How we look after your data.

• We ask for the minimum. Never your RFC password (CIEC), passwords, bank details or identity documents.
• AI proposes and a person decides. In the site’s guide, in our products and in projects.
• We state the real status of everything: live, in pilot or in development.

• All traffic is encrypted in transit (HTTPS) and data is encrypted at rest by our cloud provider.
• Keys and secrets live in a secret manager, never in the code.
• The browser has no direct access to the database: everything goes through our server, which validates every submission.
• The internal panel only admits people with a verified argonaut-ai email. Client access is by a link to your email, with no passwords to steal.
• We limit submissions per visitor and check that they come from a person. We do not store IP addresses.
• No third-party analytics and no advertising cookies.

The site’s data is stored in the United States, with these providers, which process it on our behalf:

• Google Cloud and Firebase: hosting, database, sign-in and AI model.
• Microsoft 365: email.
• Cloudflare Turnstile: bot check.

• The guide identifies itself as AI before you type.
• It is instructed not to give legal, tax or financial advice and not to ask for sensitive or contact data.
• A person reviews every brief before the call.
• Conversations are kept for 90 days to review quality and are then deleted automatically.
• We use the model under terms where your conversations are not used to train third-party models.

• Requests and contact details: up to 24 months after the last contact.
• Guide conversations: 90 days.
• Abuse counters: 2 days.

• We work inside your environment: your data stays in your systems wherever possible.
• We sign confidentiality and data-processing agreements before touching information.
• Least-privilege access, personal and revoked when the work ends.
• Test environments use fictitious or anonymised data.
• Where minors are involved, as in academies, a guardian’s consent comes before any video.

We hold no certification today. We organise our controls according to ISO/IEC 27001 (information security) and are working toward that certification. We use ISO/IEC 27701 (privacy) and ISO/IEC 42001 (AI management systems) as references. Our cloud providers hold their own certifications, which do not stand in for ours.

If a security breach significantly affects your data, we will tell you without delay: what happened, which data is involved and what we are doing.

If you find a vulnerability, write to hello@argonaut-ai.com. We will answer, and we take no action against good-faith reporters.