How NathanaelTyre.ai handles your data.
A plain-English summary of how I handle client information. The same one-pager attached to every proposal, written so you can hand it to IT, security, or legal and have them say "fine."
Your data stays inside your tools.
I build AI workflows, prompts, agents, and documentation that run inside the tools you already own: Google Workspace, Microsoft 365, Zapier, Claude or ChatGPT, your CRM. I'm not the place your data lives.
Most engagements involve no transfer of customer or employee data out of your environment. I'm building systems your org operates.
When I need to be inside your environment.
Some workflows require me to test or configure inside your environment. When that's needed, access is scoped, time-limited, documented in writing, and revoked at handoff.
In practice that means:
- Access is scoped to the specific workflow being built. Not a blanket admin grant.
- Access is time-limited to the engagement window, with the end date written down before access starts.
- Access is documented in writing: what's accessed, by whom, for how long, and for what purpose.
- Access is revoked at handoff, confirmed in writing.
- I use least-privilege accounts: only the permission needed for the task.
- Credentials never leave your environment and aren't shared with anyone.
If a workflow requires standing access (rare), we discuss it explicitly before scope is locked.
When a written data agreement is required.
A written data agreement is required before work begins on any engagement that touches:
- Customer or employee personal data
- Confidential financial or contract data
- Anything under NDA or an existing data agreement
- Regulated data (typically out of scope, flagged at the qualifier stage)
The agreement covers access, retention, and deletion. I'm happy to use your standard MSA or DPA if you have one. If you don't, I bring a short form to the conversation.
Deletion on request.
You can request deletion of any working copies, drafts, notes, or test data I've held, during or after the engagement. Deletion happens within 7 days, confirmed in writing.
The default at handoff is that no client data leaves with me. That's the safety net for anything held temporarily.
I keep an email log of every email the site sends, including the assessments' emails and the copy of a quiz result: which message went to which address, and when. Report links stay open 90 days after the report is delivered, and each log entry is deleted automatically at most 180 days after its message is sent, so a report email's entry is gone within 90 days of its link expiring. Entries logged before this rule took effect are kept until I approve a one-time deletion of them.
Human approval on anything external.
Any AI workflow I build that publishes, sends, or acts externally is built with a human approval gate by default. AI drafts. A person on your side approves. That's the pattern unless you explicitly request otherwise and we scope the risk together.
I don't build systems that move money or make customer-facing decisions without human review.
What NathanaelTyre.ai will never do with your data.
Stated plainly so it's not buried in clauses elsewhere. NathanaelTyre.ai will never:
- Sell client data to anyone, for any reason.
- Syndicate client data: no shared databases, no industry benchmark feeds, no partner data exchanges.
- Train models on client data. Your data is not training material for any model I build, fine-tune, evaluate, or sell.
- Retain client data past the handoff. No client data leaves with me at handoff; deletion of any working copies follows the timeline above. Assessment email logs follow the schedule in the Deletion section.
If any of these would need to flex for a specific engagement, it would be discussed and written down before scope is locked. The defaults above are the defaults.
What this site measures about your visit.
This site uses Google Analytics 4 (loaded through Google Tag Manager), Vercel Web Analytics and Speed Insights, the Meta Pixel, and Google Ads conversion measurement. Together they count page views, measure page-load speed, and record a few steps: finishing the quiz, starting a checkout, booking a call and buying. That tells me which posts and ads bring people here. GA4 anonymizes IP addresses before storage. There is no LinkedIn Insight Tag and no Google Ads remarketing tag.
If you give me your email (to unlock a scan, get a copy of your quiz result, or check out), I keep a one-way hash of it for 90 days, next to this browser's analytics ID and, if an ad brought you here, the ad's click ID, so a later booking or purchase can be matched to how you found me. Your email itself is never sent to Google or Meta for this. The copy of your quiz result, like every email the site sends or tries to send, also goes in my email log: your address, the subject and when it was sent, kept for at most 180 days (for entries logged before that rule, see Deletion on request above). These emails go out through my Google Workspace email, which keeps them in my sent mail.
In the EU, the UK and Switzerland these tags wait for your consent. Everywhere else they run by default. You can change your choice at any time with Privacy choices at the bottom of any page.
None of this is client engagement data. It's marketing-site traffic data, separate from anything inside an engagement, which is governed by the policies above.
To opt out on a device you control: open devtools console on any page and run localStorage.setItem('va-disable', '1'). To opt back in: localStorage.removeItem('va-disable'). The flag blocks GTM/GA4 and the Vercel scripts per-browser-per-device.
When you unlock a scan, I keep your email address, first name, answers and guess with that scan for 90 days from its last update, and I am sent an email with them so I know who asked. I write to you after that only if you ticked the box. The report email, like every email the site sends, also goes in my email log: your address, the subject and when it was sent, kept for at most 180 days (for entries logged before that rule, see Deletion on request above).
If anything needs to flex for your setup.
Raise it before we sign. The goal: hand this page to your IT, security, or legal lead and have them say "fine."