Privacy notice

What we collect, why, where it lives, and how to get it back.

This notice covers the DiscoverPro website, the discovery portal and the outreach we send, all run by Iron Rod Systems LLC, a Utah limited liability company ("Iron Rod Systems", "we", "us"). It is written to be read. Where a section matters to one kind of reader more than another, it says so.

1. Who this is for, and our role

• People taking part in a discovery. You are a sponsor, a colleague a sponsor asked to help, or someone outside the company who was asked to answer questions. Your company decided to do the discovery and decides what happens to what you tell us. We handle it on your company's behalf, under the confidentiality agreement it signed and our data processing terms.
• People we contact about our services. You received an email from us because your company looked like one we could help. For this we decide what is collected and why, and this notice governs.
• Visitors to this website. We collect almost nothing. Section 2 says what.

2. What we collect and why

From visitors to this website

• Server logs. The site runs on Cloudflare, which records IP address, browser type, the page requested and the time, for security and capacity. We do not keep our own copy.
• The customer sign-in page. If you enter your email address to have your link sent again, we use it to look up your invitation and send the link. If there is no invitation for that address, nothing is stored.
• The public pages of this site use Plausible Analytics to count visits. Plausible sets no cookies, collects no personal information and does not follow anyone across other sites. The pages you sign in to, the console and the client portal, load no analytics at all.
• We run no advertising pixels and no cross-site trackers, and load no fonts from anyone else.

From people taking part in a discovery

• Who you are. Your name, work email, job title and company, given to us by you or by the colleague who invited you.
• What you tell us. Typed answers, and voice interviews with our AI interviewer: the recording, its transcript, and the written summary made from it.
• What you share. Documents you upload and screen recordings you make to show how something is done.
• What you sign. The confidentiality agreement, your consent to recording and AI processing, and any proposal, each with the name you typed, the date and time, your internet address and browser, and a fingerprint of the exact text.
• Activity. When you opened your link, started or stopped an interview, or picked a time to come back, so that we and your company's sponsor know where the discovery stands.
• Questions you ask. Messages to the assistant in the portal and requests to talk to a person.

We use all of this for one purpose: to understand how the work gets done at your company, assess where it could be improved, and prepare findings and a proposal for your company.

From people we contact about our services

• Business contact details. Your name, job title, company, and work email address, and sometimes a work phone number or professional profile link. We get these from your company's website, public professional profiles, and commercial business-contact providers.
• Public information about your company. What it does, its size and location, and public signs that it might benefit from our work, such as job postings or news.
• Our correspondence. The emails we sent you, whether you replied, and what you said.

We use this to decide whether to write to you, to write something relevant, and to follow up a small number of times. Every email we send says who we are and carries a link to stop further emails. If you use it, or reply asking us to stop, we stop and keep only your address on a do-not-contact list so that we do not write again.

From our own team

Name, email, role, sign-in records, and a log of administrative actions, to control access and keep an audit trail.

3. What we ask you not to share

Patient health records, payment card numbers, government identification numbers, or other records whose handling is regulated by law. Personal details of your company's customers or employees beyond what is needed to describe the work. The interviewer is instructed not to ask for these and not to repeat them, and the written summary of an interview leaves them out. If something like this reaches us anyway, we delete it when we find it.

4. Recording and AI

Interviews are recorded and transcribed. You are told so, and asked to consent, before your first interview, and you can type your answers instead. The interviewer is an artificial intelligence and says so at the start of every session. A person at Iron Rod Systems reviews what comes out of an interview before any finding reaches your company. Our AI page describes what AI does and does not do in a discovery.

We do not use what you tell us to train AI models, and the providers that process it for us are not allowed to either.

5. Cookies and browser storage

The public pages of this site set no cookies. Signing in sets exactly one, depending on who you are: a session cookie for a person taking part in a discovery, or one for a member of our team. Each holds an opaque reference to a session stored on our server, not your identity. Each is marked so that scripts cannot read it, so that it is not sent from other sites, and so that it travels only over an encrypted connection. Clearing it signs you out.

Signed-in pages also keep small conveniences in your browser, such as which tab you had open and your light or dark preference. These never leave your device. We use no tracking, advertising or analytics cookies anywhere, and we do not track anyone across other sites.

