Privacy Policy

1. Who we are

This website is operated by Covington Place Partners LLC ("CPP," "we," "us," "our"), a Missouri limited liability company based in Greater St. Louis.

Contact: shea@covingtonplacepartners.com

2. What this policy covers

This policy covers covingtonplacepartners.com and the CPP Digital Workforce service, including the Digital Workers you connect to your accounts. It does not cover advisory work, which is governed by the separate agreement signed for that engagement.

3. What we collect

Information you provide

• If you submit your email through the "Notify me" or "Subscribe" forms on this site, we collect that email address.
• If you email us directly (including via any "mailto:" link on the site), we receive whatever you send — your address and message content.
• If you are an employee authorized under a signed SMS addendum to communicate with a Digital Worker, we collect your phone number, the content of your text messages, and message timestamps.

We do not currently operate any online booking, checkout, or account system, so we do not collect payment information, passwords, or account credentials through this website.

Information collected automatically

• Standard server and edge logs via our hosting provider, Cloudflare: IP address, user agent, pages visited, referring URL, timestamps.
• Google Analytics 4, once configured — standard site analytics. GA4 sets its own cookies; see Google's cookie policy and privacy policy.
• A NEXT90 measurement tag, once configured — operated by NEXT90 (n90), the firm that built and maintains this site — page visit and engagement data for site analytics. See the NEXT90 privacy policy.

Google Analytics 4 and a NEXT90 measurement tag run on the production site only, and only once configured. They do not run on preview or staging deployments or on localhost.

Cookies

Google Analytics 4 sets its own cookies for site analytics once configured. We do not use advertising or tracking cookies beyond that, and we do not currently run a cookie-consent banner — if that changes, this section will be updated first.

SMS and phone data

Phone numbers and message content collected through the Digital Worker texting service are used only to route your messages to your assigned Digital Worker, maintain the list of numbers authorized to use this service, and provide support. This data is never used for marketing, and we do not sell it. Message transcripts are retained for the duration of your organization's engagement with CPP and deleted within 90 days after that engagement ends, or sooner on request. Standard message and data rates from your carrier may apply.

Connected provider data

If your organization's engagement includes a Digital Worker connected to an account on a provider like Google Workspace or Microsoft 365, we access only what that connection's permissions screen grants — not everything a provider makes available. See what each capability allows for exactly what any given grant does and doesn't permit.

Google Workspace

When you connect a Google account, Google shows the application as "gramatr-platform-auth", with gramatr, LLC as the developer of the Google connection. It is the connection CPP Digital Workforce uses, and it is the same service.

• Gmail — read access, plus the ability to compose: your Digital Worker can draft email on request, and sends it only after your confirming click to approve.
• Calendar — read and write access, so your Digital Worker can view your schedule and create, move, or cancel events.
• Tasks — a dedicated task list for your Digital Worker.
• Contacts — read access, and the ability to save new contacts.
• Drive — full read and write access, to read, create, and edit files.

CPP's use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements (see also Section 6).

Microsoft 365

• Mail — read access, plus the ability to compose: your Digital Worker can draft email on request, and sends it only after your confirming click to approve.
• Calendar — read and write access, so your Digital Worker can view your schedule and create or move events.
• Tasks — a dedicated task list for your Digital Worker.
• Contacts — read access, and the ability to save new contacts.
• Files — full read and write access, to read, create, and edit files.

Our use of Microsoft 365 data is limited to what's described here and in your organization's engagement agreement — we do not use it to train general-purpose models, and we do not use it beyond operating your Digital Worker.

Future providers

As CPP adds support for other connected systems — advertising and analytics platforms, databases, code repositories, and similar — this section gains a parallel subsection for each one, describing exactly what's accessed and why, before that connection is used in any engagement.

The connection token for each provider you connect is stored encrypted within CPP's grāmatr-based platform and used only to operate your Digital Worker. Access remains active until you disconnect it or your engagement ends; the connection and any data retrieved through it are deleted within 90 days after that, or sooner on request. To revoke access directly at the provider: for Google, remove the connection under your Google Account's security settings, in "Third-party apps with account access"; for Microsoft, remove it under My Apps or your Microsoft account's app permissions.

Google user data is encrypted in transit and at rest. Access is limited to the people and systems that need it to provide the service, and is granted with approval and for a limited time.

