Privacy Policy

1. Who this policy covers

This policy explains how Calnan AI Labs (“we”, “us”) handles personal information about visitors to www.calnanai.com, people we contact about our services, people who book a call with us, people who apply to our partner program, and the people at our clients’ businesses we work with. Calnan AI Labs is a division of Three Comma Enterprise Corp., which is responsible for the personal information described here.

We follow Alberta’s Personal Information Protection Act (PIPA) and, where it applies, Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA). Our commercial email follows Canada’s Anti-Spam Legislation (CASL) and the US CAN-SPAM Act.

2. Information we collect

Information you give us

• Contact form: your name, email address and your description of what’s broken in your business. To filter out bots, the form also uses Cloudflare Turnstile, a hidden spam-check field and a record of how long the page was open before you sent it.
• Booking a call: the name, email address, time zone and any answers you enter when you book through our scheduling tool, Calendly.
• Calls and email: what you tell us on a call or by email, including details about your business, your systems and how your work gets done.
• Partner applications: your name, email address, city and country, graduation year (if you give it), school and program or current work, LinkedIn profile URL, your answers about who you could reach, why you’d be good at the role, how you heard about us and how the pay sounds to you, and your confirmations on the form. To filter out bots, the application form also uses Cloudflare Turnstile, a hidden spam-check field and a record of how long the page was open before you sent it.
• Client projects: contact details for the people we work with, plus any business information the project requires (see section 7).

Information from public and business sources

We contact owners and managers of businesses in their professional role. To do that, we collect business contact details (name, job title, company, business email address, business phone and company address) from public sources such as company websites, state licensing boards, industry association directories and the Better Business Bureau, and from a business contact database, Apollo. We do not scrape LinkedIn or bulk-copy online map listings.

Before we send a first email to an address, we check it with an email verification service and use it only if the result is “valid”. We use AI assistants to help us read public information about a business and draft emails; a person checks the facts and the wording.

Information collected automatically

• Website: our site is hosted by Vercel, which records standard server logs (such as IP address, browser type, pages requested and time) to deliver and secure the site. We do not use analytics, advertising pixels or cross-site tracking, and the site sets no cookies of its own.
• Bot check: our contact form uses Cloudflare Turnstile, which receives your IP address, browser details and similar technical signals to tell people from bots. It gives the form a short-lived, single-use token. While the check runs, Cloudflare may keep short-lived data in your browser, which it describes as strictly necessary for detecting bots. Cloudflare’s Turnstile privacy addendum applies.
• Fonts: our pages load fonts from Google Fonts, so your browser sends your IP address and browser details to Google when a page loads.
• Booking calendar: the Calendly calendar on our contact page is provided by Calendly, which may set its own cookies. Calendly’s privacy policy applies to that tool.
• Cost calculator: the calculator on our home page runs entirely in your browser. The numbers you enter are not sent to us or stored.
• Email: our outreach emails are sent as plain text, and open and click tracking is turned off in our email and customer-record tools.

3. How we use it

We use personal information only for the purpose we collected it for, or for a purpose you would reasonably expect, unless you agree otherwise or the law requires it.

4. Business emails we send

If you received an email from us, it went to your business address because your role suggested our services could be relevant to your company. Every email names Calnan AI Labs, shows our mailing address and tells you how to opt out.

• A person drafts and reviews each outreach email. Our founder approves the outreach copy and rules. Emails may be scheduled ahead to arrive at a set time.
• Reply “stop” to any email, or write to matt@calnanai.com, and we stop. We add you to our do-not-contact list within 10 business days, and usually sooner.
• We keep your email address on that list so we don’t contact you again.
• We email people in Canada only with their consent, or once after a referral from someone who has a business or personal relationship with both of us. A referral email names the person who referred you.

5. Call recordings

We like to record and transcribe scoping and client calls so we capture requirements accurately and can show what was agreed. Here is how it works:

• Your booking confirmation or meeting invitation says that we ask to record calls.
• At the start of the call, before recording begins, we ask everyone on the call whether they agree.
• We record only if everyone agrees. If anyone declines, we don’t record and take written notes instead.
• We keep recordings and transcripts for 12 months after the call, or until the end of your project if that is later, unless your contract says otherwise.

