Privacy

What this site collects

• Fit Check answers. The answers are fixed multiple-choice options, processed to route you and then not kept. The only thing stored is your email address, and only when it is needed for one of three jobs: holding a reserved seat, a paid-offer waitlist entry, or the larger-team list. Fail the Fit Check without joining a list and nothing about you is stored.
• Business contact and outreach records. I may keep a business email, role, company, the public source that made contact relevant, suppression status, and a compact record of outreach and responses. A verified email address by itself is not treated as permission to contact someone.
• Invite form fields. If you invite me to speak or collaborate, I store what you typed (name, email, and the invitation itself) so I can reply.
• Supabase: the access-controlled CRM and lifecycle-event store for contacts, suppressions, proof references, and engagement state. Agent roles receive only the minimum database functions needed for their job; they do not receive blanket table access.
• Clay: approved business-contact research, enrichment, email sequencing, delivery events, and unsubscribe handling. Clay controls the live sequence state; LennyClaw records the corresponding lifecycle event without putting credentials in prompts or repositories.
• AI service providers: bounded assistance with research, qualification, drafting, classification, and summaries. Only task-relevant data is supplied. Credentials, payment-card data, and unrestricted source stores are not sent in prompts.

What this site never collects

This website never collects workflow evidence, client files, credentials, or sensitive documents. There is no upload field for them anywhere, on purpose. Evidence exchange during a paid engagement happens off this website, sanitized only, under the engagement terms.

Processors, named

• Stripe: payments, receipts, and engagement records. Card details go to Stripe directly; I never see or store card numbers.
• PostHog (EU region): anonymized site analytics with no personally identifying information, served through this site’s own /ingest proxy rather than a third-party domain. No advertising cookies, no cross-site tracking.
• Google Calendar: booking your discovery and findings sessions, which only happens after payment.
• Vercel: website hosting, which includes standard server logs.

Retention

Full prospect messages are retained for no longer than 24 months after the last meaningful interaction, then deleted or de-identified. Minimal suppression evidence may be retained so a person who opted out is not contacted again. Active engagement, payment, legal, and accounting records may be kept for the period required to deliver the work or meet legal obligations. You can ask for access, correction, or deletion at any time.

Access and deletion

Email lennox@lennoxsaint.com to see, correct, or delete what is held about you. I acknowledge every request within 5 business days.

Contact basis, consent, and opting out

Forms state what they do at the point of collection. Business outreach is sent only where there is a documented lawful contact basis and a role-relevant reason; every sequence carries a clear sender identity and unsubscribe mechanism. An unsubscribe, complaint, wrong-recipient signal, or suppression match stops further outreach and blocks re-admission. A Fit Check or purchase is never silently converted into unrelated marketing consent.

No data sales

Your data is not sold, rented, or traded to anyone, for any reason.