Privacy Policy
Effective
The short version
- We collect what we need to run Sagecraft and Sage Studio, work with clients, and tell people about what we do.
- Content your organization puts into Sage Studio belongs to your organization. AI providers never train on it, and it’s never used to build anything shared with other customers.
- You can ask us to see, correct, or delete your information by emailing legal@sagecraft.net.
The rest of this page gives the details.
1. Who we are
Sagecraft is the business name of Grand Adventures LLC, an Arizona limited liability company located at 7811 E Beryl Ave, Scottsdale, AZ 85258, USA. In this policy, “Sagecraft,” “we,” “us,” and “our” mean Grand Adventures LLC.
This policy covers:
- our website at sagecraft.net (the “website”)
- the Sage Studio platform at app.sagecraft.net (“Sage Studio”)
- our consulting, advisory, and AI build work
- our training, courses, and content
Together, we call these our “services.”
Two kinds of information, two different roles.
- Information about you that we decide how to use. This includes your account, billing, website visits, and marketing. We are responsible for this information, and this policy explains how we handle it.
- Content your organization puts into Sage Studio or shares with us on a project. We call this “customer content.” Your organization controls it, and we handle it on your organization’s behalf under our contract with them. If your question is about customer content, please contact your organization first. We will help them respond.
What this policy does not cover: other companies’ websites and services, including tools you connect to Sage Studio; and an AI provider account you connect under your own agreement with that provider.
2. What we collect
Information you give us
- Account details: name, email address, phone number, job title, organization, and login details.
- Billing details: billing contact, billing address, invoices, and payment status. We send invoices through Intuit QuickBooks. When you pay online, Intuit handles your card or bank details. We never see or store your full card or bank account number.
- Training and courses: if you enroll in our training or courses, your enrollment, purchases, progress, quiz and assessment answers, and certificates.
- Recordings: we record a training, webinar, or meeting only when the participants approve. A recording may include names, faces, voices, and chat messages.
- Project details: names, roles, and contact details of the people we work with, plus project notes and correspondence.
- Messages: what you send us through support requests, website forms, newsletter sign-ups, and event registrations.
Information we collect automatically
When you use our services, we collect “usage data”: your IP address, browser and device type, operating system, the page that referred you, the pages and features you use, clicks, time spent, and error logs. Section 6 explains the cookies and similar tools that collect it.
Information we get from others
- Your organization, when it sets up your account or shares your business contact details with us.
- Microsoft Entra ID, which signs you in. It shares your name, email address, and organization, as your settings allow.
- Intuit QuickBooks, which confirms invoice payments.
- AI providers, which return results when you use an AI feature.
What Sage Studio pulls from connected tools
Your organization can connect tools to Sage Studio so it can create content and keep it up to date. Sage Studio pulls only what the permissions you grant allow:
- GitHub: repository contents, commit messages, pull requests, issues, and release notes, plus the names, usernames, and email addresses of contributors that appear in them.
- Microsoft 365: files, documents, and form responses you choose to connect from SharePoint, OneDrive, Teams, and Forms, plus the names and contact details that appear in them.
- Website crawl: the public web pages at addresses you choose.
Everything pulled from a connected tool is customer content. You can disconnect a tool at any time, and Sage Studio will stop pulling new material from it.
Please don’t send us sensitive information
We don’t ask for, and you shouldn’t submit, any of the following: health information, biometric or genetic data, government ID numbers, financial account numbers, precise location, or information about race or ethnicity, religion or beliefs, political opinions, sexual orientation, or union membership.
3. How we use it
The table below shows what we use your information for. For people in the European Union, United Kingdom, and Switzerland, the law requires us to state a “legal basis” for each use. Here is what each basis means:
- Contract: we need the information to provide what you or your organization signed up for.
- Legitimate interest: we have a reasonable business need that doesn’t override your rights.
- Consent: you said yes, and you can take it back at any time.
- Legal obligation: the law requires it.
| What we do | Information we use | Legal basis |
|---|---|---|
| Set up and run your account and our services | Account details, usage data, customer content | Contract; legitimate interest |
| Pull material from connected tools to create and update content | Customer content | Contract; your organization’s instructions |
| Send invoices and take payments | Billing details | Contract; legal obligation |
| Deliver training, courses, and recordings | Training details, recordings | Contract; consent for recording |
| Do consulting and AI build projects | Project details, customer content | Contract; legitimate interest |
| Answer questions and send service messages | Contact details, messages | Contract; legitimate interest |
| Keep our services secure and prevent fraud and abuse | Account details, usage data, logs | Legitimate interest; legal obligation |
| Understand how our services are used and improve them | Usage data, de-identified data | Legitimate interest; consent for non-essential cookies |
| Improve the algorithms that prepare content for AI (see below) | Usage data and derived signals from all customers; your organization’s content, only for your organization | Legitimate interest; contract |
| Send marketing emails | Contact details, your preferences | Consent where required; otherwise legitimate interest |
| Run AI features you choose to use (Section 5) | What you submit to the AI feature | Contract |
| Follow the law and protect our legal rights | Any of the above, as needed | Legal obligation; legitimate interest |
How we use data to improve our AI features
Sage Studio gets better by learning what works. Here are the firm limits on how we do that.
