Privacy Notice
Information as of November 12, 2026
Version 1.2 · Effective November 12, 2026.
1. Who the controller is
The controller is GROU LLC, a Wyoming limited liability company (United States), with its address at 30 N Gould St Ste N, Sheridan, Wyoming 82801, United States, owner of AI Policy Generator (aipoliciesgenerator.com). Privacy contact: privacy@aipoliciesgenerator.com. Our representative in the EU and the UK is Sumarios Seculares; you can contact it through privacy@aipoliciesgenerator.com, stating in the subject line that the message is for the representative.
2. Who this notice covers
People who visit the site, use the self-assessment, download documents or free resources, purchase, subscribe to the alerts, request a partner license or contact us. The site is not directed to anyone under 18.
3. What we do not process
- We do not use artificial intelligence to process your data or to generate or personalize documents.
- We do not receive the documents you adapt. The documents we sell are the same for every buyer; you edit them on your own devices with your own tools.
- We do not ask for special categories of data (health, ethnic origin, biometric data, etc.). Please do not include them in your messages.
4. What data we process, why, and on what basis
| Activity | Data | Purpose | Legal basis (GDPR) | Retention |
|---|---|---|---|---|
| Browsing | IP, device and browser identifiers, pages viewed, necessary cookies | Operate the site, security, fraud prevention | Legitimate interest (art. 6(1)(f)) | Technical logs: up to 90 days |
| Reference map (self-assessment) | While you use it, none on our servers: answers (role, size, headquarters country, markets, AI deployment profiles, industries, use cases, data and level) are processed in your browser and stay in the page URL and in your browser's local storage. If you then send a form (download, alerts or partner license), we include those answers in your request | Show the result; learn the markets and AI uses of the people who ask us for documents or alerts, even where we have no rules on file for those countries | Your request (art. 6(1)(b)); legitimate interest in knowing our users (art. 6(1)(f)) | In the browser, until you clear the site's data; included in a request, that request's period |
| Free downloads | Full name, work email, company, job title, phone, country, language, employee range, intended use (your organization or your clients), document or kit and format downloaded, whether you used the customizer (we do not keep on our servers what you type into it), date, acceptance of the License and of this notice, email verification status and products downloaded, and, if you completed "What applies to me," those answers | Verify your email with a signed link that expires after 7 days and contains no personal data, and deliver the documents; learn who uses them and for what; if you say they are for your clients, contact you about the partner license | Your request and the license you accept (art. 6(1)(b)); legitimate interest in knowing our users and improving the product (art. 6(1)(f)) | 24 months from your last download, or until you ask for deletion. Until you open the link, your email, organization, language, product and the rest of the form data wait in our database (Cloudflare D1); when you open it, that data is sent to the CRM and deleted from the request; expired requests are removed in the periodic cleanups |
| Access identifier (local storage) | A signed access identifier (key apg_free_v1) with a random code for your request, the language, the product requested and the expiry date; it does not include your email, name or organization. It is saved in your browser when you open the download link we email you. It is not an advertising or analytics cookie | So you can keep downloading from this browser without requesting another link until it expires | Your request (art. 6(1)(b)) | Until it expires (7 days) or you clear the site's data in your browser |
| Organization data (local storage) | What you type into the document customizer (organization name, contacts, etc.), saved in your browser (key apg_org_v1). It is sent to our servers only when you generate the customized document, and it is not stored there | So you do not have to type it again | Your request (art. 6(1)(b)) | In the browser, until you clear the site's data |
| Partner license request | Full name, work email, firm, phone, country, type of firm, approximate number of clients, message and, if you completed "What applies to me," those answers | Answer your request and, where applicable, agree the license | Pre-contractual steps at your request (art. 6(1)(b)) | 24 months from the last contact, or for as long as the license lasts |
| Regulatory change alerts | Email, name (optional), chosen countries or states, language, subscription status (pending confirmation, confirmed or unsubscribed), dates of signup, changes and unsubscription, link requests and, if you completed "What applies to me," those answers | Send you, at most once a week, notices of changes in the registry for the countries you pick; manage your preferences with a signed, expiring link | Consent (art. 6(1)(a)), confirmed by email | Until you unsubscribe; proof of consent and of unsubscription for 24 more months |
| Emailing results or free resources | Email and what you ask us to send | Send you the result or the resource | Your request (art. 6(1)(b)) | Until you ask, or 12 months without use |
| Commercial communications (optional) | Email, preferences, proof of consent | Send news and offers, only if you accept them in the form; consent is recorded once your email is verified | Consent (art. 6(1)(a)) | Until you unsubscribe |
