Privacy policy
How Crown & Oak Capital LLC, which trades as Blackthorn Labs, handles information about people: what is collected, where it comes from, why, who else handles it, how long it is kept, and how to have it corrected or deleted.
We never sell information about people. We do not rent it, trade it, or give it to anyone to use for their own purposes. It is used only inside our own work, and the companies listed in section 11 handle it only to do their part of that work for us.
1. Who we are, and the roles we hold
Crown & Oak Capital LLC, which trades as Blackthorn Labs, is an applied AI research and development firm. It builds software where the stakes are real: inside operating businesses, and it is pursuing work with federal and defense programs. The work runs from research and design through engineering to operating what is built, with the same engineering and the same standard at every scale. That work touches information about people in three different ways, and who decides what happens to it differs in each.
When you deal with us directly, as a visitor to our websites, a person at a business we may work with, a client, or a person who signs or opens something we send, Crown & Oak Capital LLC decides what is done with your information, and this policy describes how.
When we do engineering work for a client, including building or running its systems, that client owns the information those systems handle and decides what is done with it. We handle it only to deliver and support the work, to meet our own legal duties, and as the client directs in writing. Requests about information held in a client's system are best sent to that client, and we pass on any request we receive.
When we work under a government contract, the contract decides, as section 10 explains.
2. People at businesses we may work with
Before we write to or call a business, we learn what we can about it, so that what we say is about that business and not a template.
What we hold. A person's name, job title and employer, a work email address, telephone numbers, and public facts about the business: what it does, roughly how large it is, where it works, the jobs it has advertised, and what its own website says. We also keep a record of each note, call and reply.
Where it comes from. Commercial providers of business contact information, the business's own website, public registers and public job advertisements. Telephone numbers from those providers can include a person's direct line or mobile number. We do not ask them for personal email addresses.
Why. To decide whether we can be useful to a business, and to write to or call the people there about it. Each note is written for one business.
Email. Every email says who we are, gives our postal address and tells you how to stop. A request to stop is recorded and honoured. Your address, or the whole business if you ask, then goes on a stop list that is kept so the request keeps being honoured.
Calls. Kyle records some calls so the details are right afterwards. Recordings are made and transcribed on our own computer. Ask, and the recording of your call is deleted.
How long. For as long as we may work with the business. Ask, and we remove your name and contact details from our records, apart from the stop list and a dated record that a note or call took place, which we keep so we can show your request was honoured.
3. When you use our websites
This section covers the website at blackthornsec.com.
The website sets no cookies and shows no advertising. It loads one script from another company: Cloudflare, which delivers the site, adds a short script that reports each page view to Cloudflare's Web Analytics: the page, the website that sent you, the kind of browser and device, and how quickly the page loaded. It sets no cookie.
Cloudflare, which delivers the pages, handles the internet address of every request in order to deliver it.
Our websites do not follow visitors across other websites, and we do not sell or share information for advertising, so a browser's Do Not Track or Global Privacy Control signal has nothing to switch off.
Booking a call. The booking page takes your name, work email address, company, a note if you write one and the time you choose, with your time zone, the page you arrived on and the website that sent you. Kyle is told by email, on his calendar and by a message app alert. A code made from your internet address, which changes every day, is used only to limit repeated bookings and lookups. A booking is kept for as long as we may work with you, and removed when you ask, as in section 2.
A page made for one business. When we send a business a page made for it, the page records when it is opened, the kind of device and browser, the country, region and city the visit comes from, the network it comes through, and a code made from the internet address that changes every day. When the visitor interacts with it, the page also records how long it is in view, how far it is scrolled, which parts are read and opened, which of its links are followed, and whether it is printed or downloaded. When the same page is opened on a second device or from a second city, that is noted. Links in an email or a document we send carry the same page code, so following one is recorded the same way. Kyle is told by a message app alert when the page is first read, when a booking is started from it, and when it is opened again or passed on. The page sets no cookies and loads nothing from any other company, and it says so on its first screen. These records are kept for 180 days, then reduced to a short summary on the business's record. A visitor who asks for one of our documents on the site is given a page of this kind. What they type into the form is kept with it: their name and business with an email address and the kind of work they do. It is kept as a booking is, for as long as we may work with them, and removed when they ask. Kyle is told by a message app alert with what they entered.
4. When you sign an agreement electronically
If you sign an agreement with Crown & Oak Capital LLC electronically, a signing record is created so that both sides can later show who signed, what they signed and when. It contains:
- your name, email address, company and title as you confirmed them;
- how you proved it was you: a one time code sent to your email address, and for some agreements a second code can be sent to your telephone by text message. There is no password;
- the date and time of signing, and how long each document was open before you signed;
- the internet address and browser description of the device you signed from;
- an image of your signature, and if you drew it, the path and pace of the strokes, which is evidence that a person drew it and that an image was not pasted;
- a fingerprint of the agreement text and of the finished document, which is a calculated value that changes if a single character is altered.
Electronic signatures are used under the Electronic Signatures in Global and National Commerce Act, 15 U.S.C. 7001, and the Uniform Electronic Transactions Act. You will be asked to agree to sign electronically before you do, you may ask for paper instead, and you receive a copy of what you signed. The signing record is kept for as long as the agreement is in force and for as long afterwards as a question about it could still be raised.
