Privacy Policy
Last Updated: August 29, 2026
1. Introduction
Digital Boutique AI (“DBAI,” “we,” “our,” or “us”) is a California-based company providing AI automation, workflow, and custom software services to businesses. This Privacy Policy explains how we collect, use, disclose, and protect information when you visit our website, engage us as a client, or interact with the services and automations we build, and describes the privacy rights available to you — including specific rights for California residents under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA).
By using our website or services, you agree to the practices described here. If you don’t agree, please don’t use our site or services.
2. Information We Collect
2.1 Information You Provide Directly
- Contact and lead information: name, email address, phone number, company name, job title, and any message content, when you submit a contact form, book a call, or request a proposal.
- Client and project information: business details, systems, credentials/API scopes you grant us, workflows, and data you share with us in the course of scoping, building, or operating an automation, integration, or application on your behalf.
- Billing information: name, business address, and payment details processed through our payment processor (we do not store full payment card numbers ourselves).
- Newsletter and marketing sign-ups: email address and any stated preferences.
- Communications: anything you send us via email, Slack, or our contact channels, including call/meeting notes where applicable.
2.2 Information Collected Automatically
- Usage and device data: IP address, browser type and version, operating system, device type, pages viewed, referring/exit URLs, and timestamps, collected via standard web server logs and analytics tools.
- Cookies and similar technologies: see Section 9.
2.3 Information Processed on Behalf of Clients
Where we build or operate automations, dashboards, CRMs, or integrations for a client, we may process that client’s business data — and, where applicable, their end customers’ or employees’ personal information — strictly as needed to deliver the contracted service and per the client’s instructions. In that context, the client is the data controller/business and DBAI acts as a service provider/processor, governed by our services agreement and, where required, a separate data processing addendum.
3. How We Use Information
We use information to:
- Respond to inquiries, prepare proposals, and deliver contracted services
- Build, test, deploy, and operate the automations, integrations, and applications we’re engaged to build
- Communicate with you about your project, account, or service status
- Process payments and maintain business, tax, and accounting records
- Send marketing or newsletter communications (with your consent, and you may opt out at any time)
- Maintain, secure, debug, and improve our website and internal systems
- Detect, prevent, and investigate fraud, abuse, or security incidents
- Comply with legal, tax, and regulatory obligations, and enforce our agreements
We do not use information for purposes materially different from those disclosed at the time of collection without providing notice.
4. How Information Is Shared
We do not sell personal information for money, and we do not “share” personal information for cross-context behavioral advertising as defined under the CPRA. We may disclose information to:
- Infrastructure and processing subprocessors used to build and run client services, including cloud hosting and database providers (e.g., Vercel, Neon), workflow automation platforms (e.g., n8n), and AI model providers (e.g., Anthropic’s Claude API) — each bound by their own security and data-handling terms and, where applicable, our data processing agreements with them.
- Business tools used to run DBAI itself (e.g., email, scheduling, CRM, and analytics providers).
- Professional service providers performing functions on our behalf (payment processing, accounting, legal), under confidentiality obligations.
- Law enforcement, regulators, or courts when required by law, subpoena, valid legal process, or to protect our rights, users, or the public.
- A successor entity in the event of a merger, acquisition, financing, or sale of assets, with notice where required by law.
- Anyone else, with your explicit consent.
Client project data is never repurposed to benefit another client.
5. AI Processing and Model Governance
Because our core business involves AI systems, we hold ourselves to specific, verifiable commitments about how AI is used with your data:
- Commercial API terms only. AI processing is performed through commercial APIs — principally Anthropic’s Claude API — under terms that exclude customer content from model training. Where a provider offers zero-data-retention handling, we use it.
- No training on your data. Neither DBAI nor, under the API terms we operate on, our AI subprocessors use client or visitor data to train foundation models. Your data is processed to produce your outputs, nothing else.
- Human review before anything reaches your systems. For client engagements, nothing generated by our AI systems is written to a client’s production systems without human review and a human commit. There is no autonomous write path from our environment to yours.
