Privacy Policy

1. At a glance

AI Code That Works LLC, a Texas limited liability company doing business as Goosy Bear ("Goosy Bear," "we," "us," or "our") operates the Goosy Bear website at https://goosybear.ai (the "Site") and the Goosy Bear application at https://app.goosybear.ai (the "Application" — together, the "Service"). This Policy explains what personal data we collect, why we collect it, who we share it with, and the rights you have over it. Plain English wherever plain English will do.

• You give us data on the Site when you join the waitlist (your email address, plus any optional details you choose to add) or when you email us directly.
• If you use the Goosy trial — the short conversation that reads your website and builds a growth report — you also give us the link you submit, what you type in the chat, your answers to Goosy's questions, and the email address you enter to receive the report. Section 4 sets out exactly what that involves.
• If you are a Goosy Bear customer, we hold your account, the content you create in the Application, and your billing records — and, where you connect your own third-party accounts (advertising, social publishing, CRM and email, analytics), section 7 sets out per provider what we access, how it is protected, and what happens when you disconnect.
• Your browser gives us limited technical data through analytics and error-monitoring tools, which are governed by the cookie banner and by your region's consent rules.
• We use all of it to provide the Service, to bill for it, to reply to you, to send you the updates you asked for, to keep the Service working, and to stop abuse.
• We share it only with the named service providers in section 6 and the connected-account providers in section 7 — never with data brokers. The complete platform sub-processor list is published at https://goosybear.ai/subprocessors.
• We do not sell your personal data, and we do not share it for cross-context behavioral advertising.
• You can ask us for a copy of your data, a correction, or a deletion at any time by emailing goosy@goosybear.ai. Deletion has its own step-by-step page at https://goosybear.ai/data-deletion.

2. Who we are

Goosy Bear is the controller of the personal data described in this Policy — meaning we decide why and how that data is processed — except where section 3 says we act as a processor for a customer.

Postal address: AI Code That Works LLC, 2303 Ranch Road 620 S., Suite 160-240, Lakeway, TX 78734, United States.

We do not currently maintain a separate EU or UK representative. If you are in the EEA or the UK and would prefer to reach a representative in your jurisdiction, email us at the address above and we will handle your request directly.

3. What this Policy covers

This Policy covers the Site — including the waitlist form and the Goosy trial, the short conversation that builds a growth report from a link you give us (the trial is offered only when it is open; when it is not, the Site offers the waitlist instead and nothing in this Policy's trial passages happens) — and the Application: accounts, the content customers create in it, billing, and the third-party accounts customers connect to it. The Application presents its own in-product notices where a specific feature needs one; those sit alongside this Policy rather than replacing it.

Where a customer's workspace contains personal data about the customer's own contacts, leads, and audience — for example the contacts in a connected CRM, the submissions a lead form collects, or the people who message the customer's social pages — we process that data as the customer's processor, on the customer's instructions, under the Data Processing Addendum at https://goosybear.ai/dpa. If you are one of those individuals, the business you dealt with is the controller of your data: direct your request to them, and we will help them honor it.

Goosy Bear is a general-audience business product. It is not directed to children, and section 13 explains what we do if a child's data reaches us anyway.

4. What we collect

Personal data reaches us in the ways below, and in no others.

5. Why we use it, and on what legal basis

We process personal data only for the purposes below, each on the legal basis named for it (GDPR Article 6; the equivalent basis applies under the UK GDPR).

• To provide the Application to you under your subscription — accounts, content creation, publishing, the connected-account features you use, and support. Basis: performance of a contract (Article 6(1)(b)).
• To bill you and keep required financial records. Basis: performance of a contract (Article 6(1)(b)) and legal obligation (Article 6(1)(c)).
• To put you on the waitlist and send you the product news and updates you asked for. Basis: steps taken at your request before entering a contract (Article 6(1)(b)), and your consent for the marketing emails themselves (Article 6(1)(a)).
• To run the Goosy trial and build the report you asked for — reading the link you submit, holding the conversation, keeping your draft so you can come back to it, and sending you a link to the finished report. Basis: steps taken at your request before entering a contract (Article 6(1)(b)), and your consent for the follow-up emails disclosed to you at the point you give us your address (Article 6(1)(a)).
• To understand which parts of the trial people complete, using the analytics described in section 12. We record that a step happened, never what you typed, the link you gave, or your email address. Basis: your consent where consent is required (Article 6(1)(a)); our legitimate interest in a funnel that works otherwise (Article 6(1)(f)).
• To bound what the trial costs and to stop it being abused — the bot check, the rate limit, the per-conversation turn cap, and the run log that records each turn's model and cost. Basis: our legitimate interest in abuse prevention and in a service we can afford to keep free (Article 6(1)(f)).
• To reply to an email you send us. Basis: our legitimate interest in answering people who contact us (Article 6(1)(f)).
• To understand how the Service is used and improve it. Basis: your consent where consent is required (Article 6(1)(a)); our legitimate interest in a service that works otherwise (Article 6(1)(f)).
• To find and fix errors and keep the Service secure — including the audit trail of actions in the Application. Basis: our legitimate interest in a functioning, secure service (Article 6(1)(f)).
• To meet our legal, tax, and record-keeping obligations, and to establish or defend legal claims. Basis: legal obligation (Article 6(1)(c)) and legitimate interest (Article 6(1)(f)).