What we never do
- We never let AI providers train their models on your data.
- We never train or fine-tune generative AI or foundation models on customer content.
- We never use raw customer content in any model shared across customers, and we never show one customer’s content to another.
What we learn from across all customers
We use usage data and derived signals to improve our own algorithms, such as the ones that decide what to send to an AI model and how to score content. Derived signals are de-identified, combined measurements: how often content is edited or accepted, the type and impact score of a product change, token cost, and quality scores. Derived signals never include content text, code, names, or other identifiers.
What we learn from your content, only for you
Your organization’s content may be used to tune algorithms that serve only your organization. Those algorithms are never used for any other customer.
De-identified data. We may combine or strip information so it no longer identifies anyone, including the derived signals described above, and use it to improve our services. We won’t try to re-identify it.
Taking back consent. Where we rely on your consent, you can withdraw it at any time. Withdrawing doesn’t affect anything we did before.
4. Who processes it
We don’t sell your information for money. We disclose it only in the ways listed below.
- Service providers. These companies do work for us: hosting (Microsoft Azure), sign-in (Microsoft Entra ID), email (Microsoft 365 and Resend), video meetings (Microsoft Teams), invoicing (Intuit QuickBooks), analytics (Google Analytics and Microsoft Clarity), and AI processing (see Section 5). Our contracts limit them to using your information only to provide services to us. Contact us for the full, current list.
- Systems we run ourselves. Our scheduling, calendar, video meetings (Nextcloud), and customer relationship management system run on our own server in Arizona. No outside company hosts that information.
- Your organization. If you use Sage Studio through your organization’s account, its administrators can see your account and the content in that workspace.
- Legal reasons. We may disclose information when the law requires it, or to protect people, our services, or our legal rights.
- If our business changes hands. If we merge, are acquired, or sell part of the business, information may transfer to the new owner. The new owner must honor this policy, and we will tell you before your information becomes subject to a different policy.
- With your permission. We may disclose information in other ways when you ask us to or agree.
5. AI features
Who runs the AI. We don’t build our own AI models. AI features in our services run on models from Anthropic (Claude), OpenAI, Google (Gemini), and Typesafe AI (Jev).
AI features are optional and labeled. You choose when to use them.
What gets sent. When you use an AI feature, we send the AI provider only what that request needs: the text or material you select, your instruction, and the related settings. Our agreements with these providers don’t allow them to train their models on what we send. A provider may keep inputs and outputs for a short time for safety, abuse monitoring, or legal reasons, as its terms allow.
Your own AI account. If you connect your own AI provider account, for example by entering your own API key, your content goes to that provider at your direction. Your agreement with that provider, not this policy, controls what it does with your content, including whether it trains on it.
AI in our projects and our own work. On consulting and AI build projects, our contract with your organization controls which AI providers we use. We also use AI tools in our own work, such as drafting documents and summarizing meetings, under the same rule: providers don’t train on what we send.
How we improve our AI features. Section 3 explains what we learn from usage data and derived signals, and the limits we never cross.
AI can be wrong. Review AI results before you publish or rely on them. We don’t use AI or other automated tools to make decisions about people that have legal or similarly significant effects.
Before you add personal information to an AI feature, make sure that’s allowed under your organization’s policies and the law.
6. Cookies and your choices
Cookies are small files a website stores in your browser. We also use similar tools, such as tags. Here is what we use:
| Type | What it does | Where | Tools |
|---|---|---|---|
| Strictly necessary | Signs you in and keeps our services secure. Always on. | Website and app | Our own |
| Functional | Remembers your settings | Website and app | Our own |
| Analytics | Shows us how people use our services | Website and app | Google Analytics |
| Visit replays | Records how visitors move, click, and scroll so we can improve pages. Text typed into forms is hidden. | Website only | Microsoft Clarity |
Our emails may also tell us whether they were opened or a link was clicked.
Your choices.
- European Union, United Kingdom, and Switzerland: we use only strictly necessary cookies until you say yes to others.
- Everyone: you can change your choices at any time with the button below or in your browser settings. If you block strictly necessary cookies, parts of our services may not work.
