Data Security

Last updated: 17 June 2026

We run a deliberately small, low-risk engagement. The less of your data we touch, the safer it is — so we built the Quote Recovery Sprint around least access. This page explains, in plain terms, how we protect your data.

Read-only by design

For a sprint we use read-only access to your HubSpot or Pipedrive — deals, contacts, quote dates, and notes. That is all we need to find stalled quotes worth reviving and draft follow-ups.

We cannot change anything in your CRM. We don't edit records, we don't alter your pricing, and we don't send messages — your rep approves and sends every one.

What we never access

• Your drawings, specifications, or files.
• Anything beyond the CRM data needed for the sprint.
• We do not export or keep a standing copy of your customer database.

Your data stays yours

• We use your data only to deliver the sprint you hired us for.
• We never use it for our own marketing.
• We never sell or share it.
• We do not use it to train any public AI model.

Minimal working notes, deleted fast

Any working notes we create during a sprint are kept to the minimum needed and deleted within 30 days of the sprint ending. Your access is revoked as soon as the sprint is complete.

Controller and processor roles

The personal data in your CRM is yours: you are the controller, and we act only as your processor (Art. 28 GDPR) — and, where U.S. state privacy laws apply, as your service provider. We process it only on your documented instructions. On request, we sign a Data Processing Agreement (DPA) and a mutual NDA before access begins.

Encryption and providers

Connections to this website and to the tools we use are protected by SSL/TLS encryption (HTTPS). We rely on established providers that maintain their own security programs, including HubSpot, Pipedrive, Vercel (hosting), Calendly (scheduling), and Stripe (payments). Where any of these process data outside the EU/EEA, appropriate safeguards apply, as described in our Privacy Policy.

If something goes wrong

If we become aware of a security incident affecting your data, we will notify you without undue delay and support you in meeting your own obligations as the controller (for example, any notification duties under Art. 33/34 GDPR or applicable U.S. state law).

Questions

Security questions — including a request to sign an NDA or DPA before we start — are welcome at ai.kharchuk@gmail.com.