Where we rely on legitimate interests we have weighed them against your rights and concluded they are not overridden. You can object on grounds relating to your particular situation by emailing us. We do not carry out automated decision-making that produces legal or similarly significant effects on you.

6. Service providers and sub-processors

We share personal data with the service providers below, and only as far as each needs it to do its job for us. Each processes data on our instructions under its published data-processing terms.

• Supabase, Inc. (United States) — the database that stores accounts, customer content, waitlist entries, trial drafts, and consent records. https://supabase.com/privacy
• Vercel Inc. (United States) — hosting. Every request to the Service passes through Vercel, including your IP address and request metadata. https://vercel.com/legal/privacy-policy
• Stripe, Inc. (United States) — payment processing for subscriptions and fees. Your card details are entered with Stripe directly; we never receive the full card number. https://stripe.com/privacy
• LeadConnector LLC, trading as GoHighLevel (United States) — the CRM and email system that holds your waitlist or trial entry and sends you the emails you opted into, and the CRM transport behind the Application's Grow features (section 7.4). https://www.gohighlevel.com/privacy-policy
• Mailgun Technologies, Inc., a Sinch company (United States) — the transactional email service that delivers system email, including your Golden Egg report link at the end of the trial. https://www.mailgun.com/legal/privacy-policy/
• Cloudflare, Inc. (United States) — Cloudflare Turnstile, the privacy-preserving bot check on the waitlist form and on the trial. It runs in your browser to confirm you are a person, and Cloudflare states that it does not use it to track users across sites. https://www.cloudflare.com/privacypolicy/
• SideGuide Technologies, Inc., trading as Firecrawl (United States) — the page-reading service the trial and the Application's brand-ingestion features use. In the trial it receives the website or social-profile link you submit and fetches that page on our behalf, returning its text to us. It receives that link and nothing else you told Goosy. https://www.firecrawl.dev/privacy-policy
• Anthropic PBC (United States) — an AI provider behind Goosy. In the trial it receives the text of the page we fetched and the messages you send, and returns Goosy's replies and the drafted profile. https://www.anthropic.com/legal/privacy
• PostHog Inc. (United States) — product analytics, when you have granted analytics consent. Receives pseudonymous page and interaction events, including which step of the trial a visitor reached — never what you typed, never the link you gave, never your email address. https://posthog.com/privacy
• Functional Software, Inc., trading as Sentry (United States) — error monitoring and session replay. Receives errors, stack traces, and the short trail of actions before an error. https://sentry.io/privacy
• Google LLC (United States) — Google Tag Manager and Google Analytics 4, on the production Site only and subject to the consent rules in section 12. https://policies.google.com/privacy

Our current list of platform sub-processors is published at https://goosybear.ai/subprocessors and is generated from the sub-processor register we maintain, so it reflects the providers in use at the time you read it — each with its role, the categories of data it processes, and where it operates. Material additions are notified as section 16 describes.

Beyond those providers we may disclose personal data where a subpoena, court order, or other valid legal process requires it; to protect our rights, property, or safety or those of others; and in connection with a merger or sale of the business, in which case we will give you notice where the law requires it.

7. Connected accounts and platform data

The Application lets a customer connect their own third-party accounts so Goosy can do marketing work on them. This section applies to business customers who have linked an account of their own — not to a visitor to the Site. What we reach depends on the provider and on what the customer chose to connect; the categories below are the complete map.

8. International transfers

Our providers operate primarily from the United States. Where we transfer personal data out of the European Economic Area, the United Kingdom, or Switzerland to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), the UK Addendum to those clauses for UK transfers, and — where the provider has self-certified — the EU-US Data Privacy Framework and its UK extension. You may request a copy of the relevant safeguards by emailing us; copies may be redacted to protect commercially sensitive terms.

