Privacy Policy

Overview

The Small Council (we, us, our) provides an AI-powered advisory experience for founders and small business owners. This Privacy Policy explains how we collect, use, disclose, and protect information when you access our website, product, and related services (collectively, the Services).

Information we collect

We may collect the following categories of information:

• Account information: name, email address, password (hashed), and basic profile details.
• Payment information: billing address and payment status. Payment card details are processed by our payment processor and are not stored by us.
• Usage data: device information, IP address, browser type, pages viewed, timestamps, and interaction data.
• Content you provide: prompts, messages, uploaded materials, and other inputs you submit to generate advisory outputs (User Content).
• Communications: information you provide when you contact support or participate in surveys.

How we use information

We use information to:

• Provide, operate, and improve the Services.
• Create and deliver advisory outputs based on your inputs.
• Personalize your experience, including saving preferences and configurations.
• Process payments, prevent fraud, and maintain account security.
• Communicate with you about product updates, administrative messages, and support.
• Analyze performance, troubleshoot issues, and conduct internal research.
• Comply with legal obligations and enforce our agreements.

Advisory session content  the questions you ask and the responses generated  is stored to provide conversation continuity within your account. Session data is not used to train AI models, is not shared with other users, and is not sold to third parties. You may request deletion of your session history at any time by contacting [email protected].

With your explicit consent, we may send you The Council Brief newsletter and product updates. You may unsubscribe at any time via the unsubscribe link in any email or by contacting [email protected].

Legal bases (where applicable)

Where required by law, we process personal data based on:

• Contract: to provide the Services you request.
• Legitimate interests: to secure, improve, and market the Services.
• Consent: where you opt in to marketing or certain cookies.
• Legal obligation: to comply with applicable laws.

How we share information

We may share information with:

• Service providers: hosting, analytics, customer support, email delivery, and payment processing vendors.
• Professional advisors: legal, accounting, or security advisors as needed.
• Business transfers: in connection with a merger, acquisition, financing, or sale of assets.
• Legal and safety: to comply with law, respond to lawful requests, or protect rights, safety, and property.

We do not sell personal information in the traditional sense. If applicable law defines sale or sharing broadly (e.g., certain advertising cookies), you may have opt-out rights as described below.

AI processing and advisory outputs

The Services may use third-party AI models to generate outputs. Your User Content may be processed by those providers solely to generate and improve the Services, subject to contractual restrictions.

No sensitive data: Do not submit highly sensitive personal information (e.g., government IDs, health data) unless we explicitly request it.

Outputs are informational: Advisory outputs are for informational purposes and are not legal, tax, or financial advice.

Cookies and tracking

We may use cookies and similar technologies to:

• Keep you signed in and maintain session security.
• Remember preferences.
• Measure traffic and usage.

You can control cookies through your browser settings. Some features may not function without cookies.

Data retention

We retain information for as long as necessary to provide the Services and for legitimate business purposes, including compliance, dispute resolution, and enforcement.

Security

We use reasonable administrative, technical, and physical safeguards designed to protect information. No system is 100% secure, and we cannot guarantee absolute security.

Your choices and rights

Depending on your location, you may have rights to:

• Access, correct, or delete your personal information.
• Object to or restrict certain processing.
• Opt out of marketing communications.
• Receive a copy of your data (data portability).

To exercise rights, contact us using the information below.

Childrens privacy

The Services are not directed to children under 13 (or under 16 where applicable), and we do not knowingly collect their information.

International transfers

If you access the Services from outside the United States, your information may be transferred to and processed in the United States and other jurisdictions.

Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version and revise the effective date.

California Privacy Rights (CCPA/CPRA)

As a California resident you have the right to: know what personal information we collect and how it is used; request deletion of your personal information; correct inaccurate personal information; opt out of the sale or sharing of personal information (we do not sell or share your data for advertising purposes); and non-discrimination for exercising these rights. To submit a request contact [email protected]. We will respond within 45 days.

Contact

If you have questions or requests regarding privacy, contact: