Privacy Policy

Last updated: November 12, 2026

This policy explains what information F2 Site Services ("F2," "we") handles, why, who else handles it, how long we keep it, and what you can ask us to do. If you are a client with a signed agreement, that agreement also applies, and it controls where the two differ.

The short version

• Your data never trains any AI model. Not ours, and not our AI provider's.
• We never sell your information or share it for marketing.
• We see only the mailbox and calendar you connect, the folder you share, and what you send us.
• We never send email from your account. Every reply is a draft for you to send.
• When you leave, we delete everything we hold for your company within 7 days and confirm it in writing.
• What we don't control: your own Google account, and the copy our AI provider keeps for up to 30 days under its own policy (longer only if its safety systems flag it).

1. What we access, and why

We don't access other mailboxes, calendars or folders in your company.

People at F2 don't read your email except (a) when you approve it in writing for a specific occasion, such as fixing a problem, or (b) when the law requires it. Each time, we log the access and send you the log. F2 people do open the files you deliberately send us (plans, price lists, paperwork) to do and check that work, and for no other reason.

2. Google data

F2's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You own the Google connection: it runs through an app in your own Google Workspace, and you can switch it off at any time in your Google settings. It uses only these permissions:

• gmail.readonly: to read your mail.
• gmail.compose: to create drafts. Google has no drafts-only permission, so this one technically also allows sending. Our software has no send function and refuses to send from your account.
• gmail.labels: to create F2's own labels.
• calendar.events.readonly: to read your calendar events.
• Your shared folder is reached by ordinary Google Drive sharing, not through an extra app permission.

We use Google data only to provide the features you see and use. We never sell it, never use it for advertising, and never use it to train AI.

3. How we use AI

• One AI provider: Anthropic's Claude, through Anthropic's business API. Anthropic is a US company. We use no other AI provider or model.
• Never used to train AI. Under Anthropic's business terms, Anthropic does not train its models on this data.
• Anthropic's retention. Under Anthropic's published policy (as of October 2026), it keeps AI inputs and outputs for up to 30 days, and longer only for content its safety systems flag. That is outside our control. We re-check these terms periodically and will update this page if they change.
• What goes to the AI, and what never does. Only the text of your email (attachments left out) and the files you deliberately send us for a job. W-9s and other documents with Social Security or taxpayer ID numbers are never sent to the AI. Before email text goes to the AI, our software also tries to remove Social Security numbers, EINs and card numbers. That is a safety net, not a guarantee.
• AI can make mistakes, so every draft, count and quote is for you to check. See our Terms, Section 3.

4. Where your data lives

• Your email, calendar and documents stay in your own Google account. Your lasting documents are kept in a private folder in your own Drive, for your company only.
• Your assistant runs on F2's cloud server in the United States, in a separate space for your company only. It holds its notes, trackers, chat history and short-term working copies of files.
• Tax forms (W-9s) are never sent to the AI. They are filed to your folder and not kept in our email longer than needed.
• Backups: our hosting provider's backups are turned off for client servers.

5. Who else handles it

We'll tell clients by email before we add or replace a company that handles client data. We never sell your information or share it for marketing.

6. How long we keep it

• Email: we don't keep full copies of your email. Message IDs, short summaries and draft IDs are kept only as long as needed to do the work, and deleted within 7 days after you leave.
• Working copies of documents: kept only as long as needed to do the work, and deleted within 7 days after you leave. Your lasting copies are in your folder.
• Your assistant's notes, trackers and chat history: while you're a client, so your assistant can do its job.
• Logs: our server logs don't contain email, document or chat content. They are kept only as long as needed to do the work, and deleted within 7 days after you leave.
• When you leave: we delete everything we hold for your company within 7 days and confirm it in writing. This doesn't cover what stays in your own Google account (which you control), or what Anthropic keeps under section 3.

7. Information about other people

Your mailbox and documents include information about your customers, employees, subs and vendors, including W-9s with taxpayer ID numbers. We handle that information only as your service provider, to do your work. You decide what, if anything, to tell those people, and you are responsible for any notice the law requires you to give. If one of them asks us about their information, we refer the request to you.

8. Your choices

• Export: you can ask for a copy of what we hold for you at any time, including your assistant's notes, records, files and chat history. It goes to your own Google Drive.
• Deletion: you can ask us to delete your data at any time.
• Switch it off: you can disconnect your mailbox, calendar and folder at any time in your Google settings. Access stops promptly, normally within minutes.
• Confidentiality agreement: we'll sign one on request.

Email cole@f2siteservices.net for any of these.

9. Security

The steps we take today:

• Our server is private. It can only be reached over a private network, not the public internet.
• F2 accounts use two-step sign-in.
• Each client has a separate, isolated assistant setup.
• Your assistant has no permission to send email.
• Our logs don't contain email content.
• There are no hosting-provider backups of client data.

We hold no security certification, and no system is perfectly secure.

If we discover that client data in our control has been, or is reasonably believed to have been, accessed by someone who shouldn't have it, we'll tell the affected client within 72 hours of discovering it, say what we know, and help with any notices the law requires (in Virginia, Va. Code § 18.2-186.6).

10. Website visitors

• Contact form: what you type is emailed to Cole through our email provider, Resend. We use it only to answer you.
• Cookies and tracking: we don't use advertising cookies or tracking pixels.
• Our emails: every marketing email from us includes an unsubscribe link. You can also reply "unsubscribe" and we'll stop.

11. Children

F2 serves businesses and is not meant for children. We don't knowingly collect information from anyone under 13.

12. Virginia law

F2 serves businesses. We mean every statement in this policy, and we'll honor reasonable requests to see, correct or delete your information. When the information is in a client's records (for example, a client's customer), we refer the request to that client (Section 7).

13. Changes and contact

We'll post changes here with a new "Last updated" date, and email clients before any change that affects their data.

Questions: cole@f2siteservices.net · (540) 270-4541