6. Legal basis, for people in the EEA and UK

• Contract. Processing a discovery your company asked for, and its signatures.
• Consent. Recording your voice, which you can decline by typing instead, and withdraw by asking us to delete a recording.
• Legitimate interests. Contacting businesses about services relevant to them, keeping a do-not-contact list, security monitoring, rate limiting and the audit trail. We use the least information that works, and you can object at any time.
• Legal obligation. Records we are required to keep, such as signed agreements and invoices.

7. Who else processes it

We use these providers. Each is bound by a contract that limits it to providing its service to us.

• Cloudflare, for hosting, the database, file storage, and sending email from the portal.
• ElevenLabs, for the voice interviewer: speech to text, the interviewer's voice, and the conversation itself. It holds the audio of an interview until we delete it.
• Anthropic, whose Claude models write up interviews, read shared documents, and draft assessments and proposals. The voice interviewer also runs on a Claude model through ElevenLabs.
• Google, where our team's mailbox is hosted, for outreach emails and replies to them.
• Business-contact providers, which supply the work contact details described in section 2. We send them a company or a name to look up; we do not send them anything from a discovery.

We do not sell personal information, we do not share it for advertising, and we do not train models on it. The full list with what each provider handles is in our data processing terms.

8. Where it lives

Our systems and our providers are in the United States, so taking part means your information is processed there. For transfers from the EEA, the UK or Switzerland we rely on the standard contractual clauses in our providers' terms and in our data processing terms.

9. How long we keep it

• Voice and screen recordings: deleted 30 days after the work ends: when the project concludes, when a managed services agreement ends, or when a proposal is not accepted, from our storage and from the voice provider.
• Answers, transcripts, summaries and documents: kept while we are working with your company and afterwards until you ask us to delete them. On a written request we delete them within 30 days. They are not deleted on a timer.
• Signed agreements and their signature records: kept for as long as the agreement is in force and for seven years after, because they are the record of what was agreed.
• Outreach contact details and correspondence: kept while there is a live conversation, and removed within twelve months of the last contact. A do-not-contact entry is kept so that we do not write again.
• The audit trail of our team's actions: kept for the life of the system.
• Backups: roll off within 35 days of deletion.

10. Security

Encryption in transit and at rest, personal links that only work with a code sent to your own email on a new device, two-step sign-in for our team, access limited by role and by client, rate limiting, and a tamper-evident audit trail. Our security page has the detail.

11. If there is a breach

If a security incident compromises personal information, we assess it promptly and notify the companies and people affected and, where the law requires, the relevant regulators, without undue delay. We aim to tell an affected client within 72 hours of becoming aware.

12. Your rights

Depending on where you live, you may have the right to see what we hold about you, to have it corrected or deleted, to receive a copy, to restrict or object to how it is used, and to complain to a regulator. Write to legal@discoverpro.ai. We confirm who is asking and respond within 30 days, free of charge.

If you took part in a discovery, your company controls what you told us, so we may need to involve it in answering you. You can always stop taking part, ask us to delete a recording, or ask that something you said be left out of your company's report.

If we contacted you about our services, you can ask us to stop at any time by using the link in any email or by replying. California residents have the right to know what we collect and to have it deleted; we do not sell or share personal information as California law defines those terms.

13. Children

Our services are for businesses and are not directed to anyone under 16. We do not knowingly collect their information.

14. Changes

When this notice changes, the date at the top changes. For a change that matters to people in a discovery, we tell the sponsor of each open discovery by email first.

15. Contact

Iron Rod Systems LLC
legal@discoverpro.ai

This notice is governed by the laws of the State of Utah, United States.

Terms of use

The terms for using this site and the discovery portal.

These terms cover the DiscoverPro website and the discovery portal, run by Iron Rod Systems LLC, a Utah limited liability company ("Iron Rod Systems", "we", "us"). By using either you agree to them. They are the house rules for the site and portal. The work we do for a client is governed by the agreements that client signs with us: a mutual non-disclosure agreement, a master services agreement and a statement of work. Where one of those says something different from these terms, the signed agreement applies.

1. What the portal is

The portal is where a company that has agreed to a discovery tells us how its work gets done: through interviews with an AI interviewer, typed answers, documents and screen recordings. It is also where that company reads our findings and proposal and signs if it wants to go ahead.

