Enterprise Privacy Policy

1. Institutional Data Collection

Golden Door Asset LLC ("Golden Door Asset", "we", "us", or "our"), 572 Broad St, Newark, NJ 07102, operates as a specialized enterprise software and A.I. consultancy. We collect data necessary to secure institutional access, deliver implementation roadmaps, and fulfill our advisory mandates.

• Identity & Corporate Data: Professional title, firm name, institutional verified email, and contact information submitted via our lead forms and advisory applications.
• Implementation Data: Infrastructure audits, current CRM configurations, and workflow documentation provided explicitly during the advisory scoping process.
• Telemetry Data: Granular usage patterns across our website to optimize the delivery of our Agentic Pipeline Blueprint and other technical resources.

2. A.I. & Large Language Model (LLM) Processing

As an A.I. implementation firm, we adhere to the strictest standards of data sovereignty when designing pipelines for our clients.

Important: Any proprietary corporate data, client lists, or internal workflows provided during an advisory engagement are processed strictly within ring-fenced, Zero-Trust cloud environments. We do not use your private corporate data to train public foundational models (such as Gemini or ChatGPT).

3. Use & Distribution of Intelligence

We utilize the collected data strictly to:

• Deliver requested blueprints, workflows, and architectural documentation.
• Communicate regarding A.I. advisory roadmaps and implementation services.
• Monitor platform stability and optimize our website architecture.

We do not sell personal data for money. We do use advertising and analytics tools (LinkedIn and Google) that receive device and usage data so we can measure campaigns and site performance. Visitors in the EU, EEA, United Kingdom, and Switzerland receive those tools only after they opt in through Cookie settings.

4. Cookies and tracking

Visitors in the EU, EEA, United Kingdom, and Switzerland see a cookie banner. Until they accept, we do not load Google Tag Manager, Google Analytics, or the LinkedIn Insight Tag, and we do not set campaign or click-ID cookies. Other visitors see no banner; those tools load as they do today. You can change or withdraw consent at any time with the Cookie settings link in the footer.

5. Attribution

When you arrive with campaign tags (UTM parameters) or Google click IDs in the URL, we store those values in first-party cookies for 30 days — after analytics or marketing consent in the EU/UK/Switzerland, and automatically elsewhere. If you create an account or submit a form, we save the campaign tags and the page you were on to your contact record so we can understand which channels bring clients.

6. Processors and third parties

We use the following processors and third parties. Each receives only what is needed to provide the listed service.

• Google Analytics and Google Tag Manager. Receive page URLs, events, device and browser data, and (when marketing is allowed) hashed contact data submitted on the grader, playbook, and checkout forms via Google's user_data setting. Advertising measurement may also call Google Ads / DoubleClick endpoints.
• LinkedIn Insight Tag. Receives device and usage data used for LinkedIn ads conversion and audience measurement.
• Vercel. Hosts this website and collects cookieless Web Analytics (page views, no advertising cookie).
• Supabase. Stores accounts, contact records, and application data. Issues strictly necessary sb-* authentication cookies when you sign in.
• Resend. Sends transactional email (for example signup confirmation and playbook delivery) to the address you submit.
• Stripe. Processes payments for paid assessments and licenses. Stripe receives the payment details you enter on Checkout and related receipt data. Stripe may set its own cookies on stripe.com during Checkout.

7. Cryptographic Security Standards

We implement institutional-grade security architectures aligned with SOC 2 Type II principles. This includes TLS 1.3 end-to-end encryption for data in transit, AES-256 encryption for data at rest, zero-trust infrastructure access, and strict identity verification protocols for all advisory engagements.

8. EU, UK, and Swiss specifics

Where GDPR, the UK GDPR, or Swiss data-protection law applies, we rely on these legal bases:

• Consent for analytics and marketing cookies and the advertising tags described above. You can withdraw consent at any time through Cookie settings in the footer. Withdrawal does not affect processing that already occurred.
• Contract when you create an account or we deliver a paid assessment, license, or advisory engagement you requested.
• Legitimate interests for handling professional B2B contact details submitted to us (responding to inquiries, keeping a business contact record, and administering the relationship), balanced against your rights.

Our operations and several processors (including Google, LinkedIn, Vercel, Supabase, Resend, and Stripe) are located in, or may access data from, the United States. That is an international transfer. Those providers publish their own transfer mechanisms (for example Standard Contractual Clauses).

You may request access, correction, deletion, restriction, or portability of your personal data, and you may object to processing based on legitimate interests. You also have the right to lodge a complaint with a supervisory authority in your country of residence or work (for example the ICO in the United Kingdom, or your EU member-state authority).

9. Geographic Compliance & Rights

Subject to specific jurisdictional regulations (e.g., GDPR, CCPA), you reserve the right to audit, extract, or request the complete deletion of your personal telemetry and submitted contact data.