Privacy Policy

01About this policy

Who we are

Anvil AI is the trading name of Anvil AI Systems LLC, a limited liability company based in Seattle, Washington. We help business owners put AI to work: a free one-hour AI audit, free office hours, and the AI Install Day. Anything more bespoke is scoped by email.

Everything we run is delivered online over Zoom. Anvil AI Systems LLC is a Washington company and works with businesses anywhere in the United States. You can reach us at cooper@anvilaisystems.com or +1 256-750-3140.

What this policy covers

This covers our two websites — anvilaisystems.com and workshop.anvilaisystems.com — the forms on them, the sessions we run, the work we do for you, and the emails we send.

It explains what we collect, why we collect it, who we pass it to, and what you can ask us to do about it. Where a third party collects from you directly, such as Zoom when you join a call, their own policy applies to that alongside ours.

02Information we collect

Information you give us

• Your name, email address, phone number, business name and company website, when you request an audit or a seat.
• Your answers to the questions on our forms. These are free text, so they contain whatever you choose to put in them.
• Just your email address, if all you do is sign up for office hours or our mailing list.
• Whatever you tell us on a call or share with us during an engagement, which can include how your business runs, the tools you use and your numbers.

We ask for a phone number because the audit is a callback — without it we cannot do the thing the form offers. If a field is not relevant to you, leave it and tell us on the call.

Information we collect automatically

• Your IP address and your browser’s user-agent string.
• The page you landed on, the page you came from, and the pages you look at.
• Campaign tags in the URL — utm_source , utm_medium , utm_campaign , utm_content , utm_term — and the click identifiers fbclid (Meta) and gclid (Google).
• Cookie identifiers set by Google Analytics and the Meta pixel. See Cookies and tracking below.

When you submit a form we store these next to your details, so we know which ad or which page actually brought you to us.

Information from other sources

• Meta and Google report on how our ads perform. Most of that is aggregated, but the click identifier in your URL lets Meta connect your inquiry back to the ad you clicked.
• Zoom tells us who registered for and attended a session.
• We look at the company website you give us before we call you. That is public information. We do not buy data about you from anybody.

03Why we use it

Delivering what you bought

To call you back, run your session, send joining links and recordings, do the work, and support you afterwards. Confirmations, links and reminders are not marketing, and we send them whatever your marketing preferences are.

Running the business

Invoicing and records, answering your questions, keeping the sites up and secure, spotting abuse of our forms, and meeting our tax and legal obligations.

Marketing and measurement

To work out which ads and which pages actually produce inquiries, so that we spend our advertising budget on the ones that do — and to email you about what we run, if you have asked us to.

That is the reason for most of the tracking described below. We would rather say so plainly than bury it under a paragraph about improving your experience.

04Cookies and tracking

The tools we use

• Google Analytics 4 — cookies _ga and _ga_VX8EY80EMB . Set on anvilaisystems.com rather than the exact hostname, so that a visit crossing from the main site to the workshop site counts as one visit and not two. Records the pages you view and events such as starting or finishing a form.
• Meta pixel — cookies _fbp and _fbc . Records page views and completed inquiries, and ties them to a Meta ad.
• Meta Conversions API — when you submit a form, our server sends that conversion to Meta as well as your browser. It includes your email, phone and name hashed with SHA-256, a one-way transformation that lets Meta match you to an existing account without receiving the values themselves, together with your IP address, user-agent and the two Meta cookie values, which Meta requires unhashed in order to match at all. Both the browser event and the server event carry the same identifier so that Meta counts one conversion rather than two.
• Microsoft Clarity — cookies _clck and _clsk . Records an anonymised replay of your visit: mouse movement, scrolling and clicks, so we can see where a page confuses people. Text you type is masked by default.

We do not ourselves use cookies to build a picture of you across unrelated websites. Meta and Google may do so under their own policies, which govern what they do with what they receive.

Managing cookies

Your browser can block or delete cookies; every major browser has this under privacy settings. Blocking them will not stop you using the site or sending us a form.

To opt out of the advertising measurement specifically: Google publishes a browser add-on at tools.google.com/dlpage/gaoptout, and your Meta ad settings are at facebook.com/adpreferences. Most tracker blockers stop both.

One honest caveat: the Conversions API runs on our server, so a browser blocker cannot see it and cannot stop it. If you want that stopped too, email us and we will delete your record.

05Marketing messages

What we send

If you give us your email we may send you dates for the Install Day and office hours, and the occasional note about what we are seeing work. We do not email daily, and we do not sell, rent or swap our list.

If you gave us a phone number for an audit, we use it to call you about that audit. We do not add you to a marketing SMS list.

Opting out

Every marketing email has an unsubscribe link and it takes effect immediately. You can also just reply and say stop, or write to cooper@anvilaisystems.com. You will still get messages about anything you have actually booked.

