Privacy Policy

Unpromptable Assets builds private AI systems and business assets for coaches, consultants, and service businesses. This policy explains what we collect through this website, how we use it, and what choices you have.

This policy covers this website, initial inquiries, and the systems we build and run for clients, including customer-facing chatbots. Client engagements may include additional data terms in a separate written agreement.

Information we collect

When you contact us, we collect information you choose to send: name, email address, business type, business stage, budget range, service interest, message, and any project context you include.

We may also receive basic technical data from your browser or device, such as IP address, user agent, referring page, pages viewed, timestamps, and approximate location derived from technical data. We use this for security, analytics, spam prevention, and site operation.

How we use information

We use contact information to read your inquiry, respond, assess fit, scope possible work, schedule calls, send transactional follow-ups, and keep basic business records.

We use technical information to operate the site, understand aggregate site performance, prevent abuse, debug problems, rate-limit requests, and protect forms.

If you become a client, project data, source material, credentials, documents, workflows, and AI-system inputs are handled under the separate written agreement for that engagement.

AI and automation use

We may use internal automation to route, summarize, tag, or prioritize inquiries. We do not use contact-form submissions to train public AI models for Unpromptable Assets.

Do not send confidential, regulated, highly sensitive, or third-party personal information through public forms. Use forms for initial scoping only.

For paid work, we may process client-provided material through selected AI, automation, hosting, storage, and development tools as needed to perform the work. Access, permissions, data handling, and approved tools should be documented in the project agreement or implementation notes.

Systems we build and run for clients

We build, and sometimes run, AI systems for client businesses. Examples include customer-facing chatbots, automations, assessments, and content tools. Some of these systems handle personal information about the client's own customers.

When we do this, the client business decides why its customers' information is collected and how it is used. We process that information on the client's behalf, follow the client's instructions and our written agreement with them, and use it only to run, test, fix, and support the system. Under privacy laws such as the GDPR or the Philippine Data Privacy Act of 2012, the client is usually the controller and we are the processor.

If you are a customer of one of our clients, you can contact that business directly about your information. You can also contact us, and we will work with the business to handle your request.

We may use other service providers (sub-processors) to run these systems. We choose them carefully, limit what they receive to what the system needs, and require them to protect the information.

Customer-facing chatbots

Some clients use chatbots we build to answer customer messages on channels such as Facebook Messenger, Instagram, WhatsApp, or a website chat. The chatbot tells you it is an automated assistant, and you can ask to talk to a person at any time.

What we collect: when you message a business that uses one of these chatbots, we may process the messages you send and receive, when they were sent, the ID the messaging platform gives you for that business (for example, a Messenger page-scoped ID), your name as shown on the platform, and details you choose to share, such as your name, contact number, address, order details, and photos or files. We collect this directly from you through the chat, and from the messaging platform that delivers your messages.

Why we use it: only to reply to you, answer your questions from the business's own information, collect your order or request details, pass the conversation to the business's staff, alert staff when you need a person, and keep the chatbot working and safe. The legal reason is usually to take steps you ask for before or under a contract (such as placing an order), or the business's legitimate interest in answering its customers.

What we do not do: we do not sell this information, we do not use it for advertising, and we do not use it to build profiles of you. We do not use it to train AI models, and we set up the AI services we use so that they do not train on it.

Please do not share sensitive information in the chat, such as health details, government ID numbers, bank or card numbers, or passwords. The chatbot does not need them.

Automated replies: the chatbot writes replies automatically, using only the business's own information. It does not make final decisions about you. Prices, orders, refunds, and other important decisions are confirmed by the business's staff.

Who receives it: the messaging platform (for example, Meta for Messenger); our automation server (n8n, hosted on a virtual private server with Hostinger); the AI model providers that write the replies (for example, OpenRouter, which routes requests to model providers such as OpenAI), which receive your message, recent messages from the same conversation, and the business's own information; and the business's own staff, who receive alerts with your order or request details.

How long we keep it: we delete chatbot conversation records within 90 days after your last message, unless they are still needed for an open order, a dispute, or a legal obligation, or the client's agreement sets a shorter period. The business may keep its own copy of the conversation in its messaging inbox.

You can ask us to see, correct, or delete your chatbot conversation data at any time. See our data deletion instructions at unpromptable.dev/data-deletion.

Service providers

We may share information with vendors that help us run the website and business, such as website hosting, analytics, form handling, email delivery, rate limiting, scheduling, document storage, security, and professional-advisor tools.