| Purchase | Email, country, items, amount and consents with date and IP, which we keep in a Cloudflare database; name, company, tax ID (if provided) and billing address, which Stripe collects; card data is handled by Stripe and we do not store it | Conclude and perform the contract, invoice, prevent fraud, apply sanctions | Contract (art. 6(1)(b)); legal obligation (art. 6(1)(c)); legitimate interest (art. 6(1)(f)) | Contract data: 12-month access + claims period; tax data: for the period required by applicable tax and accounting rules; started but unpaid orders (email, country, IP, items): up to 30 days, and removed in the next periodic cleanup |
| Purchase record in the CRM | Contact, product purchased, order number and amount (in a note), date and customer status | Customer support and, only if you accepted commercial communications, marketing | Legitimate interest (art. 6(1)(f)) for customer support; consent (art. 6(1)(a)) for marketing | Customer support: 24 months; marketing: until you unsubscribe |
| Access and downloads | Date, time and IP of each access and download and, if you lose the link, your message to support. The download link is a signed link that expires; if you lose it, email support@aipoliciesgenerator.com | Provide access, protect the link, apply the Refund Policy | Contract (art. 6(1)(b)); legitimate interest (art. 6(1)(f)) | Access period + 24 months |
| Mail limit | Per day, a code derived from your email (not the email) and the number of messages sent | Prevent abuse of email sending | Legitimate interest (art. 6(1)(f)) | A few days |
| Cancellations and refunds | Order and request data | Process the cancellation or refund | Contract and legal obligation (art. 6(1)(b) and (c)) | Claims period |
| Customer support | Email and message content | Answer questions about orders, downloads and invoices | Contract or legitimate interest | 24 months |
| Legal defense and payment disputes | Order data, consent and download records | Bring or defend claims | Legitimate interest (art. 6(1)(f)) | Until claims are time-barred |
5. Who we share data with
- Stripe (payments, invoices and fraud prevention; we do not store your card data). For some purposes, such as fraud prevention and regulatory compliance, Stripe acts as an independent controller; see its privacy notice.
- Providers acting on our behalf: hosting, order database and email delivery (Cloudflare, Inc., United States: it stores orders and free-download requests in its database and sends the confirmation, download-link and alert emails from hello@aipoliciesgenerator.com, and with Cloudflare Turnstile it processes technical browser data to tell people from automated programs on the forms) and CRM (HighLevel Inc., GoHighLevel: it only keeps the data from the download, alerts and partner-license forms, the email verification status, the products downloaded and, for each purchase, the contact, the product purchased, the order number, the amount, the date and the customer status; if you submit a form with an email that already exists in the CRM without having verified it, what you submitted is saved as a note on that contact without changing its data).
- Advisors (legal, tax, accounting) bound by confidentiality.
- Authorities where required by law.
We do not sell your personal data or share it for cross-context behavioral advertising. We do not use analytics tools or advertising cookies.
6. Where your data is processed
We are a US company and process your data in the United States and in our providers' countries. Where the law of your country requires it for data sent abroad, we use appropriate safeguards: adequacy decisions (including the EU-US Data Privacy Framework for certified entities), standard contractual clauses, or other available mechanisms. You can request information about these safeguards at privacy@aipoliciesgenerator.com.
7. Your rights
You may request access, correction, deletion, objection, restriction and portability, and withdraw consent at any time without affecting prior processing. Email privacy@aipoliciesgenerator.com stating the right you are exercising; we may ask you to confirm that you control the purchase email. We will respond within the legal deadline (in the EU, one month, extendable for complex requests).
Rights by country (summary):
- European Union and EEA: GDPR, arts. 15-22. You may complain to the data protection authority in your country.
- United Kingdom: UK GDPR; authority: ICO.
- Mexico: ARCO rights and withdrawal of consent (LFPDPPP 2025).
- Colombia: rights to know, update, correct, request proof of authorization, revoke it, and file complaints with the Superintendency of Industry and Commerce (Law 1581 of 2012, art. 8).
- Peru: ARCO rights (Law 29733) before the National Personal Data Protection Authority.
- Chile: access, correction, deletion, objection and, once Law 21,719 takes effect, portability and blocking.
- Argentina: the data subject may exercise the right of access free of charge at intervals of no less than six months, unless a legitimate interest is shown (Law 25,326, art. 14(3)). The Agency for Access to Public Information handles complaints about breaches of data-protection rules.
- Brazil: rights under LGPD art. 18, before the ANPD.
- United States: if you live in a state whose privacy law applies to us, you may exercise the rights it grants by emailing privacy@aipoliciesgenerator.com.
You can always complain to the data protection authority in your country.
8. Security
We apply appropriate technical and organizational measures: encryption in transit, signed, expiring download and alert-management links, issuing a new link on request, rate limits, access control and logging. No system is infallible: keep your access link safe.
9. Cookies
We do not use analytics tools or advertising cookies. We only use what is strictly necessary for the site to work and your browser's local storage to keep your download access identifier and the organization data you type into the customizer (section 4).
10. Children
The site and products are directed to organizations and adult professionals. We do not knowingly collect data from anyone under 18.
11. Changes
If we change this notice, we will publish the new version with its date and, if the change is material, notify you by email where we have your address.