← Back to home
Legal

Privacy Policy

Effective date: July 18, 2026

This Privacy Policy explains how H2 Consulting Group (“H2 Consulting Group,” “we,” “us”) handles information in connection with the SpeyAI website at speyai.com (the “Site”) and describes the privacy posture of the SpeyAI software.

1. Scope

This policy covers the SpeyAI marketing and informational website. It does not cover data processed inside a deployed SpeyAI instance. SpeyAI is self-hosted software: customers run it within their own infrastructure. H2 Consulting Group does not host customer instances and does not receive, store, or process the data that flows through a customer’s deployment. Where SpeyAI is distributed through a value-added reseller (“VAR”) partner, the customer’s agreement with that partner and the customer’s own privacy notices govern the customer’s deployment.

2. Information we collect through the Site

The Site has two forms. Both send what you type to our server. Neither is required to read anything: every paper in The Record is readable in full without giving us anything.

  • Briefing requests. The briefing request form collects your organization, your role, which briefing you are asking for, what you want the agents to do, and your work email. It also asks, optionally, which cloud, version control and database you would run SpeyAI on. We use it to prepare and send your briefing and to reply to you. It reaches us as an email to a role inbox and we do not write it to a database. An acknowledgement is sent to the address you gave.
  • The Record subscription. The subscribe form on The Record collects one thing: your email address. We use it only to tell you when a new paper publishes. It is held as a contact at our email provider, Brevo, or, where that list is not yet in place, delivered to the same role inbox. We do not send you anything else at that address.
  • Analytics. We use two services to understand how the Site is used, and neither of them stores anything on your device. Vercel Web Analytics is aggregate and cookieless: it sets no cookie and does not identify individual visitors. PostHog records page views and specific interactions, including how far down a page you scroll, which sections come into view, which links and calls to action you click, and how long a page is actually visible. It runs cookieless as well: it sets no cookie and writes nothing to your browser’s local or session storage, so it holds no identifier for you between visits and cannot recognise your browser when you come back. It respects Do Not Track. We do not record sessions, and we do not capture clicks automatically for heatmaps. We never identify you to the analytics provider, and no profile of you is created there, whether or not you fill in a form. What each event does carry is the ordinary information any web request carries: the page you are on, your browser type, and the network address the request arrives from, which the provider may use to derive an approximate location.
  • What a briefing request sends to analytics. When you submit the briefing request form, we record the submission with PostHog: which briefing you asked for, and the cloud, version control and database you named. That record carries a fresh random identifier created for the submission alone, so it is not joined to your browsing on the Site and not joined to you. Your organization, your role, your message and your email address are never sent to the analytics provider. The subscribe form on The Record sends nothing to analytics at all.
  • Server logs. Our hosting provider, Vercel, may record standard technical information (such as IP address, browser type, and pages requested) for security and reliability. Confirm the server-log retention window with the hosting provider.

3. Cookies

The Site sets no analytics cookie. We do not use advertising cookies and we do not use cross-site tracking cookies either. PostHog used to set a first-party cookie so it could recognise a returning browser; it no longer does. It now keeps its identifier in memory for the length of the page you are on, and writes it neither to a cookie nor to your browser’s local or session storage. Vercel Web Analytics has always been cookieless. Nothing else the Site stores in your browser does anything other than make the Site work.

There is no cookie banner on this Site because there is nothing kept on your device to ask you about. Section 7 covers the wider question of which privacy disclosures apply to you.

4. How we use information

We use what you send through the briefing request form to prepare your briefing and to reply to you. We use a subscription address to tell you when a new paper publishes, and for nothing else. We use analytics and server logs to operate and secure the Site and to understand how it is used. We do not sell personal information, we do not use it for advertising, and we do not use it to train AI models.

5. Sharing

We share information only with the service providers that operate the Site on our behalf, under confidentiality obligations, and where required by law. Those providers are Vercel (hosting and server logs), Brevo (sending our email and holding The Record’s subscriber list), Vercel Web Analytics and PostHog (analytics). We do not sell or rent personal information. Keep this list current. Adding or changing a provider that touches Site data changes this section.

6. Data retention

We do not keep a database of form submissions. A briefing request reaches us as email, and we keep that correspondence for as long as needed to respond and for reasonable follow-up, then delete or anonymize it. A subscription address stays on The Record’s list until you unsubscribe or ask us to remove you, which you can do from any email we send or by writing to privacy@speyai.com. Confirm the analytics retention window with the analytics providers, and whether a stated maximum should be published here.

7. Your rights

Depending on your location, you may have rights to access, correct, or delete the personal information you submitted through the Site, or to object to certain processing. To exercise them, contact us at privacy@speyai.com. Confirm whether GDPR / UK GDPR / CCPA-CPRA specific disclosures are required for the Site’s audience.

8. Children

The Site is intended for business users and is not directed to children.

9. Changes

We may update this policy. Material changes will be posted here with a new effective date.

10. Contact

Questions about this policy may be directed to privacy@speyai.com. H2 Consulting Group.