- Named access with data ceilings. Individuals at DBAI with access to client information are identified by name, each with a defined data ceiling. Client access rosters are available on request and updated on change.
- Records available on request. We maintain an access and change record, a subprocessor register, and an AI usage inventory. Clients — and, where relevant, their auditors or an acquirer’s diligence team — may request these at any time.
- Certification status, stated plainly. DBAI does not currently hold SOC 2 certification. We disclose this here rather than leave it to be discovered later. Our contractual security commitments, governance controls, and subprocessor terms are documented and available to clients for review.
6. Data Security and Incident Response
We apply reasonable technical and organizational safeguards — including access controls, encryption in transit, credential/secrets management, and restricted internal access on a need-to-know basis — appropriate to the sensitivity of the data involved.
If we become aware of a security incident affecting client information, we notify the affected client within twenty-four (24) hours of becoming aware of it, bear the cost of our own investigation and remediation, and cooperate with any notification or regulatory obligation that follows. For website visitors, we provide breach notifications as required by California law (Cal. Civ. Code § 1798.82) and other applicable statutes.
No system is 100% secure and we cannot guarantee absolute security, but we work to minimize risk, monitor for anomalies, and respond promptly and transparently to any incident.
7. Data Retention
We retain personal information for as long as reasonably necessary to fulfill the purposes described in this policy:
| Category | Typical retention |
|---|---|
| Contact/lead inquiries | Up to 3 years from last contact, or until you opt out |
| Client/project data | Duration of the engagement, plus up to 7 years for tax, accounting, and legal defense purposes |
| Billing/payment records | As required by tax law (generally 7 years) |
| Website analytics/usage logs | Up to 26 months |
| Marketing/newsletter list | Until you unsubscribe |
On termination of a client engagement, we export the client’s data in a structured, usable format and delete our copies on written request, subject to legally required retention. Data may otherwise be retained longer where required by law, an active legal claim, or a client’s own retention instructions.
8. California Privacy Rights (CCPA/CPRA)
This section applies to California residents and supplements the rest of this policy, consistent with the CCPA as amended by the CPRA and its implementing regulations.
8.1 Categories of Personal Information Collected
In the preceding 12 months, we have collected the following categories of personal information, as defined in Cal. Civ. Code § 1798.140(v)(1):
| Category | Examples | Collected? |
|---|---|---|
| A. Identifiers | Name, email, phone, IP address, account username | Yes |
| B. Customer records (Cal. Civ. Code § 1798.80(e)) | Billing address, payment card type (via processor), signature | Yes (billing only) |
| C. Protected classifications | Age, race, religion, disability, etc. | No |
| D. Commercial information | Services purchased, transaction history | Yes |
| E. Biometric information | Fingerprints, voiceprints | No |
| F. Internet/network activity | Browsing behavior on our site, cookie identifiers | Yes |
| G. Geolocation data | Approximate location from IP address | Yes (approximate only) |
| H. Sensory data | Audio/visual recordings | Only if you send us a recording (e.g., a call recording you share) |
| I. Professional/employment information | Job title, employer, business contact details | Yes |
| J. Education information | Degrees, transcripts | No |
| K. Inferences | Preferences or characteristics inferred from the above | Limited (e.g., service interests based on inquiry) |
| L. Sensitive personal information | SSN, financial account access credentials, precise geolocation, health data, etc. | No, unless a client separately provides such data for a contracted service, in which case it is processed only per that client’s instructions |
Sources: directly from you, automatically via our website, from clients (in the processor context), and from publicly available business sources (e.g., LinkedIn) for B2B sales outreach.
Business/commercial purposes for collection: as described in Section 3.
Categories of third parties to whom each category has been disclosed for a business purpose: service providers and subprocessors described in Sections 4–5 (cloud hosting, AI processing, automation platforms, payment processing, professional services).