7. How long we keep it
We keep information only as long as we need it for the reasons in this policy, or longer when the law requires it (for example, for taxes or legal claims).
| Information | How long |
|---|---|
| Customer content, including material from connected tools | As set in our contract with your organization |
| Recordings of trainings and meetings | Deleted 6 months after the session, unless a contract says otherwise |
| Billing records | As long as tax and accounting rules require |
| Everything else | Until we no longer need it for the reasons in Section 3 |
To set these periods, we weigh how sensitive the information is, the risk if it were misused, why we have it, and what the law requires. When we no longer need information, we delete it or remove anything that identifies you. If it sits in a backup we can’t delete right away, we keep it from being used until it’s gone.
8. How we protect it
We protect information with encryption while it moves and while it’s stored, and we limit access to the people who need it for their work. No system is perfectly secure, so we can’t guarantee absolute security.
If a security incident affects your information, we will notify you, your organization, and regulators as the law requires, including Arizona’s data breach law (A.R.S. § 18-551 and following).
9. Your rights
Depending on where you live, you can ask us to:
- see the information we have about you
- correct information that’s wrong
- delete your information
- give you a copy in a format you can take elsewhere
- limit or stop certain uses
- withdraw consent you gave us
- stop selling or sharing your information and stop targeted advertising
How to ask. Email legal@sagecraft.net. We’ll confirm it’s really you before we act, usually by checking the name and email on your account. A request you make while signed in counts as confirmed for that account. You can have someone else make a request for you; we may ask for proof that you authorized them and confirm your identity with you directly. We use what you give us in a request only to handle that request. We’ll respond within the time the law requires, and we’ll tell you if we need more time.
If we say no, you can appeal by replying to our answer with “Appeal” in the subject line. We’ll tell you the result and, where the law provides, how to contact your state attorney general or other regulator.
No penalty. We won’t deny you service, charge you more, or give you worse service for using your rights.
Customer content. If your request is about customer content, we’ll pass it to the organization that controls it and help them respond.
Limits. We may keep some information after a deletion request when we need it to finish a transaction, follow the law, resolve disputes, prevent fraud, or enforce our agreements.
If you’re in the European Union, United Kingdom, or Switzerland
- Section 3 lists the legal basis for each use.
- When we rely on legitimate interest, you can object on grounds relating to your situation. We’ll stop unless we have compelling grounds that override your interests or we need the information for legal claims.
- You can object to marketing at any time, and we’ll stop.
- You can complain to the data protection authority where you live or work. We’d appreciate the chance to fix it first, so please contact us.
If you’re in a U.S. state with a privacy law (including California)
This part applies to the extent those laws apply to us. In the last 12 months, we collected the categories below, from the sources and for the reasons described above, and disclosed each one to the recipients in Section 4.
| Category | Examples | Sold or shared? |
|---|---|---|
| Identifiers | Name, email, phone, IP address, account ID, cookie and device IDs | No |
| Customer records | Billing contact, address, invoices | No |
| Commercial information | Services, courses, and subscriptions purchased | No |
| Internet activity | Usage data, including website visit replays | No |
| Audio and video | Recordings of trainings and meetings | No |
| Professional information | Job title and organization | No |
| Sensitive information | Login details, used only to keep your account secure | No |
- We don’t sell or share personal information.
- We don’t knowingly sell or share information about anyone under 16.
- We don’t use information to profile people in ways that have legal or similarly significant effects.
- You have the right to know what categories and specific pieces of information we collect, where they come from, why we use them, and who receives them.
- California “Shine the Light”: we don’t give personal information to other companies for their own direct marketing.
10. International transfers
Sagecraft is based in the United States. We process information in the United States, in Canada (where part of Sage Studio is hosted), and in other countries where our service providers operate.
When we move information out of the European Union, United Kingdom, or Switzerland to a country without equivalent privacy protection, we use an approved safeguard. These include the European Commission’s Standard Contractual Clauses, the UK Addendum, or a recipient’s certification under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions. Contact us for a copy.
11. Children
Our services are not for children. You must be 18 or older to create an account or buy from us. We don’t knowingly collect information from anyone under 18. If we learn we have, we’ll delete it. If you think we have, email legal@sagecraft.net.
12. Changes to this policy
We may update this policy. When we do, we’ll post it here with a new effective date. If we make an important change, we’ll tell you before it takes effect, by email or with a clear notice in our services, and we’ll ask for your consent where the law requires it.
13. Contact
Questions, requests, or complaints:
Grand Adventures LLC, doing business as Sagecraft
7811 E Beryl Ave
Scottsdale, AZ 85258, USA
legal@sagecraft.net
Please give us enough detail to understand and respond to your request.