AI Staffroom / Legal
What I collect, who else handles it, and how fast it's gone when you ask. Written to be read, not survived.
Reading the site sets no cookies and loads no ad pixels. My host sees your IP address, and so does Tally once you reach for a teardown button. Nobody else does.
Ask for a teardown and your answers get used for your teardown and for following up about it. The link you came in on also tells me which links bring people in. That's all.
If I contacted you first, your details came from public profiles and your agency's website, and one reply asking me to stop is the end of it.
AI models help with the work. I keep training switched off with every provider I use, and your information never goes through a free AI model.
On client work I get into your tools through their own sharing settings, never a shared password, and each client's data is kept separate.
I've never sold personal information and I never will. One email gets you a copy of what I hold, or gets it deleted.
AI Staffroom is me, Eli Colussi, a sole proprietor in Victoria, British Columbia. So "I" on this page means me, and I'm the one who decides what happens to your information. If I contacted you first, section 02 covers where your details came from.
Some agency owners hear from me before they've heard of me. Today that's a LinkedIn message. Email comes later, and the services it needs go on the list in section 07 before it starts.
Your details came from public profiles and your agency's website: your name, role and company, plus what's public about the agency. Research tools from Apify and PhantomBuster gather them, and I keep them in my records so I can follow up. I use them to contact you about my work, and for nothing else. I sometimes use Anthropic's AI models to help with that research, under the rules in section 03.
Want me to stop? Reply saying so, or email me. I'll delete your details and won't contact you again. The one thing I keep is a do-not-contact entry (your profile link or email address), so it stays that way.
I keep training switched off with every AI provider I use. Nothing from a client, a booking, a teardown request or anyone I contact first goes through a free AI model, because free tiers often keep prompts and learn from them. My build script won't run a free model on a real request.
Wherever the task allows, names, email addresses and other personal details come out before anything reaches a model. Some tasks need them (meeting notes are no use without the names), and then they only go to a provider whose terms rule out training on them.
I get into your tools through each tool's own sharing settings, never a shared password. You can take that access back from the same settings whenever you want.
The workflows run in your own accounts, so your data and your clients' data stay where they already are. What a model needs to see for a task goes to it (section 03 has the rules). The code for your build may sit in my GitHub until it moves into your account.
Each of your clients gets its own workspace, so nothing bleeds between them.
I ask before recording any call. Say no and nothing about the work changes.
Each agency's data is kept apart from every other client's, and nothing one client shares with me ends up in another client's build. Of everything on this page, that's the promise I'd most deserve to lose the business over.
When an agency becomes a client, the owner names the people who should get into my clients-only live sessions and sends me their names and emails. I use those to invite you and to tell you about sessions, and for nothing else.
The platform that hosts the sessions isn't picked yet. It gets your name and email when I send your invite, and the invite names it. You only join if you accept, and from then on that platform's own privacy policy covers what it collects.
Every session is recorded for whoever missed it, and people from every client team can watch the recordings. A recording shows whoever's on camera, and cameras are optional. If you end up in one and want out, ask and I'll cut you out. Anything you say or show can reach other agencies, so keep your clients' details out of it.
Invoices go out through Stripe. Pay by card and Stripe processes it, so your full card number never reaches me. Pay by bank transfer (ACH or wire) and it lands in my Wise account, which sees what any transfer carries: the sender's name and bank details.
Canadian clients can also pay by pre-authorized debit, which Stripe processes, or by direct bank transfer. Like any transfer, that one shows the sender's name and bank details to the banks it passes through.
I keep invoices and payment records for as long as tax law requires.
| Service | What it handles |
|---|---|
| Vercel | Hosts the site and keeps short-lived request logs that include your IP address. Counts visits with no cookies, and works out your city for the weather line. |
| MET Norway | The weather forecast on the homepage. Gets your city's rounded coordinates, never your IP address. |
| Tally | The teardown form and my older one. Its script loads when you reach for a teardown button. It holds your answers once you send them and emails me a copy. |
| Cal.com | Bookings. Takes your name, email, your answers to its questions and any guests' emails, and sends a copy of each booking to my automation server. |
| My email, calendar and video calls (Meet), so anything you send me sits there, and so does any call we book. It also holds the spreadsheet where I track conversations, hosts teardown videos on YouTube at unlisted links, and runs a model OpenRouter passes some requests to. | |
| Railway | Hosts my own automation server. It keeps a record of each booking (your first name, email, answers and the brief I prepare from them), handles my outreach records and holds the workflow I build for your teardown. |
| Composio | Connects my automation server to my Google email and spreadsheet, so booking and outreach details pass through it. |
| Anthropic | Its models help me research agencies, draft teardowns (your email address comes out first), write the brief I prepare before a call and build workflows. |
| OpenRouter | Passes some requests on to the company whose model runs them: build requests (Google, today) and the brief before a call (Anthropic, or Google as a fallback). Names, emails and phone numbers come out first, and each request only goes to a provider that agrees not to train on it. |
| Apify | Outreach research. Gathers names, roles and companies from public profiles. |
| PhantomBuster | Runs parts of my LinkedIn outreach, so it handles the public profile details of people I contact first. |
| Where I message people I contact first. It carries my messages and any replies. | |
| Stripe | Sends invoices and processes card payments and pre-authorized debits. Your full card number stays with Stripe. |
| Wise | Receives bank transfers (ACH and wire), along with the sender details every transfer carries. |
| GitHub | Holds my private working files, so my notes on requests from either form, on people I contact first and on client work can sit there, and so can anything I build for you. The code for a client build stays there until it moves into your own account. |
| Session platform | Hosts the client sessions. It isn't picked yet, and it goes on this list by name before the first invite. It gets your name and email when I send your invite. |
Each has its own privacy policy. Most store data outside Canada, usually in the United States, and the laws where it's stored apply to it. Apart from the banks a payment passes through, a company goes on this list before it touches your data.
Ask for any of it back or gone and I'll do it within 30 days. The exceptions are what the law makes me keep, which in practice means invoices and payment records, and the do-not-contact entry if you've asked me to stop.
I'm based in Victoria, British Columbia, so two privacy laws cover this: Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and British Columbia's Personal Information Protection Act (PIPA). I'm the person responsible for following them here.
You can ask what I hold about you, get a copy, correct it, withdraw your consent, have it deleted or tell me to stop contacting you. One email does it, and I'll answer within 30 days. If you think I've handled any of that badly, you can complain to the Office of the Information and Privacy Commissioner for British Columbia or the Office of the Privacy Commissioner of Canada.
In the United States you get the same rights on request, whichever state you're in. I don't sell personal information and I don't share it for advertising.
I won't ask why you want it. I'll only check it's really you before I send a copy or delete anything.
When this policy changes, the date at the top changes with it. Anything material about how client data is handled goes to current clients by email before it takes effect, not as a silent edit.
Ask. One person reads that inbox and you'll get a straight answer, including about the parts of this you think aren't good enough.
eli.aistaffroom@gmail.com