We don't sell your data Personal information is never sold, rented, or traded to advertisers or data brokers. Ever.

We don't train on your data Client material and visitor information are never used to train AI models — ours or anyone else's.

Client data stays segregated Engagement data is logically isolated per client, access-controlled, and handled under human oversight.

1. Who we are

Boots On The Ground AI, LLC ("Boots," "we," "us") is a Woman-Owned Small Business (WOSB) certified defensive-AI firm founded and led by Damara. Boots helps organizations deploy AI they can defend — through AI evaluations, red-teaming, secure deployment, and AI governance: the four Boots playbooks.

This policy covers information collected through our website (bootsagentai.com), through inquiries and appointments, and in the course of client engagements such as our paid AI product diagnostic.

2. What we collect

We collect the minimum information needed to run the business and deliver the work. We do not buy personal data, and we do not scrape profiles to build marketing lists.

• Contact information — name, email address, company, role. From you, via contact forms, appointment bookings, and email.
• Inquiry & engagement details — what you asked about, scheduling details, project scope, deliverables. From you, during sales and delivery conversations.
• Client materials — documents, system descriptions, code, or data you choose to share for an evaluation, red-team, or diagnostic, under the terms of your engagement.
• Payment information — billing details for paid engagements, processed by our payment provider. We do not store full card numbers.
• Website usage data — pages visited, approximate location, device and browser type, referral source, collected automatically via cookies (see Section 6).

What we do not collect: we do not collect sensitive personal categories (health, financial account credentials, government IDs, precise geolocation) through this website, and we ask clients not to send them unless an engagement specifically requires it under a written agreement.

3. How we use it

• To respond to you — answer inquiries, schedule and hold appointments, and send the information you requested.
• To deliver engagements — perform evaluations, red-team exercises, secure-deployment work, governance support, and diagnostics, and produce the deliverables you contracted for.
• To operate and improve the website — understand which content is useful, fix problems, and protect the site from abuse.
• To meet legal and contractual obligations — invoicing, record-keeping, and compliance with applicable law and government-contracting requirements.
• To communicate occasionally — if you have asked to hear from us, we may send updates about Boots services. Every such message includes a way to opt out, and opting out is final.

We do not use personal information for automated decision-making that produces legal or similarly significant effects on you, and we do not use it for cross-context behavioral advertising.

4. Our AI practices

We are an AI company, so this section matters more than most. It states, plainly, how AI touches your information when you work with Boots:

• No training on your data. Your information and client materials are never used to train, fine-tune, or improve AI models — not by Boots, and we select providers whose terms prohibit training on customer data.
• Human gates stay human. AI tools may assist with drafting, analysis, and evaluation work, but consequential outputs are reviewed by a person before they reach you or affect a decision.
• Client materials stay in scope. Material you share for an engagement is used for that engagement. It is not reused across clients, and it is not shown to other clients — engagement data is logically segregated per client.
• Confidentiality first. Client identities, materials, and findings are treated as confidential and are never published, quoted, or used in case studies without written permission.
• Evaluations handle data carefully. In evaluation and red-team work, test data is minimized, handled under the engagement's agreed controls, and attack artifacts are documented for the client's defense — not retained for other purposes.

5. When we share information

• Service providers — companies that help us operate (website hosting and scheduling through Squarespace, email, payment processing, and cloud infrastructure). They receive only what they need to perform their function.
• With your direction — when you ask us to share something, or sharing is necessary to deliver what you contracted for.
• Legal requirements — if required by law, subpoena, or court order, or to protect the rights, safety, and security of Boots, our clients, or others.
• Business transfer — if Boots is ever sold or reorganized, information may transfer with the business, subject to this policy or a no-less-protective successor.

We never sell personal information, and we do not share it with third parties for their own marketing.

6. Cookies & analytics

Our website is hosted on Squarespace, which uses cookies and similar technologies to run the site, remember preferences, and measure traffic — essential cookies required for the site to function and stay secure, and analytics cookies that help us understand aggregate visitor behavior. You can block or delete cookies in your browser settings; the site will still work, though some features may be limited. We do not run third-party advertising trackers, and we do not build cross-site profiles of our visitors.

7. How we protect it

• Least-privilege access — information is accessible only to the people who need it for the work.
• Tenant and client segregation — systems are designed row-level-security-first, so one client's data is logically isolated from every other client's.
• Audit trails — significant actions on our own production systems are recorded in append-only logs.
• Human gates on consequential actions — sensitive operations require a person's approval, not just a system's say-so.
• Framework alignment — our practices are organized around the NIST AI Risk Management Framework and secure-by-design principles.

No system is perfectly secure, and we won't pretend otherwise. If we ever discover a breach affecting your personal information, we will notify affected individuals and regulators as required by law, and say plainly what happened.

8. How long we keep it

• Inquiries — kept while we are in conversation with you, and for a reasonable period afterward in case you return.
• Client engagement records — kept for the period required by the engagement agreement, professional practice, and applicable law, including government-contracting record requirements where they apply.
• Client materials — returned or deleted at the end of an engagement as the agreement provides; ask us and we will confirm what was deleted and when.
• Website analytics — retained in aggregate form by our hosting provider per its standard schedules.

When information is no longer needed, we delete it or de-identify it. You may also ask us to delete your information sooner — see Section 9.

9. Your rights & choices

Depending on where you live, you may have some or all of these rights over your personal information — and we honor them as a matter of practice, not just where the law forces us to:

• Access — ask what personal information we hold about you and receive a copy.
• Correction — ask us to fix information that is wrong or incomplete.
• Deletion — ask us to delete your personal information, subject to records we must keep by law or contract.
• Opt out — unsubscribe from marketing messages at any time; we will never sell your data, so there is nothing to opt out of there.
• Non-discrimination — exercising any of these rights will never change the quality or price of Boots services offered to you.

To exercise a right, contact us using Section 12. We will verify the request is really from you and respond within 30 days. If we can't fulfill a request, we will tell you why, in writing.

10. Children's privacy

Boots provides professional services to businesses and government. Our website and services are not directed to children under 16, and we do not knowingly collect personal information from them. If you believe a child has provided us information, contact us and we will delete it.

11. Changes to this policy

If we change how we handle personal information, we will update this page, revise the effective date at the top, and — for material changes — note what changed and why. Changes take effect when posted, and the version published here is always the current one. We will never quietly weaken the commitments in Section 4; if they ever change, the change will be announced, not buried.

12. Contact us

Questions about this policy, or a request under Section 9, can be sent through the contact form or an appointment booking on bootsagentai.com. Address it to "Privacy — Boots On The Ground AI, LLC" and we will route it to the founder directly. Boots is a small firm: the person who wrote this policy is the person who will answer you.

Boots On The Ground AI, LLC · Woman-Owned Small Business (WOSB) Certified · Defensive AI: Evaluations · Red-Teaming · Secure Deployment · Governance
Privacy Policy · Effective October 21, 2026