Privacy Policy for Average Robot.

1. Information We Collect.

We may collect and process the following types of information:

• Identifiers: name, email address, phone number, employer, job title, and content you submit through our forms (contact, The AI Profit Readiness Assessment, book pre-order, newsletter sign-up).
• Consent records: when you agree to receive marketing email, the exact consent wording you agreed to, its version, the time you agreed, and the page where you agreed.
• Internet activity: IP address, browser and device type, pages visited, time on page, and referring URL, collected only when essential or with your consent.
• Inferences: scores derived from your responses to The AI Profit Readiness Assessment.
• Cookies and similar technologies: strictly-necessary cookies and browser storage are always used. Analytics (Google Analytics and our own lead attribution, described in section 10) depends on where you are. If your browser's time zone places you in the EU/EEA, the UK or Switzerland, or we cannot read it, no analytics runs until you accept analytics in our consent banner. Elsewhere, analytics runs unless you decline it. Marketing cookies are set only after you opt in. We treat a Global Privacy Control signal as a refusal. You can change your choices at any time via the "Cookie preferences" link in the footer.

2. How We Use Your Information & Lawful Basis.

Under GDPR / UK GDPR we rely on the following lawful bases:

• Contract / pre-contract: to respond to your inquiry, schedule discovery calls, and deliver requested services.
• Legitimate interests: to operate, secure, and improve our website, and to keep records of business communications. You may object at any time.
• Consent: for marketing emails (including our newsletter, With People) or SMS, optional analytics or marketing cookies, and any sensitive use. You can withdraw consent at any time without affecting prior processing.
• Legal obligation: to comply with tax, accounting, and other applicable laws.

We do not use your personal information to make decisions producing legal or similarly significant effects without human review, and we do not engage in profiling for automated decision-making as defined under GDPR Article 22.

AI processing of Assessment responses: When you complete the AI Profit Readiness Assessment, your answers are processed by an AI system (Anthropic's Claude) to produce a draft analysis. That draft is reviewed by a member of our team before any personalized report or follow-up is sent to you. The AI does not make automated decisions about you, and your responses are not used to train third-party AI models.

3. Sharing Your Information.

We do not sell your personal information for money, and we do not "share" it for cross-context behavioral advertising as those terms are defined under the CCPA/CPRA. We disclose information only to the categories of recipients below:

• Service providers (sub-processors): Cloudflare (website hosting, content delivery, and security, US/global); Supabase (database and edge functions, US/EU); HighLevel / GoHighLevel, also known as LeadConnector (customer-relationship management, form processing, and sending our newsletter and other marketing email, US); Resend (transactional email, US); Anthropic (AI processing of AI Profit Readiness Assessment responses to draft your analysis, US); and Google (Analytics, only if you consent to analytics cookies; and Maps if you use a location link, US). Each is bound by data-processing terms and may not use your data for their own purposes.
• Legal Compliance: Where required by law, regulation, or legal process.
• Business Transfers: In the event of a business merger or acquisition, your information may be transferred as part of that process.

Phone numbers and SMS consent: No mobile information, phone numbers, or SMS opt-in consent data will be shared with third parties or affiliates for marketing or promotional purposes. Information sharing related to phone numbers and SMS is limited to subcontracted service providers (such as our SMS delivery platform) strictly for the purpose of delivering the messages you have requested, and these providers are contractually prohibited from using the data for any other purpose.

4. Data Retention.

We keep personal information only for as long as necessary for the purpose for which it was collected:

• Contact and discovery-call submissions: 24 months from last contact, then deleted or anonymized.
• The AI Profit Readiness Assessment submissions: 24 months, then deleted or anonymized.
• Book pre-order list: until you unsubscribe or the campaign ends.
• With People newsletter: kept for 24 months from your last interaction with us, then deleted, except the suppression record. When you unsubscribe, we keep your email address and a record that you unsubscribed on a suppression list, so that we do not email you again.
• Lead attribution stored in your browser: up to 90 days for the record of your first visit, and until you close the browser tab for the record of your current visit (see section 10).
• Abuse-prevention records for our forms: kept for the length of the rate-limit window, at most 24 hours, and deleted after they expire.
• Email send logs: 12 months for deliverability and abuse prevention.
• Records required by law (e.g. tax): for the retention period set by applicable law.

5. Data Security & International Transfers.

We implement administrative, technical, and physical safeguards designed to protect personal data, including encryption in transit, row-level security on our database, and least-privilege access. Where data is transferred outside the EEA or UK, we rely on Standard Contractual Clauses (and the UK Addendum where applicable) with our sub-processors.

To protect our forms from abuse, we limit how often they can be submitted. To do this we briefly store a keyed hash of the IP address and email address used. We do not store the raw IP address or email address for this purpose.

