Gomez Jarvis Core System — Privacy Notice

1. Who we are and what this notice covers

Rafiu Olawale Isawu, trading as Prompt Architect HQ, operates Gomez Jarvis Core System (“Gomez”) from the United Kingdom and is the data controller for PAHQ’s use of personal information described here.

Contact hello@promptarchitecthq.com. Rafiu personally monitors this inbox and handles privacy requests, using tools with personal oversight.

This notice covers PAHQ’s Meta Ads and WhatsApp setup, advertising validation and related task, AI-assistance, security and support records. It describes PAHQ’s current operations; it is not a notice for every separate PromptArchitect website feature or a future client-data service.

2. Information we handle

Connections: business, app, ad-account, Page, Instagram and WhatsApp identifiers; business-phone details; names, permissions, connection status, currency and time zone. Credentials are protected separately from ordinary account records.
Advertising work: campaign and related object identifiers, audience settings, placements, budgets, schedules, images, text, destination links, provider responses and status or aggregate reports returned by Meta. The current operations do not supply Gomez with a list of individual ad viewers.
Tasks and support: instructions, relevant excerpts or screenshots, approvals, confirmations, error references, outcomes, duplicate-prevention information and accounting records. Screenshots or other supplied material can contain personal information.
Communication and preferences: contact identifiers and relevant contact-permission records. Where an authorised messaging task is used, its data can include message text, identifiers, timestamps, delivery/read/error information, drafts, follow-ups and supported media. That description does not mean every feature is currently enabled.
Privacy correspondence: your contact details, request, proportionate verification information and our response.

Information comes from the operator, people contacting PAHQ and the connected services used for the task. These categories are not permission to collect unrelated information.

3. Purposes and lawful bases

For the current PAHQ activities, we use personal information where necessary for the following legitimate interests: administering PAHQ’s business connections and advertising work; answering relevant enquiries; providing requested task assistance; investigating actual failures; protecting accounts; preventing duplicate or unauthorised actions; and reconciling uncertain outcomes. We assess necessity, less intrusive options, people’s reasonable expectations and the impact on their rights.

Selected task context may be used for requested AI assistance or necessary support review. We limit it to the task, minimise or redact unrelated information and consider whether the task can be completed without sharing identifiable content.

Where applicable law requires us to handle privacy rights, complaints or specific statutory records, the basis is compliance with that identified legal obligation. A technical accounting entry is not automatically a statutory record.

Founder instructions, Meta permissions and template approvals are not automatically data-protection consent. We do not rely on a contract with PAHQ to justify processing every person’s information. If a separate use requires consent or another basis, it must be established for that use. Consent can be withdrawn where it is the basis. Sensitive information may require additional legal conditions.

Meta receives the account, advertising or messaging information needed for the authorised operation and returns results. Anthropic’s application API may receive selected task context or media when Gomez’s AI assistance is used. Relevant, minimised information may also be supplied to Meta support, ChatGPT Pro/Codex or Claude Pro review services for a particular issue.

PAHQ uses Google Workspace for privacy correspondence at hello@promptarchitecthq.com. Cloudflare Pages hosts these two notices and provides traffic-routing and security. Cloudflare may process IP address, browser information, requested URL and time. PAHQ’s separate main website currently uses Vercel and Cloudflare.

Business processing terms govern covered Google Workspace and Anthropic application API customer data. The individual ChatGPT Pro and Claude Pro review subscriptions are separate products; we do not represent them as covered by those business processing agreements. Providers also process information for purposes described in their own privacy notices.

The model-improvement settings for the review accounts are currently off, including Claude’s setting covering chats and coding sessions. These choices do not establish past settings, erase saved material, provide zero retention or exclude every safety/legal processing exception.

Operational records are held on operator-managed computers. The standalone policy pages contain no analytics script, tracking pixel, embedded AI, sign-in form or deletion form. The separate website and provider services have their own processing.

Information can be processed in the United States and other countries, including through support, hosting and review services. Providers publish contractual transfer safeguards, including standard contractual clauses and UK provisions where applicable, and their privacy notices explain processing for their own purposes. The applicable arrangement depends on the actual service and role; a published safeguard is not proof that every account-specific arrangement or transfer has been individually verified. We do not promise UK-only processing, zero provider retention or a uniform model-training rule.

