Effective date: September 2026 · Version 1.0
This Privacy Policy explains how AI Operating Group, Inc., a Delaware corporation (“AIOG,” “we,” “us”), handles personal data in connection with the CAIO Playbook application and any white-labeled instance of it (the “Service”). It is written for organizations evaluating or using the Service, and for individuals whose data we hold.
This is a plain-language summary. Where a signed contract (a Services Agreement or Data Processing Agreement) governs, that contract controls.
We are a processorfor everything your organization puts into the Service. Your organization decides what goes in, who may see it, and how long it is kept. We act on your organization's documented instructions and do not use that data for our own purposes.
We are a controller only for a narrow set of activities we decide ourselves: running our website, answering enquiries, and meeting our own legal and accounting duties.
Data your organization puts into the Service (we are the processor):
The Service is not designed to collect special-category data (health, ethnicity, religion, biometric data, etc.), and we ask that none is entered into it.
We do not train models on your data. Content your organization submits to the Service is never used to train, fine-tune, or evaluate any machine learning model, by us or by any model provider, other than processing that occurs solely within your own instance for your own benefit.
Where content is sent to a model provider, the Service uses:
Both providers process data in the United States. Content sent to these providers is used only to generate the response you requested — not retained for their own model improvement and not used to train, fine-tune, or evaluate their base models.
Roadmap note, not yet in production: Azure OpenAI and GCP Vertex AI are under consideration for future multi-model support. This policy will be updated before either goes live.
Automated decisions. The Service supports human judgment. It does not make decisions producing legal or similarly significant effects about individuals without human involvement.
We contract with each sub-processor on terms no less protective than those we owe you, and remain responsible for their performance. We give customers advance notice before adding or replacing a sub-processor material to their data.
You may export your data in a structured, machine-readable format at any time during the term and for 30 days afterward.
We do not sell or share personal information as those terms are defined under applicable U.S. state privacy laws, and we do not use it for cross-context behavioral advertising.
If you use the Service through your employer, your employer decides what is held about you. If your relationship is with us directly, write to privacy@getaiog.com. Depending on where you are located, you may have rights of access, correction, deletion, restriction, objection, and portability. We aim to respond within 30 days.
The Service sets a single session cookie, which keeps you signed in and is strictly necessary for the Service to function. We set no analytics, advertising, or tracking cookies, so no consent banner is required.
Customer data is stored in the United States.
We may update this policy from time to time. Material changes will be communicated to customers directly before they take effect.
Privacy inquiries, sub-processor notices, and individual rights requests: privacy@getaiog.com
Legal notices: legal@getaiog.com
Postal address: 2810 N Church St, STE 90138, Wilmington, DE 19802
This is a structural draft prepared for internal review. It is not legal advice and should be reviewed by qualified counsel before publication or use in production.