5. When you open a document link
When we deliver a document, such as a report or a call recording, by a private link rather than as an email attachment, so that access can be withdrawn, you are asked before it opens to prove the link is yours by signing in with the Google or Microsoft account for the email address it was sent to. Each opening is recorded: your email address, the time, and the internet address and browser description of your device. The record also notes whether the person who opened the link is the person it was sent to. Links expire, normally after 14 days, and can be withdrawn sooner.
6. When you call, text or write to a business that uses a system we run
Among the systems we build, some answer telephone calls and send messages for the business that uses them. That business owns the information (section 1). The assistant says at the start of the call that it is automated. The information collected is what you say: normally your name, the number you called from, and what the call was about.
Recording. Each business decides whether its calls are recorded or transcribed. Where they are, the greeting tells the caller so. Details are on the recording and automated assistant page.
What the assistant will not ask for. It does not ask for payment card numbers, bank account numbers or Social Security numbers. If you need to pay, you are directed to the business's own payment process. If you read one out anyway, ask the business to remove it from the record of your call, or ask us and we pass the request to it.
How long. Recordings and transcripts are kept for the period the business has chosen, and for 90 days where it has not chosen one. When a business stops using the service its information is available to it for export for 30 days and is then deleted, apart from routine backups that expire on their normal cycle and anything the law requires to be kept.
7. Text messages
Mobile telephone numbers, and the fact that a person agreed to receive messages, are not sold, rented or shared with third parties or affiliates for marketing or promotional purposes. The full terms, including how to stop, are on the text message terms page. Every request to stop is recorded, with the words used and the time, so that it can be shown to have been honoured.
8. Information a client gives us
When a client gives us information to build or run a system, it is used only to deliver and support that client's work, to meet our own legal duties, and as the client directs in writing, and it is returned or deleted when the work ends: available for export for 30 days, then deleted, apart from routine backups that expire on their normal cycle and anything the law requires us to keep. Where practical, the accounts a system runs on are opened in the client's name, so the client keeps control of them.
9. Artificial intelligence
As an applied AI research and engineering firm, we use artificial intelligence models to research, read, draft and answer, in our own work and in the systems we build. Some run on our own hardware. Others are run by AI model providers, who are among the companies in section 11. Output from a model can be wrong, so a client reviews a system's scripts, answers and rules before it goes live, and a document a client's workflow prepares is approved by a person the client names before it is sent, unless the statement of work says otherwise. We do not use information about you to train models (section 13).
10. Work for government programs
When a government agency, or a company working for one, gives us information under a contract, the contract and the clauses it carries govern how that information is handled, stored, protected and reported, including any rules for controlled unclassified information. We do not hold controlled unclassified information today. Where those rules are stricter than this policy, they apply. Information received under a government contract is never used for marketing, to train models, or for any other customer.
11. Other companies that handle it
For the systems we run for a business, the companies fall into five groups: telephone and messaging carriers, voice AI platforms, AI model providers, workflow automation hosts, and the calendar, email and customer systems a business already uses. A business using the service can ask for the current list of companies at any time and is told before a company in a new group is added.
For our own work (sections 2 to 5): Cloudflare, which delivers our websites and receives email sent to our blackthornsec.com addresses; Supabase, which hosts our database and server functions; Google Workspace, for email and documents; GitHub, which stores our code and working files and runs our automated document processing; Apollo.io, which provides business contact information; Stripe, for invoices and payments; Anthropic, an AI model provider; and Telegram, a message app that carries alerts to Kyle, including a booking's name, company and note.
12. Where it is kept
Our database is in the United States, in Amazon Web Services' US East region, through Supabase. Our websites are delivered by Cloudflare from its servers around the world. Alerts sent to Kyle through Telegram are held on Telegram's servers, which are not all in the United States.
13. What is never done with your information
- It is not sold, rented or traded, and it is never given to anyone to use for their own purposes. It is used only inside our own work.
- We do not use it to train artificial intelligence models.
- It is not used for advertising, and it is not shared for advertising.
Crown & Oak Capital LLC may produce statistics about how its work performs, such as call counts and response times, that do not identify any business or any person.
14. Security
Multifactor authentication on every account that supports it, access limited to the people who need it, keys and access tokens kept out of our code (in files only our own account can read, on an encrypted disk, and in our hosting providers' secret stores), and encryption of information in transit. If a security incident affects a business's information, that business is told within 72 hours of the incident being confirmed.
15. Regulated information
Our systems are not used for patient health information unless the business and Crown & Oak Capital LLC have signed a separate business associate agreement. The service is not an emergency service. A caller who describes an emergency is told to hang up and dial 911.
16. Your choices
Wherever you live, you may ask what information we hold about you, ask for it to be corrected, ask for it to be deleted, or ask us to stop writing to or calling you. Write to contracts@blackthornsec.com or call 810 656 9539. Where the information belongs to a client's system, the request is passed to that client, which decides it. You will be told what was done.
17. Children
Our work is for businesses and public programs and is not directed at children under 13.
18. Changes
Changes are posted on this page with a new date.
Kyle Cleary, for Crown & Oak Capital LLC