On this page
What we collect
Three buckets, all of which you give us directly:
- Intake form answers. Your name, role, email, phone (if you provide it), company name, website, location, plus everything you tell us about your business, stack, pain, and goals.
- Engagement data. If we work together, anything you share so we can do the job -- Slack messages, briefing edits, calendar info, contract details, billing.
- Public surfaces. Only if you explicitly opt in on the intake: we scan your public website and social profiles to build a better briefing. Public-only. No logins, no scraping anything behind auth.
We do not collect tracking-grade analytics about how you use this site. No pixels, no session replays, no third-party ad networks.
How we use it
To do the work you came here for. Specifically:
- Write your briefing
- Scope, propose, and (if signed) deliver builds
- Email you about your engagement and follow up on briefings
- Send field-note posts if and only if you've subscribed
We do not sell your information. We do not feed it into model training. We do not use it to target you with ads on other sites.
Who we share it with
Only the vendors we need to run the business, and only what's strictly necessary:
- Form / email infrastructure -- to receive your intake and send replies
- Calendar / video tooling -- if we hop on a call
- Accounting + payment -- if you become a paying client
- Model APIs -- only on engagement data, and only when we're actively building or maintaining an agent for you; never your intake content alone
If a vendor changes, the list above gets updated. We don't share with anyone else without your explicit permission.
Where it lives
US-based infrastructure unless your engagement specifies otherwise (e.g., GDPR-required EU residency, which we'll set up as part of scope). Backups encrypted at rest. Access is limited to Cortland and any contractor explicitly working on your engagement.
Intake data is retained for 24 months whether or not you become a client -- long enough to remember the conversation if you come back. After that it's deleted automatically. You can request deletion sooner.
Your rights
Wherever you live, you can:
- See what we have on you -- email us, we'll send the export
- Correct anything that's wrong
- Delete everything -- at any point, no questions, even if we're mid-engagement (we may keep contract / financial records as legally required)
- Take it elsewhere -- exports come in plain JSON
If you're in the EU/UK/California, the same applies -- GDPR / UK-GDPR / CCPA equivalents are baked in.
Cookies
One: the intake form uses localStorage on your browser so your draft survives a refresh. It never leaves your machine until you hit Submit. No third-party cookies, no analytics cookies, no ad cookies.
Changes to this policy
If we change anything material, the "last updated" date at the top gets bumped and (if you've given us your email) you get a note. We won't silently change the rules on you.
Questions
Email [email protected]. Real reply within two business days. If you're requesting deletion or an export, we'll handle it inside seven days.