Plain language, like everything else here.

What this site collects, and when

• The AI Risk Scorecard runs in your browser — your answers and score are computed on your device and are not sent to us unless you choose the email option. If you do, we receive your name, email, practice type, and your score, and use them to send you the breakdown and the policy starter kit, plus occasional relevant emails. Every email includes a one-click unsubscribe.
• The chat widget. Messages you type are processed by an AI model to generate a reply. Please don't enter confidential or client-identifiable information — the widget says so, and this policy repeats it. We do not use your messages to train AI models.
• Booking. Scheduling runs on Cal.com; the details you enter there (name, email, meeting notes) are handled under Cal.com's own privacy policy and shared with us to run the meeting.
• Email. If you email hello@gaganai.com, we keep the correspondence for as long as it's useful to our conversation.

What this site does not do

• Analytics is cookieless. We use Plausible, which sets no cookies and collects no personal information — only aggregate page views, referrers, country, device type, and which site features are used (for example that a scorecard was completed and its risk band — never the answers, and never who you are).
• No advertising trackers and no cross-site tracking cookies.
• No selling or renting of your information to anyone, ever.
• The only thing stored in your browser by us is your light/dark theme preference — it never leaves your device.

Who processes data on our behalf

Brevo sends our emails and holds the contact list described above. Cal.com handles bookings. Plausible provides the cookieless analytics described above. Our hosting provider serves the site and keeps standard server logs. An AI model provider processes chat messages to generate replies. Each operates under its own published terms; we choose business-grade services and don't hand your data to anyone else.

Your choices

Unsubscribe from emails with the link in any of them. To see, correct, or delete what we hold about you, email hello@gaganai.com — we'll act on it promptly and tell you what we did. We handle personal information in line with Canada's PIPEDA; questions and complaints come to the same address first, and you always have the right to contact the Office of the Privacy Commissioner of Canada.

How long we keep things

• Scorecard and subscriber data (name, email, practice type, score band): kept while you remain subscribed, and deleted within 30 days of an unsubscribe or a deletion request.
• Booking data (Cal.com and the calendar invite): kept for 24 months after the meeting so we can refer back to what was discussed, then deleted.
• Chat transcripts: not stored by us. The AI provider processes each message to generate its reply under its own retention terms; we keep no copy.
• Client project data: kept for the engagement plus 12 months for defect correction and reference, then deleted — or returned or deleted earlier on request.

If something goes wrong

If personal information we hold is lost, accessed, or disclosed without authorization, we notify the affected people and clients without unreasonable delay, and we report to the Office of the Privacy Commissioner of Canada where the law requires it. We keep a record of every such incident.

Client engagements

Consulting engagements are governed by their own written agreements, which include specific data-handling commitments — including that client-identifiable data is not requested through this website at all. During an engagement, client project data is hosted in Canadian regions where possible, and no client personal information goes into AI tools unless it is necessary for the work — and then only into business-tier tools configured so the data is not used for training.

Changes

If this page changes materially, the date above changes with it. The current version always lives at https://gaganai.com/privacy.