Privacy Policy

Ironworks AI (“Ironworks,” “we,” “us”) builds and operates software for small and mid-sized businesses. We are based in Richmond, Virginia. This policy explains what we collect, why, who else sees it, how long we keep it, and how to make us delete it.

Two different kinds of data appear below and we treat them very differently: website visitor data, which is ordinary and minimal, and client business data, which is the operating and financial records a client connects to a system we run for them. Most of this policy is about the second kind.

01  Website visitors

If you only browse buildironworksai.com, we collect very little. Our web server records standard request logs, including IP address, browser type, referring page, and time of request. We use an analytics service to understand which pages are read. We do not sell this data, we do not use it for advertising, and we do not build profiles of individual visitors.

If you fill in a contact or discovery form, we collect what you type — typically your name, company, email address, phone number, and whatever you tell us about your business. We use it to reply to you and to prepare for a conversation. Nothing more.

02  Client business data

When a client engages us, they may connect systems they already run so that software we build can read them. Depending on the engagement, that can include work orders, job records, time entries, estimates, invoices, customer names, employee names, and hours worked.

The client owns that data. We do not. We read it to perform the work the client hired us for, and for nothing else.

Specifically, we do not:

• Sell it. Not to anyone, in any form, ever.
• Use it to train general-purpose AI models. Where we use a language model to process client data, we use providers under agreements that prohibit training on submitted content.
• Pool it across clients. One client's records are never combined with another's, and no client's data informs another client's system.
• Share it for advertising or marketing. By anyone, including us.

QuickBooks and accounting data

Where a client connects QuickBooks or QuickBooks Time, we request the narrowest access the work allows, which is normally read-only. We use that access solely to produce the reconciliation, reporting and analysis the client has contracted for. We do not initiate transactions, create invoices, move money, or alter accounting records. A client may revoke our access at any time from inside their own Intuit account, without notifying us first, and that revocation takes effect immediately.

03  Who else sees it

We run on infrastructure operated by other companies, and those companies necessarily process data on our behalf. We use as few as the work allows. As of the date above:

Provider	What it does
Amazon Web Services	Underlying compute and storage for the services below
Vercel	Application hosting
Supabase	Database and file storage
Anthropic	Language model processing, under terms prohibiting training on our submissions
Resend	Transactional and summary email delivery
Google	Website analytics and our own business email

We disclose client data to no one else, except where we are legally compelled to. If we ever receive a lawful demand for a client's data, we will tell that client unless we are prohibited from doing so.

04  Security

Credentials are stored encrypted and are never transmitted in email, chat, or documents. Access to production systems is limited to personnel who need it. Data moves over encrypted connections. We keep the access we request as narrow as the work allows, which is the most effective control available and the one most often skipped.

We are a small company and we will not claim certifications we do not hold. We hold no SOC 2 report and no ISO certification today. If a client's requirements demand one, we will say so plainly rather than imply otherwise.

05  How long we keep it

• Client business data is retained for the life of the engagement. On termination we remove the client's credentials immediately and delete or return their data within 30 days of a written request.
• Derived outputs — reports, analyses, dashboards built from client data — belong to the client, and we will provide a copy in a common format on request at any time.
• Contact and enquiry data is kept while a business relationship is live and for a reasonable period after, so that we can pick up a conversation where it left off.
• Website logs are kept for a short operational period and then discarded.

06  Your choices

You may ask us what we hold about you, ask us to correct it, or ask us to delete it. Clients may request export or deletion of their business data at any time under their agreement with us. Write to matt@buildironworksai.com and a person will read it.

We do not knowingly collect information from anyone under 18, and our services are sold to businesses rather than to consumers.

07  Changes

If we change this policy we will update the date at the top of this page. If a change materially affects how we handle client business data, we will tell affected clients directly rather than rely on them noticing.

08  Contact

Ironworks AI
Richmond, Virginia
matt@buildironworksai.com