9. How long we keep it

We keep personal data only as long as the purpose it was collected for needs it, or as long as the law requires.

• Application accounts and customer content — for the life of the account, then deleted within 30 days of account deletion (after the 30-day recovery grace period on workspace and account deletion runs out).
• Connected-account data — deleted within 30 days of the connection being removed, per section 7.7.
• Billing and tax records — 7 years, because tax law requires it.
• Audit and usage records — for the life of the account, deleted with it.
• Waitlist and trial entries — 24 months from your last interaction with us, then deleted or anonymized. If you unsubscribe or ask not to be contacted, we keep your email address on a suppression list indefinitely, because that is the only reliable way to honor the request.
• Trial drafts — 30 days. Every draft is stamped with a 30-day expiry when it is created, and one that has not become an account by then is deleted. The cookie that points at it expires on the same schedule.
• Trial run-log entries — the per-turn record of the message, the model, and the cost. We keep these as operational records of what the trial spent, and we delete yours if you ask us to.
• Email correspondence — for as long as our exchange is live, plus up to 7 years for tax, accounting, and dispute purposes.
• Analytics events — 14 months from capture. Aggregate, non-identifying summaries may be kept longer.
• Error events and session replays — 30 days from capture, then deleted under the provider's retention policy.
• Backups — a deleted record can persist in backup snapshots for up to 35 days, after which the snapshot expires.

Where the law requires us to keep a record for longer — tax records, or anything tied to a live legal claim — we keep it for the statutory period and apply the periods above once that period ends.

10. Your rights

Depending on where you live, you have some or all of the following rights over your personal data. We apply them to everyone who asks, wherever they live, because operating two standards is how mistakes happen.

• Access — a copy of the personal data we hold about you, and an explanation of what we do with it.
• Correction — fix data that is wrong or incomplete.
• Deletion — have your personal data erased, subject to the narrow exceptions in section 9 (a suppression-list entry, and anything the law requires us to keep).
• Restriction — pause our processing while a dispute about accuracy or objection is resolved.
• Portability — receive the data you gave us in a structured, machine-readable format.
• Objection — object to processing we base on legitimate interests, and to direct marketing at any time. We stop direct marketing on request, no questions asked.
• Withdraw consent — withdraw any consent you gave, at any time, without affecting what we lawfully did before you withdrew it.
• Non-discrimination — we will not treat you differently for exercising any of these rights.
• Complain — lodge a complaint with your data-protection authority. In the EU, the list is at https://edpb.europa.eu/about-edpb/about-edpb/members_en; in the UK it is the Information Commissioner's Office at https://ico.org.uk/make-a-complaint/.

California residents have the equivalent rights under the CCPA as amended by the CPRA — to know, to access specific pieces, to delete, to correct, to opt out of sale or sharing (there is nothing to opt out of, as section 6 explains), to limit the use of sensitive personal information (we collect none), and to non-discrimination. Residents of Colorado, Connecticut, Virginia, Utah, and other states with comparable laws have equivalent rights, and we honor them on the same basis.

If your personal data reached us inside a customer's workspace — you are a contact, lead, or audience member of a business that uses Goosy Bear — the business you dealt with is the controller (section 3). Send your request to them; if you send it to us instead, we will pass it to them and help them honor it.

11. How to exercise your rights

If what you want is deletion specifically, https://goosybear.ai/data-deletion sets out the steps, the exact subject line to use, and what happens after you send it.

We acknowledge requests within 5 business days and complete them within the window the law gives us — normally one month under the GDPR (extendable by two further months for genuinely complex requests, with notice), and 45 days under the CCPA (extendable by 45 further days, with notice).

We verify you before we act, normally by confirming you control the email address on file. You may use an authorized agent; a California agent must provide written proof of authorization, and we may contact you to confirm it. There is no fee, though we may decline or charge for requests that are manifestly unfounded or repetitive.

12. Cookies, analytics, and your consent

This Site sets its own first-party cookies and browser storage only. It does not host any third-party advertising cookie, remarketing tag, or social pixel. Here is everything that runs.