8.2 No Sale or Sharing of Personal Information
We do not sell personal information, and we do not share personal information for cross-context behavioral advertising. We have not done so in the preceding 12 months. If this changes, we will update this policy and provide a “Do Not Sell or Share My Personal Information” mechanism as required by law. We honor the Global Privacy Control (GPC) as an opt-out preference signal where applicable.
8.3 Sensitive Personal Information
We do not use or disclose sensitive personal information for purposes beyond those permitted without additional consent under Cal. Civ. Code § 1798.121 (e.g., providing the service, security, or as reasonably expected). You may direct us to limit any such use by contacting us, though as noted above we do not collect sensitive personal information from website visitors in the ordinary course.
8.4 Your California Rights
Subject to certain exceptions, California residents have the right to:
- Know: request disclosure of the categories and specific pieces of personal information we’ve collected, the sources, the purposes, and the categories of third parties with whom it’s been disclosed.
- Delete: request deletion of personal information we’ve collected from you, subject to legal exceptions (e.g., completing a transaction, security, legal compliance).
- Correct: request correction of inaccurate personal information.
- Opt out of sale/sharing: not applicable in practice today since we don’t sell or share, but the right exists and we will honor it if our practices change.
- Limit use of sensitive personal information: as described in 8.3.
- Non-discrimination: we will not deny goods/services, charge different prices, or provide a different level of service because you exercised a privacy right.
- Data portability: receive a copy of your personal information in a portable format where technically feasible.
How to submit a request: email tim@digitalboutique.ai with the subject line “California Privacy Request,” or call +1 562-600-0089. We will verify your identity by matching the information you provide against what we have on file before fulfilling know/delete/correct requests; requests to opt out generally require less verification. An authorized agent may submit a request on your behalf with written proof of authorization; we may still require you to verify your own identity directly with us.
Response timeline: we will confirm receipt within 10 business days and respond substantively within 45 calendar days, extendable by another 45 days when reasonably necessary, with notice to you.
8.5 Shine the Light (Cal. Civ. Code § 1798.83)
California residents may request, once per calendar year, information about any personal information we’ve disclosed to third parties for their own direct marketing purposes in the prior calendar year. We do not disclose personal information to third parties for their direct marketing purposes. Requests can be sent to the contact in Section 14.
8.6 Notice at Collection
At or before the point we collect personal information (e.g., via a website form), the categories collected and purposes are as described in Sections 2–3 and 8.1 above; this policy serves as our notice at collection.
9. Cookies and Tracking Technologies
Our website uses cookies and similar technologies for core functionality, analytics, and (where applicable) marketing attribution. You can control cookies through your browser settings, including blocking or deleting them; doing so may affect some site functionality. We recognize the Global Privacy Control (GPC) signal as a valid opt-out request where our practices require one. We do not otherwise respond to browser “Do Not Track” signals, consistent with the lack of a common industry standard for interpreting them (disclosed here per CalOPPA).
10. Other Privacy Rights (Non-California)
Depending on your location (e.g., EEA, UK, other US states with comprehensive privacy laws), you may have rights similar to those in Section 8, including the right to access, correct, delete, or port your data, object to or restrict processing, and withdraw consent. Contact us using Section 14 to exercise these rights; we will apply the appropriate framework based on your location.
11. International Data Transfers
We and our subprocessors may process data in the United States and other countries. Where required, we rely on appropriate safeguards (such as standard contractual clauses) for transfers of personal information out of the EEA, UK, or Switzerland.
12. Children’s Privacy
Our website and services are intended for business use and are not directed at individuals under 16. We do not knowingly collect personal information from children, and we do not knowingly sell or share the personal information of consumers under 16.
13. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We’ll post the revised version here and update the “Last Updated” date. Material changes affecting active clients will be communicated directly where appropriate.
14. Contact Us
Questions about this Privacy Policy, a data request, or a California privacy rights request:
Digital Boutique AI
Vista, California
Email: tim@digitalboutique.ai
Phone: +1 562-600-0089