6. AI tools

We use AI assistants, currently Claude (Anthropic) and ChatGPT (OpenAI), to research public business information, draft emails and documents, and support our work. In both, we have turned off the settings that let the provider use our content to improve its models. Calnan AI Labs does not train AI models on your information.

We use AI-assisted tools to help review partner applications, and a person reviews every decline.

7. Client data in our projects

When you hire us, we may need access to your systems and the information in them (for example, customer, order, invoice or document records). For that work:

• We handle that information only to deliver the work in our agreement with you, and only as you instruct.
• We work in accounts you own wherever possible (your software, your hosting, your keys), with access by invitation rather than shared logins.
• We keep access credentials in a password manager, not in email, chat or documents.
• We put your data only into tools that your agreement with us allows.
• When the work and any care plan end, we remove our access and return or delete project data as your agreement sets out.

8. Who we share it with

We do not sell or rent personal information, and we do not share it for targeted advertising. We share it only with the service providers listed in section 9, with people working on your project (such as contractors, under confidentiality terms), with our professional advisers (such as lawyers, accountants and insurers), with authorities when the law requires it, and with a buyer or successor if all or part of the business is sold or reorganized, under the same protections.

9. Service providers and where information is processed

We are based in Canada. The people and services below handle personal information for us outside Canada, where it may be accessible to courts, law enforcement and national security authorities of those countries. Locations reflect each provider’s published information and can change.

For our written policies on these providers, or any question about how they handle personal information, contact Matt Calnan, Founder, at matt@calnanai.com.

10. How long we keep it

• Inquiries that don’t become projects: 24 months after our last contact.
• Outreach contacts who never reply: 24 months after our last email.
• Partner applications that don’t go ahead: 12 months after our decision, or sooner if you ask us to delete them.
• People we sign an agreement with: for the length of the agreement, then 6 years.
• Do-not-contact list: your email address only, for as long as we send email, so we never contact you again.
• Client records and invoices: for the length of the relationship, then at least 6 years for tax and accounting purposes.
• Call recordings and transcripts: as set out in section 5.

After that, we delete the information or make it anonymous.

11. How we protect it

We use reasonable administrative, technical and physical safeguards for the sensitivity of the information, including a password manager for credentials, access limited to people who need it, and email authentication on our domain. No method is perfectly secure. If a breach creates a real risk of significant harm to you, we will notify you and the regulators as the law requires.

12. Your choices and rights

You can ask us to:

• tell you what personal information we hold about you and how we use it;
• correct information that is wrong;
• stop using it for a purpose, or withdraw your consent;
• delete it, unless we must keep it by law or contract (if you have opted out of email, we keep only your address on our do-not-contact list); and
• stop sending you email.

Write to matt@calnanai.com. We respond within 30 days and may ask you to confirm your identity first. These requests are free.

Canada: if you’re not satisfied with our answer, you can complain to the Office of the Information and Privacy Commissioner of Alberta (oipc.ab.ca) or the Office of the Privacy Commissioner of Canada (priv.gc.ca).

United States: some states give residents added privacy rights. We honour the requests above from anyone, wherever they live.

13. Children

Our website and services are for businesses. They are not intended for anyone under 18, and we do not knowingly collect information from children.

14. Contact us

15. Changes to this policy

We’ll update this page when our practices change and show the new date at the top. If a change materially affects how we use information we already hold, we’ll tell the people affected.

Frequently asked questions

Does Calnan AI Labs sell personal information?

No. We do not sell or rent personal information, and we do not share it for targeted advertising.

How did Calnan AI Labs get my business email?

From public business sources such as your company website, a licensing board or an association directory, or from a business contact database. We check each address with a verification service before the first email.

How do I stop your emails?

Reply “stop” to any email or write to matt@calnanai.com. We add you to our do-not-contact list within 10 business days, usually sooner.

Do you track whether I opened your email?

No. Our outreach emails are plain text, and open and click tracking is turned off.

Do you use AI to handle my information?

We use AI assistants to research public business information and draft emails, with model-training settings turned off. We do not train AI models on your information.

Do you record calls?

Only with permission. We ask everyone on the call before recording starts, and if anyone declines, we take notes instead.

Where is my information processed?

In Canada and in the other countries listed in section 9 of this policy, which include the United States.