• Strictly necessary — a first-party cookie named `revastack_consent`, plus a matching entry in your browser's local storage, recording your cookie-banner choice for one year. It carries the shared platform prefix rather than a Goosy-branded name because the consent component is shared across our family of sites; it holds nothing but your choice. This one is set whichever way you answer the banner, because forgetting your answer would mean asking again on every page.
• Analytics — PostHog, which sets first-party cookies beginning `ph_`, and Sentry, which uses browser storage rather than a cookie. Both are governed by the analytics category on the banner. PostHog starts opted out and only begins collecting once the analytics category is granted; withdrawing consent opts it back out and resets the identifier it held. Sentry keeps a short rolling buffer that is sent only if an error actually occurs — the software masks text, inputs, and media by default — and starts full session replay only after you grant analytics consent.
• Google Tag Manager and Google Analytics 4 — loaded only on the live production site, and only through our own tag container. GA4 sets first-party cookies named `_ga` and `_ga_*`. Preview and staging builds of this Site load no tags at all, so our own testing never lands in the analytics data.
• Strictly necessary — a first-party cookie named `goosy_trial_session`, set only if you start the Goosy trial and only after the bot check has passed. It holds one value: an identifier with no meaning outside this Site, which is what lets the trial recognize your own draft when you come back to it. Your browser cannot read it, and it expires after 30 days along with the draft it points at. No trial, no cookie.
• Strictly necessary — a first-party cookie named `goosy_trial_rollout`, set the first time you ask to start the trial — including when the bot check refuses, which is deliberate. It holds one random identifier with no meaning outside this Site, used for exactly one thing: keeping our answer to "is the trial open to you yet" stable while we open it up gradually, so reloading the page cannot change that answer. It creates no draft, records nothing you typed, and expires after 30 days.
• Cloudflare Turnstile — the bot check on the waitlist form and on the trial. It loads in your browser to confirm you are a person and may keep a short-lived challenge token; Cloudflare states that it is not used to track you across sites.

The Application at https://app.goosybear.ai sets its own strictly necessary cookies — the authentication session that keeps you signed in — and nothing in this section's analytics categories runs there outside the same consent rules.

Your default depends on where you are. If you are in the European Economic Area, the United Kingdom, or Switzerland, analytics and marketing consent both start DENIED and nothing beyond the strictly necessary cookie runs until you grant it on the banner. Everywhere else — including the United States, Canada, Australia, and New Zealand — they start GRANTED and the banner is how you turn them off. Your explicit choice on the banner always overrides the regional default, and it applies to that browser until you change it.

We honor the Global Privacy Control signal. If your browser sends `Sec-GPC: 1` or exposes `navigator.globalPrivacyControl === true`, we treat it as a denial of analytics and marketing consent regardless of your region. You can still grant consent explicitly on the banner if you want to, and that explicit choice wins. There is no industry consensus on what the older Do Not Track header means, so we do not act on it on its own.

You can change your mind at any time — clear this site's cookies and site data in your browser (both the cookie and the matching local-storage entry) and the banner will ask you again on your next visit. A Global Privacy Control signal is honored as a denial when you have not yet answered the banner; once you have made an explicit choice, that choice stands until you clear it and answer again.

13. Children's privacy

Goosy Bear is not directed to children, and we do not knowingly collect personal data from anyone under 16. If you are under 16, do not join the waitlist or email us. If we learn that we have collected personal data from a child under 16 without a parent's verified consent, we delete it as soon as we reasonably can. Parents and guardians who believe we hold a child's data can write to goosy@goosybear.ai and we will investigate and respond.

14. How we protect it

We apply technical and organizational measures proportionate to the data the Service holds:

• TLS encryption in transit for every connection to the Service and between our systems and our providers, and encryption at rest in the database.
• Row-level security in the database, so customer isolation is enforced by the database itself rather than by application code remembering to filter.
• Least-privilege credentials — administrative database keys never reach your browser, connected-account tokens live in an encrypted vault with every access logged, and operator access to live data is limited and logged.
• Approval gates and budgets on every action that publishes content or spends money, with an audit trail the customer can read.
• Rate limiting and a bot check on the public forms.
• Automated error monitoring and an audit trail, so unusual activity surfaces quickly.

No measure is perfect and we cannot guarantee absolute security. If a breach occurs that is likely to risk your rights and freedoms, we will notify the relevant supervisory authority within 72 hours where the law requires it, and notify you without undue delay where the risk to you is high.

15. Links to other sites

The Service may link to third-party websites and services we do not control. This Policy covers only the Service. Read their privacy notices before giving them your data.

16. Changes to this Policy

We update this Policy when what we do changes. The 'Last updated' date at the top always reflects the most recent change. When a change is material — including a material addition to the sub-processor list or a change in what we do with connected-account data — we will tell you by email if we hold your address and the change matters to you, or by a notice on the Service for at least 30 days before it takes effect.

17. Contact us

AI Code That Works LLC, 2303 Ranch Road 620 S., Suite 160-240, Lakeway, TX 78734, United States. Effective 2026-08-25.