certain processing and to complain to a supervisory authority. Contact us at mitchell@timberwright.ai and we will respond within 30 days.

9. Children

The Services are for businesses and are not directed at children under 16. We do not knowingly collect information from them.

10. International transfers

We operate from the United States and our providers may process information there and in other countries. Where required, we rely on our providers’ standard contractual safeguards for international transfers.

11. Changes

We will post any changes to this policy here and update the date above. For material changes affecting clients we will also tell you in the portal or by email.

12. Contact

Timberwright · mitchell@timberwright.ai · timberwright.ai