06Who we share it with

Service providers

• Amazon Web Services — hosting, the database your inquiry is stored in, and the email that alerts us to it. United States.
• Google — Analytics, and Workspace for our email.
• Meta Platforms — the pixel and the Conversions API, as described above.
• Pushover — sends the alert to our phones the moment an inquiry arrives, so we can call you quickly. That alert contains your name, business, phone number and email.
• Zoom — video for every session we run.

Each of these acts on our instructions, with the exception of Meta and Google, which also use what they receive for their own purposes under their own policies.

Legal and safety

We will disclose information where the law requires it, where we need to establish or defend a legal claim, or to prevent fraud or a threat to someone’s safety. We will tell you when that happens unless we are legally prevented from doing so.

Business transfers

If the business is sold or merged, customer records may move with it. Whoever buys it would be bound by this policy until they give you notice of a different one.

We do not sell your data

We have never sold personal information for money, and we have no intention of starting.

We should be more precise than that, though, because several US state privacy laws define “sale” and “sharing” more broadly than the everyday meaning. Running the Meta pixel and the Conversions API means personal information is disclosed to Meta for advertising. Under California law that is likely “sharing for cross-context behavioral advertising”, and under the Colorado, Connecticut, Virginia and Washington laws it is processing for “targeted advertising”. Plenty of companies run exactly this setup and still print a flat “we never share your data”. We would rather tell you.

You can opt out. Use a tracker blocker or the links under Managing cookies, or email cooper@anvilaisystems.com and we will delete your record and stop it at our end. We will not give you a worse service for asking, and it will not affect anything you have booked.

07Confidential business information

What we treat as confidential

What you tell us about your business — in an audit, in a session, or during an engagement — is confidential. We do not repeat it to other clients and we do not put it in marketing.

When you are on a call alongside other businesses, at office hours or on the Install Day, please treat what you hear from them the same way.

Using your story

We will ask before we use your name, your logo or your results in anything public, and we will show you the wording first. Saying no costs you nothing and changes nothing about how we work with you. If you say yes and later change your mind, tell us and we will take it down.

08Where your information lives

Where it is stored

Inquiries are stored in Amazon DynamoDB in the AWS us-east-2 region in Ohio, United States. Server access logs sit in AWS CloudWatch in the same region. Our email is in Google Workspace. If you are outside the United States, your information is processed there.

How we protect it

The sites are served over HTTPS only. The form endpoint accepts requests from our own domains only, is rate limited, and silently stores nothing when it detects an automated submission. The database has point-in-time recovery enabled. Access is limited to the two of us and protected by multi-factor authentication.

No system is perfectly secure. We would rather describe what we actually do than promise something nobody can honestly promise.

Data breaches

If personal information is exposed in a way likely to cause you harm, we will investigate and contain it, and notify you and any regulator we are required to notify, without undue delay.

Retention periods

• Inquiry and client records — 24 months after our last contact with you, then deleted. Anything attached to an invoice is kept for seven years, because tax law requires it.
• Server access logs — 90 days.
• The short-lived record that stops a double-tap creating two inquiries — 60 seconds.
• Google Analytics — up to 14 months for user-level data. Aggregated reporting persists beyond that.
• Session recordings — 12 months, unless you ask us to remove yours sooner.

You can ask us to delete your record earlier than any of these.

Recordings and content

We record some sessions so that the people who attended can rewatch them. We say so at the start. You are welcome to keep your camera and microphone off, and if you end up recorded and want it removed, email us.

Anything you type into a shared document or the chat during a session is visible to everyone else on that call.

09Your choices

Access, correction and deletion

You can ask us what we hold about you, to correct it, to delete it, to send you a copy in a portable format, or to stop using it for advertising. Depending on where you live these may be legal rights — California, Colorado, Connecticut, Virginia, Washington and a growing list of other states — but we will honor a reasonable request from anyone, wherever you are.

There is no charge, and asking will not get you a worse service.

Making a request

Email cooper@anvilaisystems.com with what you want. We may ask you to confirm something only the right person would know. That is not us being difficult — it is us not handing your details to somebody else who asked for them.

We respond within 45 days. If it is going to take longer than that we will tell you why before the 45 days are up. An authorized agent can make a request on your behalf with your written permission.

Complaints

If you are unhappy with how we have handled your information, tell us first — cooper@anvilaisystems.com — and we will try to put it right.

If that does not resolve it, you can complain to the attorney general in your own state, or to the Federal Trade Commission at ftc.gov. California residents can also contact the California Privacy Protection Agency at cppa.ca.gov.

10Children

Our services are for business owners and their teams. They are not directed at children and we do not knowingly collect personal information from anyone under 13. If you believe a child has given us information, contact us and we will delete it.

11Changes to this policy

We update this policy when our business or our tools change. The current version is always on this page with the date it was last updated. If a change materially affects you we will tell you, rather than rely on you noticing.

12Contact us

Anvil AI Systems LLC, Seattle, Washington, United States.

Email cooper@anvilaisystems.com, or call +1 256-750-3140, for anything to do with your privacy, your data or this policy.