You can ask us which recipient, contractual or adequacy arrangement and safeguards apply to your information, and how to obtain a copy, with confidential material protected where necessary.

5. Access and security

Gomez separates credentials from ordinary records, limits access by task and account scope, uses approval controls for consequential actions, and checks supported WhatsApp webhook signatures and expected account identifiers. Access is limited to those who need the information for the task. These measures do not make every record anonymous or guarantee that compromise cannot occur.

6. How long information is kept

We have adopted a manual retention schedule. There is no general automatic deletion timer. Adoption does not mean that existing records or copies have already been erased. Disconnecting an integration does not erase them.

We keep information only while necessary for its purpose or an identified legal requirement. Earlier loss of necessity or a valid rights request can require earlier action. Our manual review targets are:

Connections and ordinary contacts: review every 90 days and when the relationship ends; remove unnecessary personal details within 30 days after it ends.
Messages, task context, drafts, media and detailed support material: review monthly and at closure. Remove unnecessary content within 30 days after closure. By 90 days, delete or minimise remaining content, or record a specific continuing need and next review date.
Minimal approvals, outcomes and completed-action evidence: review every six months, with a target of 12 months after closure unless a specific continuing purpose, law or claim justifies longer. Uncertain outcomes are reviewed every 30 days for necessity and minimisation. Internal holds are not blanket exemptions from deletion.
No-contact preferences: retain the minimum needed to avoid unwanted contact, reviewing necessity annually.
Privacy cases: review every six months, with a target of 12 months after closure unless specifically justified. Avoid storing identity-document copies; remove unnecessary verification copies promptly, with a target of no later than 30 days.
Saved task notes: review quarterly and at task closure, removing information when its purpose ends or a relevant rights request requires it.
Statutory records: use the period required by the actual applicable obligation. A technical accounting entry is not automatically a statutory record.

For information retained beyond a target, we record the specific reason, minimum information needed and next review or removal date or objective trigger. A hash or reference is not automatically anonymous.

Relevant copies can include support material, exports, retained earlier versions and backups. We review the copy inventory monthly, but have not established a comprehensive automatic backup-removal cycle or restoration-suppression system. Provider retention also depends on the actual service and agreement. We do not promise a universal 30-day backup overwrite period or instant deletion from every provider or copy.

Where immediate removal is not possible, the response must explain the actual limitation, removal plan and steps to prevent further use or restoration into active use. See the Data Deletion Instructions for requesting a review.

7. Your rights and complaints

Contact hello@promptarchitecthq.com for access, correction, deletion or restriction, or to withdraw consent where used. Withdrawal does not affect earlier lawful consent-based processing.

Objection: you can object to legitimate-interests processing for reasons relating to your situation. It must stop unless compelling overriding grounds or legal claims justify continuing. Objections to direct marketing, including related profiling, must be respected without that balancing test.

Portability: where personal information you provided is processed automatically on the basis of consent or your contract, you can request a structured, commonly used, machine-readable copy and direct transmission where technically feasible. This does not automatically cover every audit field or other people’s information.

Rights depend on the facts and applicable law. Verification will be proportionate. Do not send passwords, access tokens or unnecessary identity documents. We explain the response, any applicable exception and how to challenge it.

Complaints: Rafiu handles privacy complaints at the same address. Our operating target is to acknowledge requests within two working days; this is not an extension of a legal deadline. Complaints covered by UK law must be acknowledged within 30 days, investigated appropriately and answered without undue delay. Rights requests normally require a response within one calendar month, subject to applicable verification and extension rules.

You can complain to the UK Information Commissioner’s Office (ICO) or another competent supervisory authority. Contacting us does not remove your right to complain to the regulator.

Meta integration access can also be managed through Meta’s own controls. Revoking access limits future access but does not automatically erase existing information held by Gomez or Meta.

8. Changes

The effective date is 16 October 2026. This notice must be reviewed when the relevant purposes, recipients or data handling materially change.