Privacy Policy

1. Scope

This Privacy Policy explains how GraniteAI, LLC (“GraniteAI,” “we,” “our,” or “us”) handles personal information on graniteai.co.

It covers:

• Marketing pages and informational content, including our Ideas articles
• Lead capture forms, contact forms, demo requests, and booking requests
• The AI assistant chat and the free tools in the Enterprise AI Playground
• The Mica marketing and landing pages hosted on graniteai.co, including /mica and its subpages, our trade and location pages, and named-business pitch pages

It does not govern the Mica application at social.graniteai.co. Once you create an account or start a trial there, that product handles your information under its own policy. See the dedicated Mica legal pages: Privacy Policy, Terms, and Subprocessors.

There are no user accounts on graniteai.co, and we do not process payments on this site.

2. Information We Collect

• Contact details such as name, email, phone number, business name, and trade or industry that you submit in a form.
• Inquiry details such as project goals, service interests, how you heard about us, your preferred contact method, and any message you send us.
• Tool and chat content that you type into the AI assistant or the free tools on this site, including the prompts you submit to the prompt enhancer.
• Usage analytics such as page views, clicks, scroll depth, referral URLs, campaign parameters (UTM tags), and interaction events.
• Session recordings of your interactions with pages on this site. See Section 5.
• Technical data such as IP address, approximate location derived from your IP address (city, region, country), browser type, device type, screen size, time zone, and log data.

We do not collect government identifiers, financial account numbers, health information, or biometric information on this site, and we ask that you not submit them. See Section 8.

3. How We Use Your Information

• Respond to inquiries, consultations, demo requests, and service requests.
• Follow up with you about our services, including Mica, by email, phone, or text where you have given us that contact method and asked to be reached.
• Deliver requested information about our offerings.
• Operate and improve the AI assistant and the free tools.
• Measure which pages, campaigns, and referral sources bring people to us, and improve the performance and usability of graniteai.co.
• Protect against abuse, fraud, spam, and security incidents, including enforcing the rate limits described in our Terms.
• Comply with legal obligations and enforce our terms.

We do not sell personal information for money, and we do not share it for cross-context behavioral advertising. We do not run third-party advertising or ad-retargeting trackers on this site, and we do not buy personal information from data brokers.

4. Third-Party Services

We use service providers to run graniteai.co and to process the inquiries you send us. Each receives only what it needs for its role.

• Vercel for hosting and edge delivery. Vercel handles all traffic to this site and provides the approximate IP-based location data described in Section 6.
• PostHog for product and marketing analytics and session replay. See Section 5.
• GPTrends for server-side traffic measurement. It runs on our page and API requests, though not on requests for static files such as images, fonts, and stylesheets, and it receives the requested URL, the referring URL, your IP address, and your browser user agent.
• OpenAI for the AI assistant chat and the prompt enhancer. What you type into those features is sent to OpenAI to generate a response.
• Resend for delivering lead, contact, and notification email to us, and for outbound email we send you.
• HubSpot as our customer relationship manager. When you submit a demo request, we create or update a contact record for you in HubSpot so we can follow up.
• Salesforce for the form on our Contact page, which submits directly to Salesforce Web-to-Lead. The name, email, and other details you enter on that form are transmitted from your browser to Salesforce and stored there as a lead record.
• Slack for internal notification. Submissions from our referral page and our talent signal intake form are posted to a private internal Slack channel so we see them promptly.
• Google for two things. Our chat panel loads a Google Calendar scheduling script, and booking a call with us goes through Google Calendar, which receives whatever you enter when booking. Separately, most of our Mica landing pages load fonts directly from Google Fonts, which means Google receives your IP address when one of those pages loads.
• Clutch for the reviews widget in the footer of our main site. The widget loads a script and an embedded frame from Clutch, which lets Clutch see that your browser loaded it. It does not run on the Mica landing pages.

These providers process data under their own privacy terms and their contractual obligations to GraniteAI. We may also disclose information to professional advisers, to authorities where required by law, and to an acquirer in connection with a merger, acquisition, or sale of assets.

5. Analytics, Session Replay, and Cookies

We use PostHog for first-party product analytics. It records page views, clicks, scroll depth, and other interaction events, and it creates a persistent profile for each visitor so we can understand how people move through the site across visits. Analytics requests are routed through the /ingest path on our own domain before reaching PostHog.

