Short answer: an agreement is signed before I see any client data, every tool that may handle it is named in writing, AI workflows keep a person in the approval loop, and you own what is built. I hold no security certification, and this page says so plainly.
Key terms at a glance
| Term | What I commit to | Where |
|---|---|---|
| Agreement | Signed before I see any client data. | DPA |
| Breach notice | Within 48 hours of becoming aware. | DPA 8.1 |
| New sub-processors | At least 14 days’ written notice, with a right to object. | DPA 6.2 |
| Audit | On 14 days’ written notice, once in 12 months unless there is a breach. | DPA 11.1 |
| Deletion | Project copies deleted when the support window ends, or earlier on request. | DPA |
| Transfers | I am in South Africa and my sub-processors for this website process data in the United States, under a valid transfer mechanism where the law requires one. | DPA 12.1 |
| Certification | None. I hold no SOC 2 or ISO 27001 certificate. | Below |
How your data is handled
- I sign a data processing agreement before I see any client data.
- I name every tool that may handle your data in the written agreement before any data is shared.
- I use business or API accounts, which do not train on your content by default, and send tools only the fields a workflow needs.
- Access is through credentials you grant and can revoke, and it is scoped to the workflow.
- When the support window ends I remove my access and delete project copies, or earlier if you ask. Backups and records I am legally required to keep are the exception.
- The sub-processors I use for this website are listed below.
Sub-processors for this website
- Netlify (United States): website hosting and the functions that run the diagnostic and resource requests.
- Anthropic (United States): writes the diagnostic report from your answers and answers questions typed into the Ask a Question page, through its API under commercial terms. Question text is not stored on this website. Please do not type confidential details into that page.
- Resend (United States): sends the report and resource emails.
- HubSpot (United States): call booking.
- Google Analytics and Tag Manager (United States): usage analytics, only after you accept cookies.
Checked 18 October 2026. All five process data in the United States. For a sprint, the tools that may handle your data are named in the written agreement before any data is shared.
Data processing agreement
The agreement I sign before I see any client data is published in full: read the data processing agreement or download the PDF. It covers instructions, confidentiality, security, sub-processors, breach notice within 48 hours, deletion, audits, and international transfers (the EU Standard Contractual Clauses, the UK Addendum, POPIA and the Australian Privacy Principles), plus the US state-law service-provider terms.
You contract with Wayne Conrad Advisory, a division of Poseidon Network Systems CC, South Africa.
Where a person stays in control
- Approval steps sit where your judgement matters. The workflow drafts, checks the limits and routes the work, and a person approves the steps that cannot be undone.
- Decision limits are written down first. Only what is above them is routed to a person.
- AI tools can produce wrong output. That is why approval steps keep a person in control, and why I do not promise revenue, savings or hours saved.
- The free AI hand-off checklist shows the five questions to answer before any process is handed to AI.
Who owns what
- Everything is built in your own accounts. Ownership transfers at final payment.
- You pay the tool vendors directly. Typical monthly running costs are estimated on the pricing page.
- A sprint ends at handover with a recorded walkthrough and a one-page runbook. Anything after that is a separate written agreement.
What happens to your diagnostic answers
- They are used only to write your report, which is shown on the page and emailed to you.
- They are not shared with anyone else, apart from the two services that process them for me: Anthropic writes the report text and Resend sends the email. I delete them if you ask.
- A software service writes the report text from your answers.
What I do not claim
- I do not hold a SOC 2 or ISO 27001 certificate. The vendors I use publish their own.
- I guarantee the build, not your results. The guarantee, its limits and the refund terms are on the pricing page.
Data questions or requests: privacy@wayneconrad.com. Read the privacy policy and the terms of service for the full legal wording.
Questions about data before you book?
Ask on the free 15-minute call. I will walk through exactly which tools would touch your data for the workflow you have in mind.
Book a free 15-minute workflow call