Privacy Policy

Last updated: October 14, 2026

This Privacy Policy explains how Iron Bison AI ("Iron Bison AI," "we," "us") handles personal information when you visit our website, contact us, book a meeting, start a free trial, buy something from us, or use our software (together, the "Services"). We're a US company and the Services are intended for users in the United States.

The short version

• We collect what you give us (like your name, email and phone number) and what you store in your CRM.
• We use it to run the Services, support you and, if you agree, send occasional emails.
• We don't sell your personal information.
• Card numbers are handled by QuickBooks Payments, not stored by us.
• Analytics cookies are optional and only load if you say yes.

1. Information we collect

Information you give us.

• Forms: when you use our contact, quote, waitlist or newsletter forms, we collect what you enter, such as your name, email, phone number, company, what you're interested in and your message.
• Free trial and account signup: name, email, phone number, company, team size, industry and a password. We store passwords only as a secure one-way hash.
• Bookings: name, email, optional phone and company, the topic and any notes you add, the time you choose and your time zone.
• Purchases: name, email, phone, company, what you bought and billing details such as the last four digits and brand of your card.
• Support and communications: anything you send us by email or through the Services.

Customer Data. When you use our CRM, you may upload or enter information about your own leads, contacts and customers, including names, phone numbers, emails, addresses, notes and files you import from spreadsheets ("Customer Data"). We process Customer Data on your behalf and according to your instructions. You're responsible for having the right to collect and share it with us. See section 5.

Information collected automatically.

• Cookie-free page counts: we count page views using the page address, the referring website and a visitor identifier that's a one-way hash which changes daily. It uses no cookies and can't be used to follow you from one day to the next.
• Marketing attribution: when you submit a form, we record the page you first landed on, the referring site and any campaign tags (like utm_source) in the link you followed. This is kept in your browser's session storage until you close the tab.
• Essential cookies: if you sign in, we set a cookie that keeps you signed in. See our Cookie Policy.
• Optional analytics: if you click "Allow analytics," we load Google Analytics, which uses cookies to understand how the site is used. If you don't, it never loads.
• Server logs: like most websites, our servers record technical information such as IP address, browser type and request times, used for security and troubleshooting.

2. How we use information

• To provide, run and improve the Services, including creating your account and workspace.
• To respond to your messages, prepare quotes and hold the meetings you book.
• To process payments and send receipts, trial reminders and billing notices.
• To send product updates or newsletters if you've subscribed (you can unsubscribe anytime).
• To keep the Services secure, prevent fraud and abuse, and comply with the law.
• To understand, in aggregate, which pages and marketing channels are useful.

We may call or text the phone number you give us about your account, trial, booking or inquiry. We won't use it for unrelated marketing without your consent.

3. How we share information

We don't sell or rent personal information, and we don't share it for cross-context behavioral advertising. We share it only with service providers who help us run the Services, under contracts that limit their use of it:

• QuickBooks Payments (Intuit) to process card payments. Your card details go directly from your browser to Intuit and are turned into a token. We never receive or store your full card number.
• Google Calendar and Google Meet to schedule meetings you book and create video links. Your name, email, topic and notes are added to the calendar event.
• Google Analytics, only if you consent to analytics cookies.
• Hosting, database and email delivery providers that store data and send the emails we send you.

We may also disclose information if required by law, to protect our rights or users' safety, or as part of a merger, acquisition or sale of assets (in which case we'll ask the new owner to honor this policy).

4. How long we keep information

We keep account information and Customer Data for as long as your account is open. If your trial ends or you cancel, we keep your data for a reasonable period so you can return and pick up where you left off, unless you ask us to delete it sooner. Form and booking records are kept as long as needed to follow up and for our business records. Some records, like payment history, may be kept longer where the law requires.

5. Customer Data in the CRM

For Customer Data, you are the business in control of the data and we act as your service provider. We access it only to provide the Services, to support you when you ask, to keep the system secure, or as required by law. You can export your leads to CSV at any time. If one of your contacts asks us about their data, we'll refer them to you.

Connected calendars (Google and Microsoft)

If you choose to connect a Google Calendar or Microsoft Outlook / Microsoft 365 calendar, we ask only for permission to create and manage calendar events, plus your email address so you can see which account is connected. We use that access for one thing: adding your CRM tasks to your calendar and updating or removing those same events when the tasks change. We do not read, copy or store your other calendar events, and we do not use calendar data for advertising or sell or share it. The connection key we receive is stored encrypted. You can disconnect at any time from Account in the CRM (you can also remove our access in your Google or Microsoft account settings), and we then delete the key.

Iron Bison AI's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Private calendar links (the subscription link on the Account page) show your task names and dates to any calendar app that has the link. You can replace the link at any time, which switches off the old one.

6. Security

We use reasonable safeguards, including encrypted connections, hashed passwords, access controls and US-based hosting. No system is perfectly secure, so please use a strong, unique password and let us know right away if you suspect unauthorized access.

7. Your choices and rights

• Access, correct or delete: ask us for a copy of your information, or ask us to correct or delete it. You can update most account details yourself in the CRM.
• Export: download your CRM leads as a CSV at any time.
• Marketing emails: use the unsubscribe link in any newsletter.
• Analytics cookies: choose "Essential only" in the cookie banner, or clear your browser's site data to be asked again.

Depending on where you live (for example, California, Colorado, Connecticut, Virginia and other states with privacy laws), you may have additional rights, such as the right to know what we collect and to not be discriminated against for exercising your rights. We'll honor these requests as the law requires. We may need to verify your identity first. You can also use an authorized agent where the law allows.

8. Children

The Services are for businesses and are not directed to children under 16. We don't knowingly collect personal information from children.

9. Changes to this policy

We may update this policy from time to time. If we make significant changes, we'll update the date above and, where appropriate, let account holders know by email.

10. Contact us

Questions or requests about privacy? Reach us through our contact form and choose "Support with my account." We'll respond within one business day to acknowledge your request.