privacy policy

The data controller responsible for your personal data is Chapter Two Consulting LLC. You can contact us at hello@chapter2.ai or by mail at the address we publish on our website for privacy requests and questions.

We collect information in the following ways:

• Information you provide. When you submit our contact form, we collect your name, email address, phone number (optional), company (optional), how you heard about us, areas of interest, and your message. When you submit a profile or job application, we collect your first and last name, email, phone, city, state, LinkedIn/GitHub URLs (optional), resume or CV (file), work location preferences, how you heard about us, and any message you include. We also record the time at which you gave consent where required.
• Automatically collected information. When you visit our site, we may collect your IP address, browser type, device information, and pages visited. We use this in connection with security (e.g. reCAPTCHA to prevent abuse) and, if you consent, for analytics to improve our website.
• Cookies and similar technologies. We use a cookie (or similar local storage) to remember your cookie consent choice (e.g. whether you accept or reject non-essential cookies). If you accept, we use Google Analytics, which sets its own cookies. You can change your preference at any time via the "Cookie preferences" link in our footer.

We use the information we collect to:

• Respond to your inquiries and communicate with you about our services;
• Process and evaluate profile and job applications, and to match candidates with roles (including by sharing relevant data with our recruitment/ATS provider, Loxo);
• Send internal notifications (e.g. by email via Resend) when you submit a form;
• Optionally create or update records in our CRM (Pipedrive) for business development and follow-up;
• Improve our website and user experience (e.g. analytics, when you have consented);
• Protect our site from spam and abuse (e.g. reCAPTCHA);
• Comply with legal obligations and enforce our terms.

Where the GDPR applies, we process your data on the following bases: (a) consent — for contact and profile submissions, optional marketing, and analytics cookies when you accept them; (b) contract — where processing is necessary to take steps at your request (e.g. considering your application); (c) legitimate interests — to operate our business, secure our website (e.g. reCAPTCHA), and improve our services, where those interests are not overridden by your rights; (d) legal obligation — where we must retain or disclose data to comply with law.

We do not sell your personal data. We share data only as follows:

• Resend — to send notification emails when you submit contact or profile forms (US; see Resend's privacy policy for their practices).
• Google — for reCAPTCHA (anti-spam) and, if you consent, Google Analytics (US; see Google's privacy policy).
• Loxo — for applicant tracking and recruitment when you submit a profile or job application (US; see Loxo's privacy policy).
• Pipedrive — optionally, to manage leads and contacts when we use their CRM (EU/US; see Pipedrive's privacy policy).
• Cloudflare — for hosting and security (global; see Cloudflare's privacy policy).
• Sanity — for content management that delivers site content (we do not send form data to Sanity).

We may also disclose information if required by law, to protect our rights or safety, or in connection with a merger or sale of assets (with appropriate confidentiality and use restrictions).

Your data may be processed in the United States or other countries where our service providers operate. Where we transfer personal data from the UK or EEA to countries not deemed to provide adequate protection, we rely on appropriate safeguards such as the UK International Data Transfer Agreement, the EU Standard Contractual Clauses, or other mechanisms permitted by applicable law. You may request details of these safeguards by contacting us.

We retain your information only as long as necessary for the purposes described above. Contact and profile submission data are kept for as long as needed to respond, conduct recruitment, and maintain business records (typically several years unless you request erasure sooner). Analytics data is typically aggregated or anonymized; cookie consent is retained to honour your choice. We may retain certain data longer where required by law (e.g. tax or employment records).

Depending on where you live, you may have the following rights:

• UK/EU/EEA (GDPR): Right of access, rectification, erasure ("right to be forgotten"), restriction of processing, data portability, and to object to processing. You may withdraw consent at any time. You have the right to lodge a complaint with a supervisory authority (e.g. in your country of residence).
• California (CCPA/CPRA): Right to know what personal information we collect and how it is used and shared; right to delete; right to correct; right to opt out of the "sale" or "sharing" of personal information (we do not sell or share for cross-context behavioural advertising); right to non-discrimination for exercising these rights.
• Canada (PIPEDA): Right to access and correct your personal information; right to withdraw consent (subject to legal or contractual restrictions); right to complain to the Office of the Privacy Commissioner of Canada.
• Australia (Privacy Act/APPs): Right to access and correct your personal information; right to complain to the Office of the Australian Information Commissioner.

To exercise any of these rights, contact us at hello@chapter2.ai. We will respond within the timeframes required by applicable law (e.g. one month under GDPR, 45 days under CCPA where applicable). We may need to verify your identity before processing a request.

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the CPRA gives you additional rights:

• Right to know: You may request a copy of the categories and specific pieces of personal information we have collected about you, the categories of sources, our business or commercial purposes for collecting it, and the categories of third parties with whom we share it.
• Right to delete: You may request that we delete your personal information, subject to certain exceptions (e.g. to complete a transaction, detect security incidents, comply with law).
• Right to correct: You may request correction of inaccurate personal information we hold about you.
• Right to opt out of sale or sharing: We do not sell personal information nor do we "share" it for cross-context behavioural advertising. If our practices change, we will update this policy and provide a clear opt-out mechanism.
• Right to non-discrimination: We will not discriminate against you for exercising your CCPA rights.
• Authorised agents: You may designate an authorised agent to submit requests on your behalf; we may require verification of the agent's authority and your identity.

To submit a request, contact us at hello@chapter2.ai. We will respond within 45 days as required by California law.

If you are in the United Kingdom or the European Economic Area, the UK GDPR or the EU GDPR gives you the following rights:

• Right of access: You may request a copy of your personal data and information about how we process it.
• Right to rectification: You may request correction of inaccurate or incomplete personal data.
• Right to erasure ("right to be forgotten"): You may request deletion of your personal data in certain circumstances (e.g. where it is no longer necessary, where you withdraw consent, or where it was processed unlawfully).
• Right to restrict processing: You may request that we restrict how we use your data in certain situations (e.g. while we verify accuracy or where you object to processing).
• Right to data portability: Where we process your data by automated means based on consent or contract, you may request a copy in a structured, machine-readable format or transfer to another controller where technically feasible.
• Right to object: You may object to processing based on legitimate interests or to direct marketing. We will stop such processing unless we have compelling legitimate grounds that override your interests.
• Rights related to automated decision-making: We do not make decisions based solely on automated processing that significantly affect you; if we did, you would have the right to obtain human intervention and to contest the decision.
• Withdraw consent: Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.
• Complaint: You have the right to lodge a complaint with a supervisory authority in your country of residence (e.g. the ICO in the UK, or your local data protection authority in the EEA).

To exercise any of these rights, contact us at hello@chapter2.ai. We will respond within one month.

We use reasonable technical and organisational measures to protect your data (e.g. HTTPS, access controls, secure form handling). No method of transmission or storage is 100% secure; we cannot guarantee absolute security.

Our website and services are not directed at children under 16 (or higher age in certain jurisdictions). We do not knowingly collect personal data from children. If you believe we have collected a child's data, please contact us and we will delete it promptly.

We may update this Privacy Policy from time to time. We will post the revised policy on this page and update the "Last updated" date. Material changes may be communicated by a notice on the site or by email where appropriate. We encourage you to review this policy periodically.

For privacy-related requests, questions, or complaints, contact us at hello@chapter2.ai. We will work with you to resolve any concerns.