Current or expected providers include Vercel for hosting and analytics, Resend for transactional email, Upstash for rate limiting, and scheduling tools if you book a call. These providers process information for us or under their own policies where applicable.

Analytics, cookies, and tracking

We may use privacy-respecting analytics to understand traffic and improve the site. Analytics may collect pages visited, browser, device, referral source, approximate location, and event data.

We do not use this site to sell personal information. We do not currently run behaviorally targeted ads. If this changes, this policy should be updated before that activity starts.

Some browsers send Do Not Track signals. There is no common industry standard for responding to them, so this site does not currently respond to those signals.

How we share information

We do not sell your contact-form submissions.

We may share information with service providers, professional advisors, legal authorities when required, or a successor if the business is reorganized, merged, or transferred.

We may publish testimonials, case studies, logos, names, screenshots, or project details only when we have permission or when material is anonymized, aggregated, public, or representative rather than client-identifying.

Email communications

We may send transactional emails about inquiries, scheduling, proposals, and project conversations. We send marketing emails only where allowed and will provide opt-out instructions for non-transactional email.

You can ask us to stop non-transactional messages at any time.

Retention

We keep inquiry records while useful to respond, manage relationships, maintain business records, resolve disputes, and comply with legal obligations. Lead records are generally kept no longer than needed for those purposes.

Spam, rate-limit, and security logs are kept for shorter periods where practical. You can ask us to delete contact-form information, but we may keep limited records where needed for security, legal, tax, accounting, or legitimate business reasons.

Security

We use reasonable technical and organizational measures to protect information, including limited access and vendor controls where appropriate. No website, email system, AI tool, or internet transmission is perfectly secure.

For client projects, security expectations should be set in the project scope, including access controls, credential handling, approved tools, human review points, and handoff practices.

If a security incident affects personal information, we will act quickly to contain it, tell the affected client business, and notify affected people, regulators, and platforms such as Meta where the law or platform terms require it. For example, the Philippine Data Privacy Act requires notice to the National Privacy Commission within 72 hours in certain cases.

Your choices and privacy rights

You may ask to access, correct, delete, or receive a copy of personal information you have provided to us. You may also ask us to stop contacting you.

Depending on where you live, privacy laws may give you additional rights, including rights to be informed, to know what we collect, to object to processing, to delete or block data, to correct data, to receive a copy in a portable format, to opt out of certain sharing or targeted advertising, to limit sensitive-data use, to withdraw consent, to claim damages where the law allows, or to appeal a denied request.

To make a request, email us (see Contact below). We may ask for details to confirm it is you. We aim to reply within 30 days and will tell you if we need more time or if the law lets us refuse part of the request.

Questions and complaints

If you have a privacy question or complaint, email our Data Protection Officer (see Contact below). Tell us what happened and what you would like us to do. We will look into it, reply in writing, and aim to resolve it within 30 days.

If you are not happy with our answer, you can complain to your local privacy regulator. Examples: the National Privacy Commission (Philippines), the Office of the Privacy Commissioner of Canada or the Commission d'accès à l'information du Québec, the Office of the Australian Information Commissioner, or your state attorney general or the Federal Trade Commission (United States).

Where information is processed

We are based in the United States and the Philippines. Our team, clients, and service providers work in several countries, so your information may be stored or processed outside the country where you live, including in the United States, the Philippines, and other countries where our service providers operate their servers.

Information processed in another country may be accessed by the courts, law enforcement, and national security authorities of that country under its laws. When we send information to another country, we use service providers that protect it and we stay responsible for it.

Where laws such as the GDPR apply, we rely on appropriate legal bases such as consent, contract steps requested by you, legitimate interests in operating and securing the site and the systems we run, and compliance with legal obligations.

Children

This site and the chatbots we build are for business customers. They are not directed to children under 13, and we do not knowingly collect personal information from children under 13.

If you believe a child sent us personal information, contact us and we will take appropriate steps to delete it.

Changes

We may update this policy as our site, services, vendors, or legal obligations change. The updated date shows when the current version took effect. For material changes, we may add additional notice where appropriate.

Contact

Our Data Protection Officer is James Presbitero. Privacy requests, questions, and complaints can be sent to james@unpromptable.dev.

To delete chatbot conversation data, follow the data deletion instructions.

For project inquiries, use the contact page.