Privacy Policy for Average Robot.

1. Information We Collect.

We may collect and process the following types of information:

• Identifiers: name, email address, phone number, employer, job title, and content you submit through our forms (contact, The AI Alignment Snapshot, book pre-order).
• Internet activity: IP address, browser and device type, pages visited, time on page, and referring URL, collected only when essential or with your consent.
• Inferences: scores derived from your responses to The AI Alignment Snapshot.
• Cookies and similar technologies: only strictly-necessary cookies are set by default. Optional analytics or marketing cookies are set only after you opt in via our consent banner. You can change your choices at any time via the "Cookie preferences" link in the footer.

2. How We Use Your Information & Lawful Basis.

Under GDPR / UK GDPR we rely on the following lawful bases:

• Contract / pre-contract: to respond to your inquiry, schedule discovery calls, and deliver requested services.
• Legitimate interests: to operate, secure, and improve our website, and to keep records of business communications. You may object at any time.
• Consent: for marketing emails or SMS, optional analytics or marketing cookies, and any sensitive use. You can withdraw consent at any time without affecting prior processing.
• Legal obligation: to comply with tax, accounting, and other applicable laws.

We do not use your personal information to make decisions producing legal or similarly significant effects without human review, and we do not engage in profiling for automated decision-making as defined under GDPR Article 22.

3. Sharing Your Information.

We do not sell your personal information for money, and we do not "share" it for cross-context behavioral advertising as those terms are defined under the CCPA/CPRA. We disclose information only to the categories of recipients below:

• Service providers (sub-processors): Supabase (database and edge functions, EU/US), Resend (transactional email, US), Lovable (hosting, EU/US), and Google Maps (when you interact with the location link). Each is bound by data-processing terms and may not use your data for their own purposes.
• Legal Compliance: Where required by law, regulation, or legal process.
• Business Transfers: In the event of a business merger or acquisition, your information may be transferred as part of that process.

Phone numbers and SMS consent: No mobile information, phone numbers, or SMS opt-in consent data will be shared with third parties or affiliates for marketing or promotional purposes. Information sharing related to phone numbers and SMS is limited to subcontracted service providers (such as our SMS delivery platform) strictly for the purpose of delivering the messages you have requested, and these providers are contractually prohibited from using the data for any other purpose.

4. Data Retention.

We keep personal information only for as long as necessary for the purpose for which it was collected:

• Contact and discovery-call submissions: 24 months from last contact, then deleted or anonymized.
• The AI Alignment Snapshot submissions: 24 months, then deleted or anonymized.
• Book pre-order list: until you unsubscribe or the campaign ends.
• Email send logs: 12 months for deliverability and abuse prevention.
• Records required by law (e.g. tax): for the retention period set by applicable law.

5. Data Security & International Transfers.

We implement administrative, technical, and physical safeguards designed to protect personal data, including encryption in transit, row-level security on our database, and least-privilege access. Where data is transferred outside the EEA or UK, we rely on Standard Contractual Clauses (and the UK Addendum where applicable) with our sub-processors.

6. SMS Communications & Consent.

If you provide your phone number and opt in to SMS communications via one of our forms, we may send you operational messages (such as appointment reminders, inquiry follow-ups, and account-related notifications) and, if separately opted in, occasional marketing messages.

• Opt-in is always explicit, separate, and never pre-checked.
• Message frequency varies. Message and data rates may apply.
• You can reply STOP at any time to unsubscribe, or HELP for assistance.
• We do not share your phone number or SMS consent with third parties or affiliates for their own marketing.

7. Your Rights (EEA, UK, and Switzerland).

If you are in the EEA, UK, or Switzerland you have the right to: access your personal data; rectify inaccurate data; request erasure; restrict or object to processing; data portability; and withdraw consent. You also have the right to lodge a complaint with your local supervisory authority.

To exercise any of these rights, reach out via our Let's Talk section. We will respond within 30 days.

8. Your California Privacy Rights (CCPA/CPRA).

If you are a California resident you have the right to:

• Know what categories and specific pieces of personal information we have collected about you, the sources, the business or commercial purpose, and the categories of recipients.
• Request deletion of personal information we hold about you.
• Request correction of inaccurate personal information.
• Opt out of the sale or sharing of personal information.
• Limit the use and disclosure of sensitive personal information.
• Be free from retaliation for exercising any of these rights.

We do not sell or share personal information for cross-context behavioral advertising. We honor opt-out preference signals such as the Global Privacy Control (GPC) automatically. To exercise any California right, reach out via our Let's Talk section and note "California Privacy Request" in your message. We will verify your request and respond within 45 days.

Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and other states with comprehensive privacy laws have substantially similar rights and may use the same contact channel.

9. Cookies & Choices.

You can review and change your cookie preferences at any time using the Cookie preferences control in the footer. You can also configure your browser to refuse cookies, though some site features may not work as intended.

10. LinkedIn and Third-Party Links.

Our website and communications may link to third-party websites, including LinkedIn. We are not responsible for their privacy practices. Please review their privacy policies before providing information.

11. Children's Privacy.

Our services are directed to business audiences and not to children. We do not knowingly collect personal information from individuals under 16, and we do not sell or share the personal information of consumers under 16 (consistent with COPPA and CCPA/CPRA).

12. Policy Updates.

We may update this Privacy Policy from time to time. Changes will be posted on this page, and the updated date will be indicated above. Your continued use of our website or services signifies your acceptance of these changes.

13. Contact Us.

Data controller: Average Robot. For privacy questions or to exercise any right above, reach out via our Let's Talk section. EEA/UK individuals may also contact their local data protection authority.