Privacy Policy
Last updated: July 29, 2026
AI Policy Starter ("we," "us") is operated by Well Made Decisions LLC, a Wyoming limited liability company. This policy explains what we collect, how we use it, and your choices. Questions: [email protected].
Information we collect
- Information you provide: your first and last name, email address, and company name, plus the answers you enter in the questionnaire (industry, company size, regions and U.S. states of operation, regulated data types, intended AI use cases, technology platform and systems, AI-adoption status, IT function, governance owner, risk priorities, AI-tool decisions, any additional context, and — if you choose to upload one — the file name and a short text excerpt of a reference document).
- Payment information: if you purchase the paid pack, payment is processed by Stripe. We do not receive or store your full card details.
- Technical information: your IP address and basic device/browser information, used to operate the service, prevent abuse, and enforce rate limits.
- Local storage: we save your in-progress answers in your browser's local storage so you can resume; this stays on your device.
- Feedback you send: if you use our feedback form, we store the name, email, and message you provide so we can read your feedback and follow up. We do not add you to a marketing list.
How we use your information
- To generate your requested documents and provide free and paid access.
- To process payments and provide support.
- To prevent abuse and secure the service (bot verification and rate limiting).
- To understand usage and improve the product.
- To communicate with you about your request or account.
Your generated documents
The free Governance Overview is generated and assembled in your browser and downloaded directly to your device; we do not store it. If you purchase the full pack, we generate your documents on our servers and store the text, so delivery no longer depends on your keeping the tab open. The finished files are assembled into Word documents in your browser when you open them.
If you purchase the full pack, we store the answers you entered and a copy of your finished documents for up to 30 days so you can download your pack from any device through a secure link we email you. The link is protected by a long, unguessable token and only works while your access is active. Your answers and documents are deleted after your access period ends, or sooner if you request it at [email protected].
Service providers we share with
We share limited information with the following providers solely to operate the service. We do not sell your personal information.
| Provider | Purpose | What it receives |
|---|---|---|
| Anthropic | AI generation of your documents | Your questionnaire responses (such as industry, tools, systems, operating regions, and any reference-document excerpt you choose to upload) are sent to Anthropic's API to draft your documents. We do not send your name or email address to the AI. Under its commercial API terms, Anthropic does not use API inputs or outputs to train its models. |
| Stripe | Payment processing | Your email and payment details (handled by Stripe; see Stripe's privacy policy). Payment details are not shared with any AI provider and are not stored by PolicyStarter. |
| Supabase | Storing your questionnaire/contact record | The information you provide in the form. |
| Resend | Sending your download link (paid pack) | Your email address, used to deliver the secure link that lets you download your paid pack within your access period. |
| Cloudflare | Hosting, request proxying, bot protection (Turnstile), privacy-friendly cookieless site analytics (Cloudflare Web Analytics), and, for paid users, temporary storage of your answers and finished documents | Technical data such as IP address, the page visited, referrer, and basic device or browser information; and, for paid users, temporary storage of your questionnaire answers and finished documents (up to 30 days) so you can download your pack. Cloudflare Web Analytics does not use cookies and does not track you across other sites. |
Cookies and similar technologies
We use browser local storage to save your progress, and Cloudflare Turnstile may set a token to distinguish humans from bots. For website analytics we use Cloudflare Web Analytics, which is privacy-first and does not set cookies or track you across other sites. We serve our fonts from our own servers, so viewing the site does not send your data to a third-party font provider. We do not use advertising or cross-site tracking cookies. We do not respond to Do Not Track signals; because we do not sell or share personal information, Global Privacy Control signals do not change our practices.
Data retention
- Contact and questionnaire record: the record you create (name, email, company, and your questionnaire answers) is retained in our database until you request deletion or it is no longer needed for the purposes above.
- Paid-pack answers and documents for download: if you purchase the pack, a copy of your answers and your finished documents is stored for up to 30 days so you can download your pack from any device, then automatically deleted.
- Abuse-prevention data: rate-limit and payment-access records expire automatically (within 24 hours to 30 days).
You can request deletion of your information at any time at [email protected].
Your rights
Depending on where you live (including under the GDPR and the California CCPA/CPRA), you may have the right to access, correct, delete, or port your personal information, and to object to or restrict certain processing. We do not sell or "share" personal information for cross-context behavioral advertising. You may use an authorized agent to submit a request, and we will take steps to verify the request. We will not discriminate against you for exercising your rights. To exercise any right, email [email protected]; we will respond as required by law.
Where the GDPR applies, we process your information to perform our contract with you (Article 6(1)(b)), for our legitimate interests in operating and securing the service (Article 6(1)(f)), and with your consent where required. Your information is processed in the United States, and our providers offer appropriate safeguards for international transfers. You have the right to lodge a complaint with your local supervisory authority.
Security
We use reputable infrastructure providers and reasonable technical measures to protect your information. No method of transmission or storage is perfectly secure. If a data breach affects your personal information, we will notify you and the appropriate authorities as required by applicable law.
International users
We are based in the United States and process information there. By using the service you understand your information may be processed in the U.S.
Children
The service is for businesses and is not directed to children under 16, and we do not knowingly collect their information.
Changes
We may update this policy; we will revise the "Last updated" date above and, where appropriate, provide additional notice.
Contact
Well Made Decisions LLC (Wyoming, USA) — [email protected].