Privacy Policy

This policy describes how Stones AI handles information from visitors to stonesai.com. We update it when our practices change. For specific questions, email us at the address below.

1. Who we are

Stones AI is a Texas-based company. The data controller for personal information collected via stonesai.com is Stones AI. This policy covers stonesai.com only. Our product VTTD has its own privacy policy at vttd.tech/privacy.

For privacy questions, contact privacy@stonesai.com.

2. Information we collect

stonesai.com does not have a contact form. When you email us, we receive whatever you choose to send and we keep what's needed to respond. We do not capture or store form-style submissions on the site itself.

We do not currently run analytics on stonesai.com. No first-party tracking pixels, no session replay, no third-party trackers. Standard infrastructure logs (CloudFront access logs) may include IP address and user-agent for the operational purposes described in section 4.

When we add analytics, we will list the specific tool, lawful basis, and retention period in this section before turning it on. See issue #31 for the upcoming counsel review.

3. How we use information

We use what we collect to operate and improve the website, respond to your inquiries, and inform decisions about what to build next. We do not sell personal information. We do not stitch visitor identity across stonesai.com and vttd.tech.

4. Lawful basis for processing

For visitors in the EU, UK, or other jurisdictions where the GDPR or a similar privacy law applies, we process personal information on these lawful bases:

• Legitimate interest — responding to inquiries you send us by email, and operating, securing, and debugging stonesai.com (standard infrastructure logs).
• Consent — any future analytics or tracking cookies will be set only after you have given specific, opt-in consent for that purpose. We will not quietly enable tracking and disclose it later.
• Legal obligation — responding to lawful requests from regulators or law enforcement.

5. Sharing and international transfers

We share information only with service providers who help us operate the website (hosting infrastructure; analytics tooling once added) and only to the extent they need it. We may disclose information when required by law or in connection with a business transaction.

stonesai.com is hosted in the United States. If you contact us from the EU, UK, or another jurisdiction, your information will be transferred to and processed in the United States. Where required, we rely on standard contractual clauses (SCCs) or other recognized transfer mechanisms with our service providers.

6. How long we keep information

We keep information only as long as we need it for the purposes in section 3, unless a longer retention is required by law.

• Emails to david@, security@, privacy@, and transparency@stonesai.com are retained for up to 24 months after the last response in the thread, after which we delete or archive per our internal retention schedule.
• Standard infrastructure logs (CloudFront access logs and equivalents) are retained for up to 90 days for security and operational purposes.

7. Your rights

You have rights regarding your personal information. The list below applies in full to visitors in the EU, UK, or California; we apply the same rights to all visitors as a matter of practice.

• Access — request a copy of the personal information we hold about you.
• Rectification — ask us to correct information that is inaccurate or incomplete.
• Erasure — ask us to delete information we hold about you.
• Restriction — ask us to limit how we process your information while we resolve a question.
• Portability — receive your information in a structured, machine-readable format.
• Objection — object to processing based on legitimate interest, including any future direct marketing.
• Withdraw consent — where we process based on consent, you may withdraw it at any time.
• Complaint to a supervisory authority — EU residents may contact the data protection authority in your country; UK residents may contact the Information Commissioner's Office (ICO); California residents may contact the California Privacy Protection Agency (CPPA).

To exercise any of these rights, email privacy@stonesai.com. We respond within 30 days, faster when we can. We may need to verify your identity before acting on a request.

8. Contact

Questions about this policy? Email privacy@stonesai.com.

This policy is current as of May 6, 2026. We're working with counsel on the next revision; substantive changes will be reflected here.