Privacy notice

1. Scope and current state

This draft covers the Copp Oak Advisors public website and its local, synthetic preview routes. Copp Oak is building an owner-led AI transformation practice. The public pages explain the practice, its Navigate → Build → Steward method, and the client-owned Company Brain direction.

The local draft does not enable analytics, advertising trackers, booking, payment, or a live model connection. Disabled preview controls are not a sign that those services are active.

2. Information and local previews

The public pages are primarily static content. The local “See It in Action” preview states that entered text is not sent, stored, or used to generate a response. The Client Access controls are disabled and do not create an account or contact an identity provider.

The local Opportunity Review readiness screen is fail-closed. It asks for bounded yes/no eligibility answers and does not ask for names, contact details, free text, links, business facts, or sensitive information. Do not put confidential, regulated, privileged, credential, payment-card, or other sensitive data into a public page.

A local Company Brain reference workflow may use a necessary, server-only session cookie to continue a synthetic local session. The current code marks it HttpOnly and SameSite=Strict. It is not an analytics cookie. The production cookie inventory remains review-gated.

3. Purpose and use

Current known use is to display the website, protect local synthetic routes, and keep local preview behavior within its stated boundary. Any future contact, booking, intake, payment, client portal, connector, or Company Brain workflow will need its own approved purpose, data boundary, access rule, and notice.

The legal basis or other jurisdiction-specific basis for each future processing activity is review-gated and is not stated by this draft.

4. Vendors and sharing

No external analytics, advertising, booking, payment, or model provider is enabled by this local legal-page draft. A final notice must identify the hosting, logging, identity, scheduling, payment, storage, model, and other vendors that are actually used, together with the relevant purposes and safeguards.

The vendor and subprocessor register, disclosure list, transfer details, and any data-processing terms are review-gated. This page does not invent them.

5. Cookies and analytics

This local draft adds no analytics, advertising, or marketing cookies. The only currently known application cookie is the necessary local synthetic-session cookie described above. It is not used to measure visits or build a marketing profile.

A future analytics inventory, cookie categories, consent choice, preference mechanism, event dictionary, recipients, and retention rule are review-gated. Analytics must not be enabled by treating this draft as approval.

6. Retention and deletion

This draft does not assert a retention period for request data, server logs, local session state, recordings, transcripts, client-source material, derived memory, backups, or support records. The exact schedule must match the actual system and agreement.

Retention periods, deletion triggers, backup aging, export paths, legal holds, and the owner of each deletion process are review-gated. No deletion promise should be inferred from this draft.

7. Security and access

Copp Oak's operating baseline calls for least privilege, named access, MFA where available, separate client environments, encryption, secrets protection, logs, backups, export, deletion, and human approval for material external actions. Those are control requirements, not a claim that every control is already deployed on this local website.

The production security architecture, incident process, authentication, hosting controls, and evidence for any future service remain review-gated.

8. Requests and contact

A final notice should explain the available privacy requests, identity checks, response timing, appeal path where required, and the responsible contact channel.

Review-gated: Copp Oak has not confirmed the public privacy-request email, form, postal address, or other contact channel for this draft. No postal address is supplied here. Do not send sensitive information through an unconfirmed channel.

9. Children and special categories

The site is written for business owners and operating leaders. A final notice must state the rule for children’s data and any sensitive or regulated information. That rule is review-gated; this draft does not authorize submitting such information.

10. Draft status and changes

This page remains a local draft until legal review confirms the controller or business identity, scope, practices, rights, vendors, retention, contact channel, and effective date. A final version must state when it takes effect and how material changes are communicated.