2. What it is not

Our assessments, estimates and proposals are recommendations based on what we were told. They are not legal, tax, accounting or employment advice. Estimated savings are estimates, not guarantees. Your company makes its own business decisions.

3. Your personal link

You reach the portal through a link that is yours alone. Do not forward it. If a colleague should take part, hand questions to them from inside the portal so they get their own link. The first time you open your link on a new device we email you a code to confirm it is you. Tell us straight away if you think someone else has used your link, and we will replace it.

4. The AI interviewer and recording

The interviewer is an artificial intelligence and says so. It asks questions and follows up on your answers; it does not give advice. Sessions are recorded and transcribed, with your consent, so that we work from what you actually said. You can type your answers instead, stop at any time, and pick up later from where you left off. Our AI page says more.

5. What you share

You keep all rights in what you share. You give us permission to use it to carry out your company's discovery and the work that follows. Share only what you are allowed to share. Please do not share:

• patient health records, payment card numbers, government identification numbers, or other records whose handling is regulated by law;
• personal details of your company's customers or employees beyond what is needed to describe the work;
• anything you have no right to disclose, or that belongs to someone who has not agreed.

6. Confidentiality

What you share through the portal is covered by the mutual non-disclosure agreement your company signs before the first question. If you are outside that company and were asked to help, you are shown a confidentiality notice and agree to it before you see anything.

7. Signing electronically

Agreements in the portal are signed by typing your name and confirming. We record the date and time, your internet address and browser, and a fingerprint of the exact text you signed, and email a signed copy to both sides. By signing in the portal you agree that this has the same effect as signing on paper, and you confirm you have authority to sign for your company. You can ask for a paper copy.

8. Acceptable use

Do not use the site or portal to break the law, to upload malicious code, to try to reach another company's information, to probe or disrupt the service, to copy our question sets, methods or software, or to use automated tools against it. We may suspend a link that is being misused.

9. Our intellectual property

The site, the portal, and our methods, question sets, templates and software are ours. What we deliver to your company about its business is your company's to keep and use, as the signed agreements say.

10. Third-party services

The portal relies on other providers, named in our privacy notice, for hosting, voice and AI. We choose them with care but do not control them, and an outage of theirs can make the portal unavailable.

11. Availability

We work to keep the portal available and your place in it saved, but we do not promise it will always be so. If something is not working, the email that brought you here reaches a person.

12. Emails from us

If we wrote to you about our services and you would rather we did not, use the link in any email or reply and say so. We will stop.

13. Disclaimers

The site and portal are provided as they are. To the extent the law allows, we make no warranties about them beyond what a signed agreement with your company says, including any implied warranty of merchantability or fitness for a particular purpose.

14. Limitation of liability

To the extent the law allows, we are not liable for indirect or consequential losses arising from use of the site or portal, and our total liability for such use is limited to one hundred US dollars. This section does not limit what a signed agreement between your company and us provides, which has its own terms, or any liability the law does not allow to be limited.

15. Ending

You can stop using the portal at any time. Your company's sponsor can ask us to close a discovery and delete what was shared. We may close a discovery that has been inactive for a long time, after telling the sponsor.

16. Changes

We may update these terms and will show the date when we do. If a change matters to people in an open discovery, we tell the sponsor by email first.

17. Law and disputes

These terms are governed by the laws of the State of Utah, United States, without regard to its conflict-of-laws rules. The state and federal courts located in Utah have exclusive jurisdiction over any dispute about them. If you have a concern, write to us first and we will try to resolve it.

18. Contact

Iron Rod Systems LLC
legal@discoverpro.ai

Security

You are telling us how your business runs. Here is how we look after that.

This page describes the safeguards in the discovery portal as it is built today, in plain terms, and what we do not do. We are a small firm and have not yet had an independent security audit; we would rather say so than imply otherwise.

Getting in

Clients

• A personal link, one per person. Only a fingerprint of it is stored, so a copy of our database would not reveal a working link. A link can be revoked or replaced at any time.
• A code on every new device. The first device to open a link is trusted. Any other device must enter a six-digit code sent to that person's own email, which expires in ten minutes.
• Separate sessions. Each person sees only their own questions and answers. A sponsor sees progress for colleagues they invited, not their answers word for word.