6. SMS Communications & Consent.

If you provide your phone number and opt in to SMS communications via one of our forms, we may send you operational messages (such as appointment reminders, inquiry follow-ups, and account-related notifications) and, if separately opted in, occasional marketing messages.

• Opt-in is always explicit, separate, and never pre-checked.
• Message frequency varies. Message and data rates may apply.
• You can reply STOP at any time to unsubscribe, or HELP for assistance.
• We do not share your phone number or SMS consent with third parties or affiliates for their own marketing.

7. Our Newsletter, With People.

With People is our weekly email newsletter, sent on Tuesdays. You can subscribe through a form on our website. The form asks for your email address and, optionally, your first name. To subscribe you tick a separate box, which is never pre-ticked.

• What we keep: your email address, your first name if you give it, the exact consent sentence you agreed to and its version, the time you agreed, the page and the place on the page where you signed up, and the attribution details described in section 10.
• Lawful basis: your consent. You can withdraw it at any time.
• How it is sent: your details are stored in our database (Supabase) and in our customer-relationship platform (HighLevel / GoHighLevel, also known as LeadConnector), which sends the emails from mail.average-robot.com. After you subscribe we send a welcome email straight away and a second email three days later.
• Unsubscribing: every email contains an unsubscribe link. Once you unsubscribe, we stop sending you the newsletter and other marketing email, and we do not resubscribe you automatically. You can also ask us to unsubscribe you by emailing privacy@average-robot.com.
• Retention: your details are kept for 24 months from your last interaction with us, then deleted, except the suppression record. When you unsubscribe, we keep your email address and a record that you unsubscribed on a suppression list, so that we do not email you again.

8. Your Rights (EEA, UK, and Switzerland).

If you are in the EEA, UK, or Switzerland you have the right to: access your personal data; rectify inaccurate data; request erasure; restrict or object to processing; data portability; and withdraw consent. You also have the right to lodge a complaint with your local supervisory authority.

These rights include requesting a copy of your data, correction, or deletion. To exercise any of them, email privacy@average-robot.com or use our contact page, and tell us what you would like us to do. We will verify your request and respond within 30 days.

9. Your California Privacy Rights (CCPA/CPRA).

If you are a California resident you have the right to:

• Know what categories and specific pieces of personal information we have collected about you, the sources, the business or commercial purpose, and the categories of recipients.
• Request deletion of personal information we hold about you.
• Request correction of inaccurate personal information.
• Opt out of the sale or sharing of personal information.
• Limit the use and disclosure of sensitive personal information.
• Be free from retaliation for exercising any of these rights.

We do not sell or share personal information for cross-context behavioral advertising. We honor opt-out preference signals such as the Global Privacy Control (GPC) automatically. To exercise any California right, email privacy@average-robot.com or use our contact page, and note "California Privacy Request" in your message. We will verify your request and respond within 45 days.

Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and other states with comprehensive privacy laws have substantially similar rights and may use the same contact channel.

10. Cookies & Choices.

You can review and change your cookie preferences at any time using the Cookie preferences control in the footer. You can also configure your browser to refuse cookies, though some site features may not work as intended.

Lead attribution: to understand which sources bring people to us, our website can keep a small record in your browser of how you arrived. It holds the campaign tags (UTM source, medium, campaign and content) in the link you followed, the page you landed on, and the site that referred you. There are two records. The record of your first visit is kept in your browser's local storage for 90 days. The record of your current visit is kept in session storage until you close the tab.

We treat lead attribution as analytics. If your browser's time zone places you in the EU/EEA, the UK or Switzerland, or we cannot read it, nothing is stored until you accept analytics in our consent banner. Elsewhere, it is stored unless you decline. A Global Privacy Control signal is treated as a refusal in every region. If you reject analytics, or later withdraw your consent through Cookie preferences, we delete these records from your browser.

These records are first-party. They leave your browser only with a form you choose to submit, and they are stored with that submission so we can see which source brought you to us. We never share them with advertising networks. If nothing is stored, a form you submit still includes the campaign tags in the address of the page you are on.

11. LinkedIn and Third-Party Links.

Our website and communications may link to third-party websites, including LinkedIn. We are not responsible for their privacy practices. Please review their privacy policies before providing information.

12. Children's Privacy.

Our services are directed to business audiences and not to children. We do not knowingly collect personal information from individuals under 16, and we do not sell or share the personal information of consumers under 16 (consistent with COPPA and CCPA/CPRA).

13. Policy Updates.

We may update this Privacy Policy from time to time. Changes will be posted on this page, and the updated date will be indicated above. Your continued use of our website or services signifies your acceptance of these changes.

14. Contact Us.

Data controller: BPWB LLC (trading as Average Robot), 12050 Broadway Ter, Oakland, CA 94611. For privacy questions or to exercise any right above, email privacy@average-robot.com or use our contact page. EEA/UK individuals may also contact their local data protection authority.