Privacy policy

Tuff Way Ops is the trade name of Tuff Way LLC, a Florida limited liability company with its principal place of business at 7901 4th St N STE 300, St. Petersburg, FL 33702. References to "we," "us," and "our" in this policy mean Tuff Way LLC.

We install AI-assisted workflows for small businesses. We are not a SaaS company, a healthcare provider, a financial advisor, a legal services firm, or an advertising network. This policy describes how we handle personal information collected through this website, through the free-workflow application (including any documents you upload and the intake conversation), and through the calls we hold with you.

Identifiers and contact information. When you submit an application, book a call, or email us, we collect: your name, your role, business name, work email address, optional phone number, and the content of your message.

Application answers. What you tell us about the process you want automated: the revenue band, process name, elapsed turnaround estimate, documentation available, and the most sensitive category of information the process touches. If nothing is written down, we also collect your walkthrough, cadence, trigger, successful end state, tools, customer-facing status, and optional current owner. The intake assistant may infer your industry from this context or ask you to clarify it.

Documents you upload. If you say you have a written SOP, checklist, or notes, you must attach at least one AI-readable PDF, DOCX, TXT, MD, PNG, JPG, or JPEG file. We store the original so we can scope the work and send a model-readable version to the intake assistant. We ask you not to upload passwords, API keys, account numbers, or protected records, and the upload screen says so. If you send us something you should not have, tell us and we will delete it and confirm.

Intake conversation. The questions our intake assistant asks and the answers you give are stored with your application so we can scope the work and so a human can review the decision.

Business context. We collect what you choose to tell us about your business: your industry, process frequency, current time spent, the workflow problem you want to solve, and the tools you currently use.

Booking metadata. When you book a call through our Google Calendar scheduler, Google collects scheduling-related information directly (the meeting time you selected, any answers to scheduling questions, and your email address). Google shares that information with us so we can hold the call. Google's handling of that data is governed by the Google Privacy Policy, which is separate from this one.

Email engagement. If you receive emails from us, our transactional email provider records standard delivery telemetry, such as delivery, bounce, and unsubscribe status, so we can confirm our messages are reaching you and honor opt-outs.

Technical data. Our hosting provider logs standard request data (IP address, user agent, page requested, timestamp) for security and abuse prevention. Our rate limiter stores a hashed request identifier and rate-limit metadata so we can reduce form abuse without storing raw IP addresses in the limiter. We do not use this data to build profiles or to target advertising.

We do not collect financial account information, payment card data, government identifiers, biometric data, geolocation beyond country/region inferred from IP, protected health information, or any other sensitive category of personal data through this website.

To assess whether your process is a fit for a free workflow build, and to scope it if it is.

To hold the confirmation call you booked, and to deliver the workflow if we take it on.

To respond to your messages.

To communicate about the application you asked us to review, including its status and next steps. You can ask us to stop nonessential follow-up at any time.

To send transactional confirmations (booking confirmations, calendar invites, password-style one-time links). These are non-marketing and continue regardless of marketing opt-out status, because you need them to use the service.

To prevent fraud, abuse, and security incidents on our website.

To improve how we describe and scope our services. We may use anonymized and aggregated patterns from form submissions to refine our positioning. We do not share individual records.

We do not sell personal information. We do not share personal information with third parties for cross-context behavioral advertising (sometimes called "targeted advertising"). We do not run third-party ad pixels or remarketing tags on this site.

We do not use your data to train AI models, ours or any third party's. We do not allow our service providers to use your data to train their own AI models on your behalf. Our AI provider is contractually bound not to train on data submitted through its API.

The intake assistant gathers information and produces an assessment. A clean application may be accepted automatically under server-enforced qualification and safety rules; every other application is routed to a person. No application is declined automatically.

We do not text you for marketing purposes. We send SMS only inside a workflow you have explicitly configured with us as a paid client, to audiences for which you hold lawful basis and prior consent.

We add you to marketing updates only if you affirmatively select the optional marketing checkbox. You can unsubscribe at any time. Application-status and other transactional messages do not depend on that optional choice.

We do not require an account, set tracking cookies for advertising, or fingerprint your device.

We rely on a small number of service providers to operate the website and the application process. Each is contractually limited to using personal information solely to provide its service to us.

Hosting: Vercel Inc. (United States) hosts the website and processes inbound requests.

Web analytics: Vercel Web Analytics records privacy-conscious page views and custom button-click events so we can understand which pages and calls to action are working. We do not use it for advertising or cross-site profiling.

Rate limiting and application storage: Upstash Redis (United States and/or regional cloud infrastructure selected at setup) stores hashed request identifiers and rate-limit counters, and holds application records while they are being processed. We do not send raw IP addresses to the rate limiter.

AI processing: Anthropic PBC (United States) provides the model behind the intake assistant. Your application answers, your conversation with the assistant, and any machine-readable documents you upload are sent to Anthropic's commercial API so the assistant can ask relevant questions and produce an assessment. Anthropic does not train its models on commercial API data by default. Standard API inputs and outputs are generally deleted from Anthropic's backend within 30 days, subject to Anthropic's stated exceptions; files uploaded through its Files API persist until we delete them and may be deleted earlier than our internal archive copies.