Our team

• No passwords. Sign-in is by a one-time link or code sent to a work email address on an approved list.
• A required second step. A passkey or an authenticator app, with recovery codes. A passkey is bound to this site's address and cannot be used on a look-alike.
• Roles and client-by-client access. Admin, editor and read-only roles. A team member can be limited to named clients, and to the delivery side of a client without its discovery material.
• An audit trail. Sign-ins, failures, role changes, links issued and revoked, documents opened, and settings changed are recorded with who and when. Each entry carries a fingerprint that includes the one before it, so an entry cannot be altered or removed without the chain showing it.

In transit and at rest

• Encrypted connections only. Every request is forced to HTTPS, older TLS versions are refused, and browsers are told to use HTTPS only.
• Encrypted storage. The database and file storage are encrypted at rest by our hosting provider. Secrets our own software holds, such as authenticator secrets, are encrypted again with a key kept outside the database.
• Session cookies scripts cannot read, that are not sent from other sites, and that only travel over HTTPS.

In the browser

• A strict content policy. Pages load scripts only from this site. The interview page may connect to the voice service and nowhere else. Nothing can be framed by another site.
• No third-party scripts on any signed-in page. The console and the client portal load nothing from anyone else. The public marketing pages load one script, Plausible Analytics, which uses no cookies and collects no personal information.
• Client pages are marked not to be indexed by search engines and send no referrer when you follow a link out.

Against abuse

• Rate limits on sign-in, on codes, on client requests and on the page that sends a link again.
• Requests from other sites are refused for anything that changes data.
• The page that sends a link again answers the same way whether or not an address is known, so it cannot be used to find out who our clients are.

What we keep, and for how long

• Recordings of voice and screen are deleted 30 days after the work ends: when the project concludes, when a managed services agreement ends, or when a proposal is not accepted, from our storage and from the voice provider.
• Everything else from a discovery is kept until you ask us to delete it, and is then deleted within 30 days of your written request.
• Signed agreements are kept with the exact text signed and its fingerprint.

Our privacy notice has the full schedule.

AI providers

• No training on your information. We use providers whose terms prohibit using what we send them to train their models.
• Research never carries your details. When the portal looks up a tool your company uses, it searches by the tool's name and a few general words on what it is used for, such as "accounting and invoicing". Nothing that identifies your company goes into the search.
• A person reviews AI output before it reaches you. Figures in an assessment are calculated by ordinary arithmetic from the inputs shown, not produced by a model.
• The interviewer is told not to ask for, and not to repeat, personal details of your customers or employees, or card and account numbers, and the written summary leaves them out.

Our AI page covers this in more depth.

What we do not do

• We do not sell information or share it for advertising.
• We do not handle patient health records, payment card data or other regulated records unless a signed statement of work covers them and says how.
• We do not claim certifications we do not hold. We have no SOC 2 or ISO 27001 report today.

If something goes wrong

If we learn of unauthorized access to a client's information, we tell that client without undue delay, and aim to within 72 hours, with what we know and what we are doing about it.

Reporting a problem

If you believe you have found a security problem, write to security@discoverpro.ai with "Security" in the subject line. Please give us a reasonable time to fix it before telling anyone else, and do not access information that is not yours. We will acknowledge your report and tell you what we find.

How we use AI

What the AI does in a discovery, what a person does, and where the line is.

We build AI for businesses, and we use it in our own work. This page says exactly where, so that you know what you are talking to and who stands behind what you read.

Where AI is used

• The interviewer. An AI you can talk to or type with. It asks how the work gets done and follows up on your answers. It says it is an AI at the start of every session and whenever you ask.
• Writing up. After a session, AI turns the transcript into written answers, each with the words of yours that support it.
• Reading what you share. AI reads documents and narration from screen recordings and notes what they show.
• Drafting. AI drafts the summary of what we heard, the assessment, the scope of a proposal and its statement of work.
• The assistant. A helper in the portal that answers questions about the process.

Where a person is in charge

• Every finding is reviewed by a consultant at Iron Rod Systems before it reaches you. Nothing goes from the AI straight to your company.
• You check what we heard before we build on it. If we got something wrong, you correct it, and the correction replaces what the AI wrote.
• A person sets every price. AI never writes a fee.
• A person holds the calls where findings and proposals are discussed, and a person is who you reach if you ask to talk to one.