4. How we use it

• To respond to messages you send us
• To notify you when you've asked to be notified (new content, published research)
• To understand how visitors use the site, so we can improve it
• To operate and secure the website
• To comply with legal obligations

5. How we share it

We do not sell your personal information. We share it only with the vendors that help us run this website:

Vendor	What they do	Where
Cloudflare	Website hosting, CDN, and the email relay that delivers form submissions to us	Global edge, US-based company
Google (GA4)	Website analytics	US/EU
NEXT90 (n90)	Website development and site analytics	US
Twilio, Telegram, Slack	Message delivery for the Digital Worker, where your engagement uses them: text message through Twilio, chat through Telegram or Slack	Per each provider's own infrastructure
gramatr, LLC	Hosts the Digital Worker platform — including database storage and the reasoning and processing it does on your behalf — on its own Microsoft Azure infrastructure, and, for a cloud-hosted engagement, routes requests through its Bifrost layer to a language model (currently GPT 5.6 Luna) to generate responses	Microsoft Azure, East US 2
Microsoft Azure	The cloud infrastructure gramatr's platform runs on, including the language model that processes the content your Digital Worker works on. CPP's relationship with Azure runs through gramatr — CPP does not separately contract with Microsoft	East US 2
Google Workspace	The Google account you connect — accessed only for what you've authorized, to operate your Digital Worker	Per Google's own infrastructure
Microsoft 365	The Microsoft account you connect — accessed only for what you've authorized, to operate your Digital Worker	Per Microsoft's own infrastructure

CPP offers two ways a Digital Worker's AI processing can run, and your engagement agreement states which applies to you:

• Cloud-hosted (the default). When your Digital Worker processes a request, the relevant content from your connected accounts is sent through gramatr's Bifrost layer to a language model hosted on Microsoft Azure — currently GPT 5.6 Luna. Per Microsoft's own data, privacy, and security terms for Azure OpenAI Service, prompts and responses are not used to train, retrain, or improve any Microsoft or third-party model, and are not shared with OpenAI. CPP may change which model it uses as performance needs evolve; this policy describes whichever model is currently in use.
• On-premises. For engagements that require it, inference runs on infrastructure you control instead of CPP's cloud platform. In this mode, no request content leaves your environment to reach gramatr, Microsoft Azure, or any other third-party model host.

CPP personnel do not routinely view the content your Digital Worker processes, under either mode; limited access may occur only when necessary to diagnose a reported issue, with your authorization, where needed for security or to investigate abuse, or where the law requires it. This data is never sold and never used for advertising.

We may also disclose information if required by law, court order, or to protect our rights and safety, or in connection with a merger, acquisition, or sale of assets, with notice where required.

6. Google API Services User Data Policy

CPP's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We do not use Google user data to develop, improve, or train generalized or non-personalized artificial intelligence or machine learning models.

We do not sell Google user data. We do not use it for advertising, including retargeting and interest-based ads. We do not give it to data brokers or information resellers, and we do not use it to determine credit-worthiness or for lending.

7. How long we keep it

Data type	Retention
Waitlist / subscribe form submissions	Delivered directly to our team's inboxes — retained per our normal email records until deleted
Direct emails to us	Retained per our normal email records until deleted
Server logs (Cloudflare)	Per Cloudflare's standard log retention
GA4 data	Per Google Analytics default retention (currently 14 months)
SMS messages / phone numbers	Duration of the engagement, deleted within 90 days after it ends, or sooner on request
Connected provider token & retrieved data (Google Workspace, Microsoft 365, or any future provider)	Duration of the engagement, deleted within 90 days after it ends or you disconnect, or sooner on request

8. Your rights

Covington Place Partners is a small firm and does not meet the size or data-volume thresholds that trigger most U.S. state privacy laws. We honor the following as a matter of practice regardless:

• Access — ask what information we have about you
• Correction — ask us to fix inaccuracies
• Deletion — ask us to delete information we hold about you
• Opt out — unsubscribe from any notification list at any time

To exercise any of these, email shea@covingtonplacepartners.com. We do not sell or share personal information in the sense defined by the CCPA/CPRA.

9. International visitors

We operate from the United States. If you visit this site from outside the U.S., your information will be transferred to and processed in the U.S.

10. Children

This website is not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.

11. Changes to this policy

We may update this policy as the site evolves. When we do, we'll update the "Last updated" date above.

If we change how we use Google user data, we will update this page and let you know.

12. Contact

Questions about this policy: shea@covingtonplacepartners.com

Covington Place Partners LLC · Greater St. Louis, Missouri, USA

Related: Terms of Service · Digital Worker Capabilities · SMS Addendum