Session replay. PostHog also records replays of browsing sessions on this site, so we can watch how a page was actually used and fix what confuses people. A replay captures your mouse movement, clicks, scrolling, and the pages you view.

Form input in replays. On our main site, text you type into form fields is masked in the recording. On most of the Mica landing pages, including our trade pages, our New Hampshire location page, our dealership pages, and our named-business pitch pages, that masking is turned off. On those pages the text you type into the lead form, including your name, email, and phone number, can appear in the session replay. This setting varies from page to page, so treat anything you type into a form on this site as something we can read, and do not enter anything you would not want us to see.

Cookies and local storage. We use first-party cookies and browser local storage to hold a PostHog visitor identifier and session state. We do not use third-party advertising or behavioral-advertising cookies. You can block or clear cookies through your browser.

AI chat analytics. Conversations with the AI assistant are logged to PostHog, including the messages exchanged and model performance data such as token counts and response times.

6. Visit Alerts on Certain Mica Pages

On some Mica pages, an arriving visitor triggers an internal email alert to us. That alert contains the page visited, the approximate location derived from your IP address (city, region, country), your IP address, the referring URL, any campaign parameters in the link, your device type, screen size, and time zone, and a link to the PostHog session replay for that visit.

These alerts run on:

• Our named-business pitch pages, each prepared for a specific business we are approaching
• Our dealership landing page
• The main /mica page, but only when you arrive through the QR code on our digital business card

We use this to know when someone we have pitched is looking at the proposal, so we can follow up. Requests we identify as bots or link-preview crawlers are filtered out and do not generate an alert. The alert fires once per browsing session. It does not run on the rest of graniteai.co.

7. AI Features

The AI assistant chat and the prompt enhancer send what you type to OpenAI’s API to generate a response. We use the standard API configuration, under which OpenAI does not use the data to train its models.

These features have no account and no access controls. Treat anything you type into them as information you are sharing with us and with OpenAI. Output is generated by an AI model and can be inaccurate. See our Terms of Service for the limits on relying on it.

8. What Not to Send Us

Forms and tools on this site are for business inquiries. Do not submit government identifiers, financial account numbers, health information, credentials, trade secrets, or personal information about other people. If you send us information we did not ask for and do not need, we will delete it.

9. Data Retention

We retain inquiry and contact records for as long as needed to respond to you, manage the relationship, and satisfy legal or operational requirements, and we delete them when you ask. Analytics events and session recordings are retained according to our PostHog plan’s retention schedule and are then aggregated or removed. Server logs are retained for a short operational period.

10. Your Rights and Choices

You may request access to, correction of, or deletion of personal information we hold about you, and you may ask us to stop contacting you. Depending on where you live, you may have these rights by law, including under the California Consumer Privacy Act as amended. We extend them to everyone who asks.

To make a request, email jason@graniteai.co. We will respond within 45 days.

Email. Every marketing email we send includes an unsubscribe link. You can also reply to any email from us and ask to be removed.

Analytics and replay. You can opt out by blocking cookies in your browser or by using a content blocker. We honor the Global Privacy Control signal as an opt-out of sale and sharing, and we do not sell or share personal information for advertising in the first place. We do not respond to browser Do Not Track signals, which have no agreed standard.

If you use Mica at social.graniteai.co, rights and choices for that product are described in the Mica Privacy Policy.

11. Data Security

We use reasonable administrative, technical, and organizational safeguards to protect personal information handled through graniteai.co, including encryption in transit, origin and rate-limit controls on our AI chat and prompt tool endpoints, and secrets held in environment configuration rather than in code. No system is perfectly secure.

12. Where Your Information Is Processed

Our infrastructure is hosted in the United States, and our service providers process information there and in other countries where they operate. If you access this site from outside the United States, your information will be processed in the United States, where data protection laws may differ from those where you live.

13. Children

This site is for businesses and is not directed to children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us personal information, email jason@graniteai.co and we will delete it.

14. Changes to This Policy

We may update this Privacy Policy periodically. Material updates will be posted on this page with a revised date.

15. Contact Us

If you have questions about this Privacy Policy or our data practices, email jason@graniteai.co or write to GraniteAI, LLC, 145 Lakeside Dr, Manchester, NH 03104.