What the AI is not allowed to do

• Give advice, name a product, quote a price or promise a result during an interview. It gathers facts; recommendations come later, from people.
• Invent. Written answers record only what you said. Every finding in an assessment links back to the answer, document or session it came from, and a finding with nothing behind it is flagged for the consultant.
• Do the arithmetic by feel. What a problem costs and what fixing it would save are calculated by ordinary arithmetic from the inputs shown: how often, how long, at what rate. You can check them.
• Ask for or repeat personal details of your customers or employees, or card and account numbers.

Your information and AI providers

The interviewer's voice and speech recognition come from ElevenLabs, and the models that do the thinking and writing are Anthropic's Claude. Neither is allowed to use what we send to train its models. When the portal researches a tool your company uses, it searches by the tool's name and a few general words on what it is used for, and nothing that identifies your company goes into a search.

What we recommend to you

We lead with AI because it is what we do best. If a simpler fix would serve your business better, that is what we recommend, and we say so. Nothing gets dressed up as AI.

When we build something for you that uses AI, the statement of work says where it is used, that its output can be wrong, and which review step stays with your people.

AI can be wrong

It can mishear, misread and misjudge. That is why the steps above exist: your own words kept beside every answer, your check of what we heard, a consultant's review, and arithmetic you can verify. If something in what we send you does not match what you told us, tell us and we will fix it.

Your choices

You can type instead of talking. You can stop at any time. You can ask to talk to a person. You can ask us to delete a recording, or to leave something you said out of your company's report.

Data processing terms

How we handle personal information on a client's behalf.

These terms are part of the master services agreement between a client and Iron Rod Systems LLC, a Utah limited liability company ("we", "us"). They apply wherever a client gives us personal information and data protection law makes the client its controller and us its processor. They take effect when the client signs the mutual non-disclosure agreement or the master services agreement, whichever comes first. Nothing more needs signing, and we will sign a counterpart if a client's process wants one.

1. Which information this covers

• Client information is what a client and its people give us for a discovery or for the work that follows: answers, recordings, transcripts, documents, screen recordings, and access to the client's systems and the data in them. The client decides what to give us and why. The client is the controller, we are its processor, and these terms govern.
• Our own records are who a client's people are and how to reach them, the agreements signed, and invoices. We decide how to handle those in order to run a business, so we are their controller and our privacy notice governs instead.

Where a term is defined in the GDPR, the UK GDPR or the CCPA, it carries that meaning here.

2. What we do with it, and why

We process client information only to carry out the discovery, to perform the work in a statement of work, to keep the portal and what we build secure and running, and to support the client when asked. We do not sell it, share it for advertising, use it to serve another client, use it to train models, or mine it for statistics.

3. The client's instructions

We process client information only on the client's documented instructions. The signed agreements, these terms, and what the client's people choose to share and ask of us are those instructions. We will tell the client if an instruction appears to break data protection law, and may pause that processing while it is sorted out. If a law we are subject to compels us to go beyond the instructions, we will tell the client first unless that law forbids it.

4. Who can see it

Access is limited to the people at Iron Rod Systems working on that client, each under a written duty of confidentiality that outlasts their time with us. Access within our team can be limited client by client, and administrative actions are logged in an audit trail.

5. Security

We keep the measures in Annex II, judged against the risk to the people the information is about. We may change a measure as the portal changes, but not in a way that materially weakens overall security. Our security page carries the working detail.

6. Subprocessors

The client gives us general authorization to use subprocessors. Those that may handle client information are named in Annex III. Each is bound by written terms no less protective than these, and we remain responsible to the client for what they do. Before adding or replacing one, we give at least 30 days' notice by email to the client's sponsor. If the client has a reasonable data protection objection and we cannot offer an alternative, the client may end the affected work and we refund fees prepaid for the unused part.

7. When someone asks about their information

People whose information a client gave us deal with the client, because the client is the controller. If one of them comes to us directly, we tell them to contact the client, and tell the client promptly. We will help the client answer, including by finding, correcting, exporting or deleting what we hold, without charge for reasonable help.

8. If there is a breach

If we become aware of a personal data breach affecting client information, we notify the client without undue delay, and aim to within 72 hours. The notice says what we know: what happened, the kinds and rough number of records, the likely consequences, what we are doing, and who to talk to. We send what we know first and add to it as we learn more. We do not notify regulators or the people affected on the client's behalf unless the client asks us to in writing.

