Current public policy
Privacy policy
This page explains, in plain English, what data Gentoo Logic collects when you use Penn, Conny, and the custom AI services we configure for customers, how we use it, who we share it with, and what choices you have. If anything below is unclear, email pdauderis@rookeryventuresllc.com and we will walk you through it.
1. What we collect
Account information
When you sign up, we collect your name, email address, and the venture or organization you represent. If you pay us, our payment processor handles your card details — we never see the full card number.
Email content (when you connect Gmail)
A custom Penn agent may read email to triage it, draft replies, or complete another workflow you approve. When you connect a Google account, we may read message contents, subject lines, sender and recipient addresses, attachments, and labels. We only use the connected account and the permissions you authorize. The exact access is shown before you connect it.
Calendar events (when you connect Google Calendar)
A custom Penn agent may read your calendar to schedule meetings, prepare for them, or surface conflicts when you authorize that module. This can include event titles, times, attendees, and locations for the connected account.
Contacts (when you connect Google Contacts)
With your permission, a custom agent may read your contacts to complete the workflow you approved. This can include names, email addresses, phone numbers, and any notes you have written into the contact record.
Files (when you connect Google Drive)
A custom Penn agent may organize files it creates on your behalf — proposals, briefs, or meeting notes. We do not scan your full Drive unless you have explicitly enabled a Drive-scan feature; if you have, that scan is read-only and is described in the feature's consent screen.
OAuth tokens
When you connect a Google account we receive an access token and a refresh token. We store these encrypted at rest and use them only to perform the actions you have authorized. You can revoke them at any time at myaccount.google.com/permissions or by clicking Disconnect in the app.
Usage data
We collect basic logs about how the product is used — pages visited, features clicked, errors hit. These logs help us fix bugs and improve the product. They contain device and browser information but not the contents of your messages or files.
Penn business interviews and project requests
You can complete Penn's interview and generate a starter plan without giving us contact details. If you ask for a review, we collect the pain point and choices you submitted, your generated starter plan, your name, email address, company if supplied, and your permission for Gentoo Logic to contact you about that request. We use this information only to evaluate and follow up on the project you asked us to review.
When Penn's AI-guided interview is enabled, the business problem and conversation text are sent to Anthropic so Penn can choose the next useful question and draft the first-lift recommendation. We do not send the contact details from the follow-up form as part of that AI prompt. Do not include passwords, credentials, regulated data, or sensitive personal information in the interview.
Prompts and research questions (Conny)
When you use Conny, we collect the email address you verify, the prompts and research questions you submit, the enhanced prompts and briefs we produce for you, and — for paid briefs — the delivery record. With the consent you give on the form, we keep these prompt-and-result records and analyze them in aggregate, anonymized form to improve Conny's prompt templates and model picks. We do not use them to train AI models, we never sell them, and we never mix them with any other customer's data.
2. How we use it
We use the data above to run the product you signed up for — nothing more. Specifically:
- Running only the connected email, calendar, contact, and file workflows you approve for your custom Penn agents.
- Showing you relevant activity, decisions, and operational information inside a private customer workspace when one is included.
- Sending you product emails (onboarding, feature changes, billing receipts).
- Running your Conny prompts through the AI models that produce your answer, and delivering the result to your email.
- Using the Penn interview text to choose useful follow-up questions and draft a narrow first-lift recommendation.
- Reviewing and responding to Penn project-plan requests you explicitly submit.
Marketing email and the Gentoo Logic list
Some actions — like requesting a Conny access code — add you to the Gentoo Logic email list, and say so right next to the button before you click. We send occasional product news, never more than a few emails a month. Every marketing email includes a one-click unsubscribe link, and unsubscribing never affects the transactional email you asked for (access codes, receipts, paid briefs). We never sell or share the list.
We do not sell your data. We do not use the contents of your messages, calendar, contacts, or files to train AI models — neither our own models nor third-party models. We may use de-identified operational metrics to improve reliability and product decisions, but we do not use those metrics to reconstruct customer content or sell profiles.
3. Who we share it with
We share data only with the service providers we need to run the product:
- Google — when an approved Penn module reads your inbox, creates a draft, or lists a calendar, those API calls go to Google. Google's privacy policy governs the data once it is in their hands.
