Olivier GIRAUDO Consulting

Privacy Policy

Effective Date: August 1, 2026

Last updated: August 6, 2026

We may update this policy from time to time as our practices and services evolve. If you have questions, please contact us.

Olivier GIRAUDO Consulting LLC (“OGC,” “we,” “us,” or “our”) operates OGC Client Navigator (the “Platform”), an internal tool used by our consultants to run client discovery calls, score business health, generate roadmaps, and deliver reports to clients of Olivier GIRAUDO Consulting.

This Privacy Policy explains what information the Platform collects, how it’s used, and the choices available. The Platform has two types of account: OGC consultants, whether engaged as employees or independent contractors (“Team Members”), use the full internal tool; and the clients we serve (“Clients”) may be invited by their consultant to a separate, restricted client portal account (email and password, with password reset available) where they can view their business health report, roadmap, and Deep Dive results, message their consultant, and submit feedback or complaints. A Client portal account does not provide access to the internal Team Member tool, other clients’ data, the strategy library, or any administrative features. This policy also explains how we handle information submitted through our public website contact form and our self-serve check-in and Deep Dive pages.

1. Information We Collect

  • Team Member account information: name, email address, password (handled by our authentication provider, Supabase), account approval status, and handbook acknowledgment records.
  • Client portal account information: when a consultant invites a client to the client portal, we create an account containing the client’s email address and a password (handled by our authentication provider, Supabase), plus portal activity records such as a first-login timestamp.
  • Client information entered by consultants: business name, contact name, email, phone number, business address, industry, a free-text business-goal note the consultant may record about the client, and free-text answers given during discovery calls.
  • Public contact form submissions: name, email, phone number, and message submitted through the contact form on our marketing website, along with whether the visitor checked the disclaimer-agreement checkbox and which version of the disclaimer text was shown. Consent is recorded exactly as the visitor left it — a submission made without checking the box is stored as not accepted, never silently changed to agreed.
  • Self-serve check-in and Deep Dive answers: answers submitted directly by a visitor or client through our free 15-minute business check-in and paid Deep Dive pages, including free-text answers, industry/business category, annual revenue range, referral source (how they heard about OGC), and post-report satisfaction/NPS feedback.
  • Complaints, feedback, and support records: case number, category, message thread, status, and resolution notes for complaints, feedback, and support cases submitted through the Platform.
  • Call recordings and transcripts: client calls are recorded to the Zoom cloud with an audio transcript. Those transcripts are imported into and stored within the Platform, where they are used to auto-fill discovery answers and build assessments and roadmaps.
  • Assessment data: scores derived from discovery answers, computed business-health scores and roadmap assignments, notes, and (optionally) AI-generated scoring rationale.
  • Engagement and roadmap data: action items, statuses, owners, due dates, notes, time logs, communication logs, and feedback logs related to implementation work.
  • Consultant email connection details: OGC purchases and provides each consultant with a full business email account (username@giraudoconsulting.com) and complete login credentials. Consultants use this account for all client communication — whether through an email client such as Outlook or webmail, or by connecting it within the Platform to send client reports. We store the SMTP host, port, username, and an encrypted copy of the password used for that Platform connection in a secured secrets vault. We do not store this password in plain text, and it is never displayed back to the consultant after it’s saved.
  • Report links: when a report is generated for a client, we create a unique, hard-to-guess link. Anyone with that link can view the report and download it as a PDF, without logging in, so it should be treated as sensitive — see Section 6.
  • Automatically collected information: basic usage analytics (such as page views and visit counts) may be collected by our hosting provider, Lovable, to help us understand how the Platform is used. Beyond that minimal, non-advertising hosting analytics, the Platform does not use third-party advertising or tracking cookies, and there is no separate cookie-consent banner today because none is needed for what is actually collected.

2. How We Use Information

  • To operate the Platform: run discovery calls, calculate scores, generate 30/60/90-day roadmaps, and produce client reports.
  • To deliver reports: send report links and PDF reports to clients on a consultant’s behalf, from that consultant’s connected email address.
  • To manage accounts: approve new consultant accounts, track handbook acknowledgment, and maintain audit records of consent given on client calls.
  • To improve the Platform: understand usage patterns and fix problems.
  • To assist scoring: when enabled, client discovery answers may be sent to a third-party AI service to suggest a numeric score and short rationale; a human consultant always reviews and can override any AI suggestion before it’s saved.
  • To analyze call transcripts: imported call transcripts are analyzed by AI to draft and summarize the client’s answers, rank priority business areas, and pre-fill Deep Dive answers. These outputs are drafts only and are always subject to human consultant review before anything is finalized, scored, or delivered to a client.

3. How We Share Information

We do not sell client or Team Member information.

We share information with the following categories of service providers, only as needed to operate the Platform:

  • Database, authentication, and file storage: Supabase.
  • Application hosting: Lovable.
  • AI-assisted scoring (optional, human-reviewed): processed through Lovable’s AI gateway, which may route requests to third-party AI model providers.
  • Email delivery: when a consultant sends a report, it is delivered through that consultant’s OGC-issued business email account, not a shared OGC mailbox. Automated replies to public contact form submissions are sent through an OGC-connected business mailbox using the same encrypted-credentials approach.
  • Contact form processing: messages submitted through the public contact form are classified by AI (through Lovable’s AI gateway) to categorize the inquiry and flag urgent ones, so the right staff member can respond. The message content is processed for that purpose and stored as a contact submission record.
  • Call recording and transcription: recordings are made via Zoom cloud recording, which also produces the transcript. Those transcripts are imported into and stored within the Platform and processed through our AI gateway to assist with assessment drafting, always under human review.

We may also disclose information if required by law, or to protect the rights, property, or safety of OGC, our Team Members, or our clients.

4. Data Security

We use industry-standard measures to protect information stored in the Platform, including encrypted storage of consultant email passwords in a dedicated secrets vault, role-based access controls, and restrictions so that consultants can generally only see clients assigned to them (administrators can see all). No method of storage or transmission is perfectly secure, and we cannot guarantee absolute security.

5. Data Retention

We retain client and assessment information for as long as needed to support the ongoing consulting relationship and for a reasonable period afterward for record-keeping purposes. Call transcripts imported into the Platform are retained alongside the client’s assessment records. Team Members can request deletion of specific client records; administrators can review and act on such requests.

6. Report Links Are Sensitive

A client report link allows anyone who has it to view that client’s Action Plans, and download it as a PDF, without signing in. Please do not forward, publicly post, or share a report link with anyone other than the intended client. If you believe a report link has been shared inappropriately, contact us using the information in Section 10 so we can revoke it.

7. Your Choices and Rights

Team Members can review and correct their own account information at any time, and can disconnect their email integration from Settings.

Clients whose information is held in the Platform may contact OGC directly (through our consultant, or using the contact information below) to request access to, correction of, or deletion of their information, subject to our legitimate business and legal record-keeping needs.

8. Children’s Privacy

The Platform is intended for business use by adults and is not directed at children. We do not knowingly collect information from anyone under 18.

9. Changes to This Policy

We may update this policy from time to time. Material changes will be reflected by an updated “Last updated” date at the top of this page.

10. Contact Us

Questions about this Privacy Policy can be directed to: admin@giraudoconsulting.com

Return home