Privacy policy.

Who we are

Procilium is an automation practice run by Joshua Mott. We build email, data and agent automations for other businesses. This policy covers this website and the work we do for clients.

For anything on this site, Procilium is the data controller. That means we decide what gets collected and we are responsible for it. Contact details are in clause 11.

What we collect

Less than most sites. There is no analytics script, no advertising pixel, no tracking cookie and no chat widget on this page.

• If you book a call: your name, email, and the answers you give on the booking form. That is handled by Cal.com and lands in our Google Calendar and inbox.
• If you email us: whatever you put in the email. It sits in Google Workspace like any other mail.
• Automatically: our host, Netlify, keeps standard server logs, which include IP addresses and which pages were requested. We do not read these unless something is broken.

Why we collect it

To reply to you, to turn up to the call you booked, and to do the work if you hire us. That is the whole list.

The legal basis is straightforward: if you contacted us, we are acting on your request. If you become a client, we are performing a contract. Server logs exist because running a website securely requires them.

Client data, during a build

If you hire us, we will end up touching real data: your inbox, your CRM, your invoices. This is the part that actually matters, so here is how we handle it.

• We work inside your accounts. Automations run on your subscriptions, in your name. We are guests in your systems, not a middleman holding your data.
• You get a written data map before we build. What leaves your systems, what it is sent to, and why. If you are not happy with an item on it, we find another way.
• Read-only wherever read-only will do. We ask for write access only where the job requires it.
• Access ends when the work does. Credentials we held get handed back or revoked at handover, and you can revoke them yourself at any point without asking us.
• We will sign your NDA before the audit, not after. Ours is available if you would rather use it.

AI and your data

Our builds send text to AI model providers, usually Anthropic or OpenAI, through their paid business APIs. Two things are worth knowing.

• Nothing is used to train anybody's model. The business APIs we use exclude your data from training by default. That is a contractual term, not a promise we invented.
• We send the minimum. An agent reading invoices gets the invoice, not your whole accounting system.

If you want a build that never sends anything to a third-party model, say so on the audit call. It narrows what is possible, but it is often achievable and we will tell you honestly which parts survive.

Who we share with

We do not sell data, and we do not share it for marketing. We do use a small number of suppliers to run the business:

• Netlify hosts this website
• Cal.com handles call bookings
• Google Workspace handles our email and calendar
• Anthropic and OpenAI provide the AI models used inside client builds

Each holds data only to provide that service. We would also disclose information if the law required it, which has not happened and would be an unwelcome first.

How long we keep it

• Enquiries that go nowhere: deleted within 12 months.
• Client records: kept for the length of the engagement, then as long as tax law requires.
• Credentials and access: removed at handover.
• Server logs: kept by Netlify on their own short schedule.

Ask us to delete something sooner and we will, unless we are legally required to keep it.

Your rights

Depending on where you live, you have the right to ask what we hold about you, to have it corrected, to have it deleted, to get a copy, and to object to how we use it. Under GDPR and similar laws these are formal rights. We would honour them regardless.

Email us and ask. No form to fill in, no fee, and we will respond within 30 days, usually the same week.

Security

Two-factor authentication on every account that supports it. Credentials in a password manager, never in a spreadsheet or an email. Least access that does the job. This site is served over HTTPS.

Nobody can promise perfect security and we will not pretend otherwise. If something went wrong in a way that affected you, we would tell you promptly and plainly rather than quietly.

Changes to this policy

If we change it, the effective date at the top of the page changes. For anything significant affecting current clients, we would email rather than rely on you noticing.

Contact

Questions about any of this, or a request about your data, go to the same place as everything else: