Privacy Policy
1. Overview
This Privacy Policy describes how Mare & Oak, LLC (“Mare & Oak,” “we,” “us,” or “our”) collects, uses, and protects information when you visit mareandoak.com (the “Site”) or use the Contact Flow to initiate a consultation inquiry.
We collect only what is necessary to run the Site and to deliver the consultation experience we describe here. We do not sell your information.
2. Information We Collect
2.1 Information You Provide Directly
When you use the Contact Flow on the Site, you may submit:
- Name — used to personalize your consultation record and calendar invitation.
- Email address — used to confirm your booking and as the primary identifier for your contact record in our CRM.
- Business challenge description — the free-text description you enter in the Intake Form. This becomes the starting context for the Intake Agent conversation.
Submission of this information is voluntary. You may leave the Site at any time without submitting anything.
2.2 Intake Agent Conversation Data
After Intake Form submission, you may interact with the Intake Agent — a large language model (AI) powered conversational assistant that asks clarifying questions about your submission. The full text of this conversation is retained as part of your consultation record.
The Intake Agent runs on Azure AI Foundry, Microsoft’s managed AI inference platform. Conversation data is processed within our Azure subscription and does not leave it to reach any third-party AI provider. See Section 4 for how this data is used.
2.3 Context Summary
At the end of the Intake Agent conversation (or immediately after the Intake Form if you skip the agent), the Site generates a human-readable Context Summary — a structured distillation of your Intake Form answers and agent conversation. You may review and edit this summary before submitting it. The version you submit is the version that is stored and shared.
The Context Summary is stored verbatim in your HubSpot appointment record (see Section 5) and used to generate a Structured Agenda for your calendar invitation.
2.4 Booking Data
When you select a calendar slot and confirm a booking through the Site, we collect:
- The selected date and time of your consultation.
- A Structured Agenda generated by an additional AI inference call that combines your Context Summary with standard agenda templates. This agenda is written into your Google Calendar invitation.
2.5 Cookies and Automatic Data Collection
When you visit the Site, we automatically collect technical information through cookies and similar technologies. See Section 6 for a full description of each cookie category and how to manage your preferences.
Automatic collection may include: IP address (truncated), browser type, operating system, referring URL, pages viewed, and session interaction patterns.
3. Why We Collect This Information
| Information | Purpose |
|---|---|
| Name, email address | Create your contact record; send your calendar invitation; identify you if you return |
| Business challenge description | Provide context to the Intake Agent; generate your Context Summary |
| Intake Agent conversation | Produce an accurate Context Summary; improve Intake Agent performance over time (in de-identified form only) |
| Context Summary | Populate your HubSpot appointment record; generate your meeting’s Structured Agenda |
| Calendar booking details | Create the Google Calendar event and send your invitation |
| Analytics and session data | Understand how visitors use the Site so we can improve it |
We do not use any personal information for automated profiling or decisions that have legal or significant effects on you.
4. How We Use Your Information
To deliver the consultation experience. Name, email, conversation data, Context Summary, and booking details are used solely to complete your consultation booking and to ensure Mare & Oak’s principal has the context needed for a productive first conversation.
To maintain our CRM. Your name, email, and Context Summary are stored in HubSpot as a Contact and an associated Appointment record. This allows us to track consultation history and manage the lead relationship over time.
To improve the Intake Agent. Conversation data may be used in aggregated or de-identified form to evaluate and improve Intake Agent performance. It will not be used to train external AI models, and it will not be shared with third parties in identifiable form.
To operate and improve the Site. Analytics and session data are used in aggregate to understand which pages and features are working well and to prioritize improvements.
5. Third-Party Services
To deliver the Site and Contact Flow, we rely on the following third-party services. Each receives only the data necessary for its role:
| Service | What they receive | Why |
|---|---|---|
| Microsoft Azure (Static Web App + Functions + AI Foundry) | Site traffic; Intake Agent conversation data; Contact Summary | Hosts the Site and powers the Intake Agent inference. Conversation data is processed within the Azure subscription and does not leave it. |
| HubSpot | Name, email, Context Summary | CRM — creates your Contact and Appointment records. |
| Google Calendar | Booking date/time, Structured Agenda | Creates the calendar event and sends the meeting invitation. |
| Google Analytics | Anonymized session and traffic data | Measures Site usage in aggregate. |
| Microsoft Clarity | Session interaction recordings and heatmaps | Measures Site usability in aggregate. |
Mare & Oak is not responsible for the privacy practices of these services. We encourage you to review their privacy policies:
- Microsoft: privacy.microsoft.com
- HubSpot: legal.hubspot.com/privacy-policy
- Google: policies.google.com/privacy
6. Cookies and Tracking Technologies
The Site uses cookies in the following categories:
- Necessary cookies — Required for baseline Site operation and to store your cookie consent preferences. These cannot be disabled.
- Functional cookies — Support richer site experiences, including Contact Flow continuity between sessions.
- Analytics cookies — Used by Google Analytics and Microsoft Clarity to measure Site traffic and session behavior in aggregate. Data is processed by Google and Microsoft respectively.
- Performance cookies — Monitor page load behavior and responsiveness metrics.
- Advertisement cookies — Used for campaign attribution and advertising measurement.
You may adjust your preferences at any time using the Cookie Preferences control in the Site footer. Disabling analytics or performance cookies will not affect the core functionality of the Site or your ability to complete a consultation booking.
7. Data Retention
| Data | Retention approach |
|---|---|
| CRM Contact and Appointment records (HubSpot) | Retained indefinitely as part of our business records unless you request deletion |
| Calendar events (Google Calendar) | Retained for the duration of the event; subject to Google Calendar’s standard deletion behavior |
| Intake Agent conversation logs | Retained in Azure for a rolling 90-day period for diagnostic purposes, then deleted |
| Analytics and session data | Processed and aggregated by Google and Microsoft per their respective data retention policies |
8. Your Rights and Choices
Access and correction. You may request a copy of the personal information we hold about you, or ask us to correct inaccurate information, by emailing us at the address in Section 10.
Deletion. You may request that we delete your consultation record, including any HubSpot Contact and Appointment data we hold. We will honor deletion requests to the extent technically feasible. Note that calendar events already confirmed cannot be retroactively removed from Google Calendar.
Cookie preferences. You may withdraw or change your cookie consent at any time using the Cookie Preferences control in the Site footer.
Marketing. We do not send marketing emails unless you explicitly opt in. If you have opted in and wish to unsubscribe, follow the unsubscribe link in any email or contact us directly.
9. Security
We protect your information through:
- Transport security — All Site traffic is served over HTTPS.
- Credential management — API keys and service credentials (HubSpot, Google Calendar, Azure AI Foundry) are stored in Azure Key Vault and accessed by the Azure Function via managed identity. They are never embedded in code or exposed to the browser.
- Least-privilege tool surface — The Intake Agent has access to exactly two external tools: checking calendar availability and creating a booking. It cannot access, modify, or delete any other data.
No transmission over the internet is completely secure. We cannot guarantee absolute security, but we take commercially reasonable steps to protect your information.
10. Contact
If you have questions about this Privacy Policy, would like to exercise your data rights, or wish to report a concern, please contact us:
Mare & Oak, LLC
hello@mareandoak.com
We aim to respond to all privacy inquiries within 10 business days.
11. Changes to This Policy
We may update this Privacy Policy from time to time. The revised policy will be posted on this page with an updated effective date. Continued use of the Site after an update constitutes acceptance of the revised policy. If the change is material, we will make reasonable efforts to notify affected users.