9. Assessments

If the client needs to carry out a data protection impact assessment or consult a regulator about our processing, we will give the information reasonably needed.

10. Getting it back, and deletion

On written request we return or delete client information within 30 days. Without a request, voice and screen recordings are deleted 30 days after the work ends: when the project concludes, when a managed services agreement ends, or when a proposal is not accepted; the rest is kept until the client asks for it to be returned or deleted. Copies the law requires us to keep, and copies in routine backups until they roll off within 35 days, remain protected by these terms.

11. Showing our work

On written request, no more than once a year unless there has been a breach, we will answer a reasonable security questionnaire and provide the information needed to show we meet these terms. If that is not enough to meet a legal requirement, we will agree a proportionate audit, at the client's cost, on reasonable notice and without access to other clients' information.

12. Sending information across borders

We and our subprocessors process client information in the United States. Where client information comes from the EEA, the UK or Switzerland, the European Commission's standard contractual clauses (processor to controller and controller to processor modules, as the roles require), with the UK addendum where it applies, are incorporated into these terms, with the details in the annexes. If the clauses and these terms conflict, the clauses control.

13. California

For the CCPA we are a service provider. We do not sell or share client information, do not keep, use or disclose it outside our direct relationship with the client or for any purpose other than the services, and do not combine it with personal information from other sources except as the CCPA allows a service provider to. We will tell the client if we can no longer meet these obligations.

14. Regulated records

These terms do not make us a business associate under HIPAA or cover payment card data. We ask clients not to send such records. If a statement of work needs them, it must say so, and the further agreement the law requires must be signed first.

15. Precedence, liability and law

If these terms and the master services agreement conflict on the handling of personal information, these terms control. Liability under these terms is subject to the limits in the master services agreement. These terms are governed by the law that governs that agreement.

Annex I · The processing

Parties

The client (controller), and Iron Rod Systems LLC (processor), legal@discoverpro.ai.

Categories of people

The client's owners, employees and contractors who take part in a discovery. The client's own customers, suppliers and employees, to the extent they appear in documents, recordings or systems the client shares.

Categories of personal information

Names, job titles and work contact details. Voice recordings and what was said in them. Whatever personal information appears in documents, screen recordings and systems the client chooses to share, which we ask the client to keep to what is needed to describe the work.

Special category data

None is intended. We ask clients not to share it, the interviewer is instructed not to ask for it, and we delete it when we find it.

How often, and how long

Continuously during a discovery and any work that follows, and then as section 10 says.

Nature and purpose

Collecting, recording, transcribing, storing, analysing and summarising, in order to assess the client's processes, propose improvements, and build and run what the client agrees to.

Annex II · Technical and organizational measures

• Encryption in transit (HTTPS enforced, TLS 1.2 or newer) and at rest; a further layer of encryption for secrets our software holds.
• Personal links stored only as fingerprints, with a code sent to the person's own email on any new device.
• No passwords for our team: one-time sign-in to an approved address plus a required second step (passkey or authenticator app).
• Access by role and by client; least access needed for the work.
• A tamper-evident audit trail of administrative actions.
• Rate limiting on sign-in, codes and client requests; cross-site requests refused for anything that changes data.
• A strict browser content policy, and no third-party scripts on any signed-in page.
• Scheduled deletion of recordings; deletion of other material on request and at the end of the work.
• Instructions to the AI interviewer and to the write-up not to collect or repeat personal details that are not needed, with a person reviewing output before it is used.
• Written confidentiality duties for everyone with access.

Annex III · Subprocessors

• Cloudflare, Inc. (United States). Hosting, database, file storage, and sending email from the portal. Handles all client information held in the portal.
• ElevenLabs, Inc. (United States). The voice interviewer: speech recognition, speech, and the live conversation, and transcription of narrated recordings. Handles interview audio and transcripts, and holds interview audio until we delete it.
• Anthropic, PBC (United States). Claude models that write up interviews, read shared documents, and draft assessments, proposals and statements of work, and that power the interviewer through ElevenLabs. Handles the text of answers, transcripts and documents.

Providers we use only for our own outreach, such as our mailbox host and business-contact providers, do not receive client information and are described in our privacy notice.