Privacy policy

Last updated 15 October 2026. AI Panic Room is operated by Grant Robertson, an individual based in the Dominican Republic. Contact: Grant@aipanicroom.com.

Data controller. Grant Robertson, operating AI Panic Room as an individual in the Dominican Republic, is the data controller responsible for personal data processed to operate this service. Contact Grant@aipanicroom.com for privacy questions or requests. Paddle separately handles its payment and billing processing under its own privacy notice.

Accounts and service delivery. We process your email, name if provided, account identifier, authentication information and connected-account details to create and secure your account. We process the website addresses, website evidence, job/task answers, optional CV content, assessments, generated reports and saved preferences you submit to deliver the requested service. The legal basis is performance of our contract with you or taking steps at your request before a contract. Reports are private by default; sharing a summary or sharing with a team happens only when you choose to do so.

Support and orders. We process support messages and correspondence to answer enquiries and resolve issues, on the basis of contract performance or our legitimate interest in helping users. We keep order identifiers, purchased plans, payment/refund status and subscription records to provide access, handle cancellations and meet applicable accounting or legal obligations. Paddle collects card and billing information; we do not store your card details.

Security and usage. Technical records may include IP addresses, device/browser information, request and error logs, sign-in activity and usage/allowance records. We use these for security, fraud prevention, troubleshooting and reliable operation, on the basis of legitimate interests in protecting users and the service. Optional analytics or marketing storage, if introduced, requires consent where applicable. You can withdraw consent without affecting earlier lawful processing; we do not use report inputs for marketing without your permission.

Newsletter. If you sign up for the newsletter (from the box at the bottom of our pages or in your account settings), we keep your email address, when you agreed and whether you confirmed, on the basis of your consent. Signups from the website are only added after you click the confirmation link we email you. Newsletters are sent through Resend, our email provider. Every issue has a one-click unsubscribe link, and you can switch it off in your account settings at any time; after you unsubscribe we keep only a record that you opted out so we never email you again.

Sponsor banner and sponsor pages. When someone views the sponsor banner, clicks a sponsor, opens a sponsor page or follows a sponsor's link, we count the event against that sponsor without recording who you are, your IP address or any device identifier; sponsors see only totals. For businesses buying a sponsorship, we process the account email, the website address they give us and the page content they submit (company name, logo, tagline, text, pictures and links) to build, review and show their sponsor page, on the basis of contract performance. Their website's public pages are read through Firecrawl to draft the page. Sponsor content is kept while the sponsorship is active and for up to 12 months after it ends for records and disputes, then deleted.

Who receives data. We share only data needed for the relevant purpose with service providers such as our hosting and database provider for account and report storage; AI-processing providers for requested assessments; Firecrawl for website collection; Google for optional connected search data or website performance checks; and email/support delivery providers. Connected Google data is accessed only through the permissions you grant. Paddle is our Merchant of Record and receives data needed for product sales, subscription management, payments, tax compliance and invoicing. Professional advisers may receive relevant records for legal or accounting work, and authorities may receive data when the law requires it. A share link exposes only its published summary, not your private report inputs; links can be revoked.

Retention while using the service. Account details, saved reports and connected data are kept for the duration of your account so that you can use your history and purchased services. Support correspondence is kept while resolving your request and for as long as reasonably needed to address related complaints or disputes. Security and operational records are kept for as long as needed to investigate incidents, prevent misuse and operate the service. Order, refund and audit records are retained for the periods required by applicable accounting, tax or legal duties and, where necessary, until relevant disputes are resolved. These are purpose-based retention periods, not a promise of automatic deletion on a fixed date; data is deleted or anonymised when its purpose and any lawful retention requirement end.

Account deletion and kept results. Deleting your account removes your sign-in and cancels subscriptions immediately. Saved reports, results and related purchase records are retained under a one-way fingerprint of your email so they can be restored if you return and confirm the same email. This fingerprint is pseudonymous, not anonymous. There is currently no automatic expiry for these kept results: they remain until you request complete erasure or this recovery service ends, subject to records we must lawfully retain. We rely on our legitimate interest in preserving purchased results for returning users; you can object and request erasure at Grant@aipanicroom.com. Account deletion alone is not a complete-erasure request.

Security measures. We use appropriate technical and organisational safeguards, including encrypted HTTPS connections, authenticated access, access-control rules that restrict private reports to their owners, role-restricted administrative access and logs of owner-console actions. Stored Google connection credentials are encrypted and restricted to server-side access. We limit access to personal data to those who need it to operate the service. No online service can guarantee absolute security.

International processing. Our providers may process data outside your country, including outside the UK or EEA. Where applicable data-protection law requires safeguards for these transfers, we rely on appropriate provider contractual protections, including standard contractual clauses or adequacy decisions where applicable. Contact us for information about safeguards relevant to your data.

Your rights. Depending on applicable law, you may request access, correction, erasure, restriction, portability or object to processing based on legitimate interests. You may withdraw consent and complain to your local data-protection authority. Where GDPR applies, these include its access, rectification, erasure, restriction, portability, objection and consent-withdrawal rights, and we respond within one month, subject to lawful extensions. Contact Grant@aipanicroom.com; we may need to verify your identity. We explain any lawful reason for retaining particular records rather than erasing them.

Cookies and local storage. Essential cookies and browser storage maintain sign-in, security and requested service state. Non-essential analytics or marketing cookies are not set without consent. You can manage storage through browser settings; blocking essential storage may prevent sign-in or parts of the service from working. See the Cookie policy linked in the Policies menu.