Document storage: Vercel Blob (United States) stores uploaded files privately, under keys tied to your application.

Transactional email: Resend, Inc. (United States) delivers email notifications, application follow-ups, and booking confirmations.

Calendar and meeting: Google LLC (United States) provides the appointment scheduler and the Google Meet video call. Google's privacy practices govern data Google collects directly.

Operational tooling: Google Workspace (mail and storage) and a spreadsheet- or CRM-based prospect tracker, used by Tuff Way LLC personnel only.

If we add or change a category of service provider in a way that materially affects this policy, we will update the policy and the effective date below.

Application archive: we keep application answers, uploaded documents, intake conversations, research notes, summaries, booking records, and related correspondence as part of our internal business records. We do not promise automatic deletion on a fixed schedule.

We keep the archive while it remains reasonably necessary to understand the application, prepare or deliver services, maintain accurate business records, handle security or disputes, improve our operations using appropriately protected information, or meet legal obligations. Those purposes are the criteria we use to determine the retention period.

You may request deletion at any time. We will delete information when required, subject to identity verification and any information we are permitted or required to retain for legal, security, contractual, or recordkeeping purposes.

Email delivery telemetry: up to 12 months, then aggregated.

Web server access logs: up to 90 days, then aggregated for security analytics.

Paid-client records (after a signed engagement) are retained per the terms in that client's service agreement, typically 7 years after the engagement ends for tax and audit purposes.

See "Your rights" below for the request process.

Regardless of where you live, you can ask us to: (i) tell you what personal information we have about you, (ii) correct anything that is wrong, (iii) delete what we hold, (iv) stop sending you marketing email, or (v) provide a portable copy of what you submitted. Email will@thetuffway.com from the address you originally used. We respond within 30 days and will tell you if we cannot fulfill a request and why.

If you are a California resident, the California Consumer Privacy Act and California Privacy Rights Act give you the rights to know, delete, correct, limit use of sensitive personal information, and opt out of sale or sharing for cross-context behavioral advertising. We do not sell or share personal information for behavioral advertising, so the opt-out right does not require any action, but you may still confirm in writing by emailing us. We do not discriminate against you for exercising any privacy right.

If you are a Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Florida (under the Florida Digital Bill of Rights), or other US-state-law resident, you may have equivalent rights. The contact procedure is the same.

If you are in the European Economic Area, the United Kingdom, or Switzerland, the General Data Protection Regulation and the UK GDPR apply. Our legal basis is consent for marketing email and legitimate interest (responding to your inquiry, securing the site) for everything else. You have the right to lodge a complaint with your local data protection authority.

If we cannot reasonably verify that a request comes from you (or your authorized agent), we may decline the request and tell you why.

This site sets only the cookies and storage strictly necessary to load pages and remember basic UI state. We do not set cookies for advertising or cross-site tracking.

We use Vercel Web Analytics to measure page views and application-step events. The analytics are used to improve the funnel and are not used for advertising, retargeting, or building visitor profiles. We do not send application answers, names, email addresses, document names, or conversation text in analytics events.

We also use server-side rate limiting on the application. The limiter uses a one-way request identifier, not your form answers, to decide whether too many submissions have been sent in a short period.

Embedded third-party widgets (such as the Google Calendar appointment scheduler) may set their own cookies when loaded. Those are governed by the third party's privacy policy.

We take reasonable administrative, technical, and physical measures to protect personal information we hold, including TLS in transit, access controls, and least-privilege principles for staff accounts. No method of internet transmission or electronic storage is perfectly secure, so we cannot guarantee absolute security.

If a personal information breach occurs that is reasonably likely to result in identifiable risk to you, we will notify you and the appropriate regulators in accordance with applicable law, typically within the timeframes those laws require.

Our website and service providers are located in the United States. If you submit information from outside the United States, you understand and consent to your information being transferred to and processed in the United States, which may have data protection laws different from those of your country.

This website is intended for owners and operators of small businesses. It is not directed at children. We do not knowingly collect personal information from anyone under 16. If you believe a minor has submitted information, email will@thetuffway.com and we will delete it.

Every marketing email includes an unsubscribe method. We honor opt-outs within ten business days, as required by the federal CAN-SPAM Act, though typically the same business day.

Transactional messages (booking confirmations, account-style notices) are not subject to the marketing opt-out because you need them to use the service you requested.

We may update this policy as our practices evolve. The effective date below shows the most recent change. If we make material changes (adding a new category of data, a new purpose, or a new third-party recipient) we will update this page and, where appropriate, notify people who have opted in to receive our emails.

Privacy questions, requests, or complaints: email will@thetuffway.com with "Privacy" in the subject line.

Mailing address: Tuff Way LLC, 7901 4th St N STE 300, St. Petersburg, FL 33702, United States.