Privacy Policy

Last updated 20 October 2026

1. Who is responsible

ProdClaw is the trading name of Markus Rommel, an independent software developer, who is the data controller for information collected through this site. Contact: [email protected].

2. What we collect

What	Why	When
Name, email, company, website	To reply to your inquiry	You submit the inquiry form
What you tell us about your product, stage, timeline, and budget	To scope the work and give a useful answer	You submit the inquiry form
Scheduling details	To hold a call	You book through our scheduling provider
Project information and credentials	To perform an engagement you have signed	During a paid engagement
Email address	To send updates you asked for	You subscribe; only if you subscribe

We do not use advertising cookies, analytics trackers, or fingerprinting on this site. Our hosting provider keeps standard server logs for security and reliability.

3. Discovery documents stay in your browser

The Blueprint discovery form on this site saves your answers in your own browser's local storage so you can return to it. Those answers are not transmitted to us unless you choose to download the file and send it. Clearing your browser data removes them.

4. How we use it

• To respond to inquiries and prepare proposals.
• To perform engagements you have contracted us for.
• To send administrative messages about an active engagement.
• To meet legal, accounting, and tax obligations.
• To send occasional updates, if you subscribed. Unsubscribe at any time from any email.

We do not sell, rent, or trade your personal information.

5. Client data and confidentiality

During an engagement we may access your source code, databases, infrastructure, business information, and credentials. This is treated as strictly confidential under the confidentiality terms of your agreement, and:

• Credentials are stored in a password manager or secret store, never in plain text, email, or chat.
• Access is limited to what the work requires.
• Your data is never used to train machine learning models.
• Your data is never shared with other clients or used in other engagements.
• We ask you to rotate all shared credentials once the engagement ends, and we remove our access on request.

Where we process personal data on your behalf as part of an engagement, we act only on your documented instructions as a data processor, and will execute a separate data processing agreement where applicable law requires one.

6. Call recording and the front desk service

If you use the AI front desk, we process calls and messages on your behalf. This section covers how that works, because it involves other people's personal data as well as yours.

• Recording disclosure. Every call opens with a notice that it is recorded. California is a two-party consent state, so this is a legal requirement there and our standard practice everywhere.
• What is captured. Audio, a written transcript, a summary, the caller's phone number, and whatever they provide during the call such as a name, address, and description of the problem.
• Text messages. Missed-call text-back, booking confirmations, review requests, and estimate follow-ups are sent on your behalf. Recipients can opt out by replying STOP, and we honour that immediately.
• Where it lives. In a cloud account registered to your business, not pooled in a ProdClaw platform.
• Who is the controller. You are the data controller for your callers' data. We are a processor acting on your instructions.
• Quality review. A small sample of calls is reviewed by a person each week so factual errors get corrected. Reviewers see only what the service already holds.
• No model training. Call content is never used to train machine learning models, yours or anyone else's.

Retention. Transcripts are kept for 13 months and audio for 90 days, then purged, unless you ask in writing for a different period. Shorter retention is available on request and we will not argue with you about it.

7. Missed-call check

If you request a free missed-call check, we place a small number of test calls to the number you give us. We place no more than five calls, never before 8am or after 9pm local time, and we stop immediately if you ask. Those calls may be recorded so the report is accurate. The recordings and the number are deleted once your report is sent. You must be authorised to give permission for the number you submit, which is why that is a required checkbox rather than something buried in these terms.

8. Service providers

These third parties process limited data on our behalf. Each has its own privacy policy.

Provider	Purpose	What it receives
Cloudflare	Website hosting and delivery	Server log data
FormSubmit	Delivering inquiry form submissions by email	The contents of the form you submit
TidyCal	Call scheduling	Name, email, booking details
Buttondown	Email updates, if you subscribe	Email address
Twilio	Phone numbers, call handling, SMS delivery for the front desk	Call audio, phone numbers, message content
Voice platform	Speech recognition and synthesis for the front desk	Call audio and transcripts
Stripe	Invoicing and payment	Billing details; we never see full card numbers

We may also disclose information where required by law, or where necessary to establish or defend a legal claim.

9. How long we keep it

• Inquiries that do not become engagements: up to 12 months, then deleted.
• Client project data: for the engagement plus the support window; deleted or returned on request afterwards.
• Client credentials: deleted at the end of the engagement.
• Invoices and financial records: as long as tax and accounting law requires.
• Email subscribers: until you unsubscribe.

10. Security

We apply the same practices to our own operations that we build into client systems: credentials held in a secret store rather than in files or environment variables, multi-factor authentication on all accounts, encrypted disks, least-privilege access, and encrypted backups. No system is perfectly secure, but nothing here is an afterthought.

11. Your rights

You can ask us to provide a copy of the personal data we hold about you, correct it, delete it, or stop using it for a particular purpose. Email [email protected] and we will respond within 30 days. Depending on where you live, you may have additional rights under laws such as the GDPR or the CCPA; we honour those requests regardless of where you are located.

12. International transfers

We operate from the United States and our service providers may process data there. If you are in another jurisdiction, submitting information to us involves a transfer to the US.

13. Children

This site and our services are intended for businesses and are not directed at anyone under 18. We do not knowingly collect data from children.

14. Changes

We may update this policy; the current version is always the one published here with the date shown above. Material changes affecting an active engagement will be communicated directly.

15. Contact

Any privacy question or request: [email protected]