Privacy

What this site collects

• Fit Check answers. The answers are fixed multiple-choice options, processed to route you and then not kept. The only thing stored is your email address, and only when it is needed for one of three jobs: holding a reserved seat, a paid-offer waitlist entry, or the larger-team list. Fail the Fit Check without joining a list and nothing about you is stored.
• Newsletter signup. If you sign up for Lenny’s AI Builders, your email address, the page you signed up on, and your confirmation status go to Kit, the newsletter provider. You are not subscribed until you click the confirm link Kit emails you. Every email has a one-click unsubscribe. Signing up again with an address that is already subscribed changes nothing.
• Business contact and outreach records. I may keep a business email, role, company, the public source that made contact relevant, suppression status, and a compact record of outreach and responses. A verified email address by itself is not treated as permission to contact someone.
• Invite form fields. If you invite me to speak or collaborate, I store what you typed (name, email, and the invitation itself) so I can reply.
• Free call test requests (on Instagram, not this site). If you message me for a free call test, your business name and the business number you send stay in that Instagram chat. ManyChat sends the first automatic reply. I ring that number once for the test, and I note when I rang and how long it took you to get back to me, so I can tell you. The number is only used for the test.
• Supabase: the access-controlled CRM and lifecycle-event store for contacts, suppressions, proof references, and engagement state. Agent roles receive only the minimum database functions needed for their job; they do not receive blanket table access.
• Clay: approved business-contact research, enrichment, email sequencing, delivery events, and unsubscribe handling. Clay controls the live sequence state; LennyClaw records the corresponding lifecycle event without putting credentials in prompts or repositories.
• AI service providers: bounded assistance with research, qualification, drafting, classification, and summaries. Only task-relevant data is supplied. Credentials, payment-card data, and unrestricted source stores are not sent in prompts.

What this site never collects

This website never collects workflow evidence, client files, credentials, or sensitive documents. There is no upload field for them anywhere, on purpose. Evidence exchange during a paid engagement happens off this website, sanitized only, under the engagement terms.

Processors, named

• Stripe: payments, receipts, and engagement records. Card details go to Stripe directly; I never see or store card numbers.
• PostHog (EU region): anonymized site analytics with no personally identifying information, served through this site’s own /ingest proxy rather than a third-party domain. No advertising cookies, no cross-site tracking.
• Google Calendar: booking your discovery and findings sessions, which only happens after payment.
• Kit: the Lenny’s AI Builders newsletter, its double opt-in confirmation, and unsubscribes. The public field notes and issues on this site are read from Kit.
• YouTube: episode videos. Before you press play, only the video’s still image loads (from YouTube’s image server). The player loads when you press play, in YouTube’s privacy-enhanced mode.
• Vercel: website hosting, which includes standard server logs.
• Supabase: the private customer record. If you hold a seat or join a list, your email, the outcome and whether you came from the site or an outreach page are stored there so i can follow up. Your Fit Check answers are not. If you pay, the three prep answers you give (business and website, the job, and an optional examples link) are stored there too.
• Resend: sends the emails about your seat or list spot (the confirmation, and one reminder before a held seat lets go), and after you pay, the next steps and one reminder if a step is still open. It also sends me an alert with your email and Fit Check answers so i can follow up.
• Telegram and Slack: a short alert to me that a Fit Check, payment, prep or booking came in. It carries no name, email or answers.

Retention

Full prospect messages are retained for no longer than 24 months after the last meaningful interaction, then deleted or de-identified. Minimal suppression evidence may be retained so a person who opted out is not contacted again. Active engagement, payment, legal, and accounting records may be kept for the period required to deliver the work or meet legal obligations. You can ask for access, correction, or deletion at any time.

Access and deletion

Email lennox@lennoxsaint.com to see, correct, or delete what is held about you. I acknowledge every request within 5 business days.

Contact basis, consent, and opting out

Forms state what they do at the point of collection. Business outreach is sent only where there is a documented lawful contact basis and a role-relevant reason; every sequence carries a clear sender identity and unsubscribe mechanism. An unsubscribe, complaint, wrong-recipient signal, or suppression match stops further outreach and blocks re-admission. A Fit Check or purchase is never silently converted into unrelated marketing consent.

No data sales

Your data is not sold, rented, or traded to anyone, for any reason.