- Anthropic — Penn and some custom agents use Anthropic's Claude models to draft text and reason over decisions, including reasoning through an interview and drafting a first-lift recommendation. We send Anthropic only the content needed for the immediate task—not Penn's contact form—with prompts configured so that Anthropic does not retain the data for training.
- Multi-model AI providers (Conny) — Conny's whole point is running your question through several independent models. Depending on the product you buy, your prompt goes to Anthropic, OpenAI, Google, and Perplexity (which also hosts the NVIDIA model we use). Each receives only your prompt for the immediate task — never your account details.
- Resend — our transactional email provider. Resend sees the recipient address and the content of the emails we send you (access codes, receipts, briefs) in order to deliver them.
- Google Cloud / Firebase — our database and runtime live on Google Cloud. Your data is encrypted at rest in Firestore.
- Stripe (if you pay us) — billing only. Stripe sees your card details; we see a receipt.
We do not share your data with advertisers, data brokers, or third-party analytics platforms. If we are ever required by law to disclose data (court order, subpoena), we will notify you unless the legal order prohibits notice.
4. How long we keep it
- Email, calendar, contact, and file data: kept as long as your account is connected. If you disconnect a Google account, we delete the cached copies within 90 days.
- OAuth tokens: deleted immediately when you disconnect or revoke access at myaccount.google.com/permissions.
- Account information: kept until you close your account. When you close, we delete personal data within 30 days and keep only the minimum records we are required to keep by law (invoices, tax records).
- Anonymized telemetry: kept indefinitely. Because it contains no tenant identifier, name, or content, we cannot link it back to you to delete it — but it cannot identify you either.
- Logs: 30 days for application logs, 90 days for security logs.
- Conny prompts and briefs: kept while you have an account so your history keeps working. Email pdauderis@rookeryventuresllc.com to have your prompt history deleted; we delete it within 30 days.
- Email list membership: kept until you unsubscribe. Unsubscribes take effect immediately.
5. Your rights and choices
You have rights over your data. We honor these rights for everyone — not only people in jurisdictions where the law requires it.
- Access — download a copy of your tenant data from Settings → Privacy → Download my data.
- Correction — edit your account profile from Settings → Account.
- Deletion — close your account from Settings → Account → Close, or email us at pdauderis@rookeryventuresllc.com.
- Portability — the Download my data export is a JSON bundle you can take elsewhere.
- Disconnect Google — use the disconnect control provided with your service, or revoke access at myaccount.google.com/permissions. Either path stops the connected Gentoo agent from accessing your account.
- Ask about operational metrics — email us to ask what is collected for your configuration or to request an available opt-out.
- Object / restrict processing (GDPR) — email us and we will pause processing of your data while we work it out.
- Do-not-sell / share (CCPA) — we do not sell or share your personal information, so this is always on by default.
- Complain to a regulator — if we have not handled your request well, you can complain to your local data protection authority. In the EU, that is your national DPA; in California, that is the CPPA.
To exercise any of these, email pdauderis@rookeryventuresllc.com. We will respond within 30 days.
6. Security
We do the basics carefully. OAuth tokens are encrypted at rest. Data in transit is encrypted with TLS. Database access is limited to the service accounts that need it, and every access is logged. Tenant data lives in tenant-scoped collections that the database rules prevent from being read across tenants — the isolation is enforced in code, not just policy.
We are a small team and we do not pretend to be SOC 2 certified — we are not. We will tell you what we are and are not. If a breach happens that affects your data, we will notify you within 72 hours of discovering it, with what happened, what data was involved, and what we are doing about it.
7. Children
Gentoo Logic is a B2B product. It is not designed for, marketed to, or intended for use by anyone under 16. We do not knowingly collect personal information from anyone under 16. If you believe we have, email us and we will delete it.
8. Changes to this policy
We update this policy as the product changes. When we make a material change — anything that affects what we collect, how we use it, or who we share it with — we will email everyone with an active account and update the "last updated" date at the top of this page. You will see the change in your account or service communication before it takes effect.
9. Contact
Gentoo Logic is operated by Rookery Ventures LLC. For any privacy question, data request, or complaint, email pdauderis@rookeryventuresllc.com. For everything else, see gentoologic.com.