Privacy and data — Paul · Articulate AI

Your contacts are the most sensitive asset in your business. The whole project is built around minimising exposure and keeping you in control end-to-end.

The short version

Your WhatsApp export lives on one machine — my Mac, encrypted at rest.
Nothing gets uploaded to a third-party CRM, marketing platform, or AI vendor's training pipeline.
Enrichment uses public data only (DLD open records, public LinkedIn, public news). No paid people-search APIs that store profiles.
AI processing runs on Claude API with strict privacy posture — no data retention, no model training on your data.
The final deliverable is yours. I delete my working copy at project end (default day 60, or earlier on request).
Goyzer stays your CRM of record. Nothing gets written to it without your explicit approval.

What we pull, exactly

Source	What we pull	Where it stays
Your WhatsApp CSV	Chat names, message text, dates, attachments metadata (not content)	My local Mac, encrypted folder
Your Gmail (optional)	Subject lines, snippets, sender/recipient. Full body only on threads you flag.	My local Mac, encrypted folder
Your Calendar (optional)	Meeting titles, dates, attendees	My local Mac, encrypted folder
Dubai Land Department open data	Public ownership records, transaction history	Cached locally, public source
Public LinkedIn profiles	Name, role, employer, public posts (no DMs, no contacts)	Cached locally
Public news / press	Mentions of contacts in articles, podcasts, awards	Cached locally
Goyzer notes (optional)	Existing notes you've already captured on contacts	Read-only

What we don't pull

Paid people-search APIs (Truecaller, Apollo, Hunter, ZoomInfo) — these store profiles centrally and create third-party data exposure
Private LinkedIn DMs or connections
Bank statements, transaction records, identity documents
WhatsApp end-to-end-encrypted backup (the export bypasses E2E by design, but only when you turn it off explicitly)
Anything from a contact's private social profiles

AI handling

Processing runs on the Claude API (Anthropic). Specifically:

Zero data retention is enforced at the API level. Your data is processed and discarded.
No training. Anthropic does not train models on API-submitted data.
No cross-tenant leakage. Each request is isolated.
No third-party AI vendors. Specifically: no OpenAI, no Google Gemini, no consumer ChatGPT, no Gemini Workspace integrations seeing your data.

Reference: Anthropic data usage policy — Section "Data Usage".

Compliance posture

UAE Data Law (Federal Decree-Law No. 45 of 2021) — the project operates within the personal-data-processing exemption (data processed by the data subject's appointed agent for the subject's own legitimate business interests). You are the data controller. I am the processor. A short data-processing agreement (DPA) is part of the project paperwork — one page, plain English, signed at kickoff.

GDPR — relevant only for any European data subjects in your book (Greek, French, Italian HNW clients). Posture: same legitimate-interest basis under GDPR Art 6(1)(f), with the additional guard that no profiling decision is automated — every opener is reviewed by you before sending.

Your control

At any point, you can ask me to:

Delete specific contacts from the working set (e.g. "remove anyone I tag in Goyzer as 'do-not-contact'")
Pause processing
Hand back all working files and delete my copies
Run a single-contact deep-dive without joining to the broader book

You own the data. You own the deliverable. You own the IP in any drafted message. Articulate's only retained right is to reference the existence of the engagement in case-study form, anonymised, with your written approval before publication.

After project end

Working files deleted from my Mac (verified by sha256 manifest in the close-out email)
Cached DLD / LinkedIn / news data deleted
Goyzer integration disconnected (if we'd connected one)
Your deliverable PDF + CSV remain yours, stored wherever you keep your business records

Questions

WhatsApp me for anything not covered. The privacy posture is deliberately conservative — UAE HNW clients are sensitive about data exposure, and the project should not create new attack surface.