Privacy Policy

Gary Vision Ventures, LLC · Effective 2026-09-29

Gary Vision Ventures, LLC ("GVV", "we", "us") builds software, including AI tools. This policy explains what personal information we collect, why, and what you can do about it. It covers garyvisionventures.com, its subdomains, our web apps (such as MidwestAmalfi, Indiana Procurement Radar, and Public Procurement Response Copilot), the connectors we build for AI assistants, and any other product that links to this policy (together, the "Services").

Who we are

Gary Vision Ventures, LLC is a Delaware limited liability company based at 111 W Maple St, Chicago, IL 60610. You can reach us at thegaryvisionfundllc@gmail.com.

What we collect

Information you give us

• Messages and feedback. If you email us or use a feedback form, we get what you send, including your email address if you include it.
• What you type into our tools. For example, the business name and focus you enter into Public Procurement Response Copilot, or a search in one of our apps. We use it to produce the result you asked for.
• Account and billing details. If you buy from us, our payment processor, Stripe, collects your payment details. We never see or store your full card number. We receive your name, email, billing details, and a record of the purchase.

Information collected automatically

• Usage events. When you use our sites, we record events such as page views, clicks, and searches, along with the page, time, and any campaign tags in the link you followed (for example, utm_source). We use this to learn which features are useful.
• Technical data. Our hosting provider, Cloudflare, processes your IP address, browser type, and request details to deliver the site and protect it from abuse.
• Anonymous counters. Some pages increment simple visit and click counters through a third-party counting service. These counters store totals, not who you are.
• Browser storage. Some apps save your preferences or shortlists in your own browser's local storage so they're there when you come back. This data stays on your device, and we don't receive it. We don't use advertising or cross-site tracking cookies.

Information from connected services

• If you connect one of our connectors or AI tools to another service (for example, through an AI assistant), we receive only what's needed to do what you asked, within the permissions you granted. See "Connectors for AI assistants" below.

How we use it

We use personal information only to:

• Provide the Services and do what you asked.
• Keep the Services secure, working, and free of abuse.
• Understand how the Services are used so we can improve them.
• Respond to you, and send receipts and service messages.
• Meet legal, tax, and accounting obligations.

We don't sell personal information. We don't share it for targeted advertising. We don't use your content to train AI models.

AI features

Some Services use AI models to generate results. When you use one, the input needed for that result is sent to our AI model provider (for example, Anthropic) to generate the response. We use providers under business terms that don't allow them to train their models on that data. AI output can be wrong. Review it before relying on it.

When we share information

We share personal information only:

• With service providers that run parts of the Services for us, and only for that purpose: Cloudflare (hosting, storage, security), Amazon Web Services (Enroute's data processing and email), Stripe (payments), AI model providers (AI features), map tile and open-source library providers (loading maps and page scripts, which receive your IP address), a counting service (anonymous page counters), and Google (email).
• To complete your request. For example, a connector sends your instruction to the service it connects to.
• For legal reasons. When the law requires it, or to protect the rights, safety, and security of our users, the public, or GVV.
• In a business transfer. If GVV is involved in a merger, acquisition, or sale of assets, under this policy's protections.

Data we handle for business customers

When a business hires us to run software on its own data (for example, AI tools inside its email or documents), we process that data on the business's behalf and follow its instructions and our contract with it. The business's own privacy policy governs that data. If your data is in that situation, contact that business first. We'll help it respond to your request.

Connectors for AI assistants

We build connectors that let AI assistants, including Meta's Muse, use our Services. For connectors:

• We collect the requests your assistant sends to the connector, the results we return, an identifier for your account, the permissions you granted, and access tokens. We store tokens only in hashed or encrypted form. We don't log the content of your requests.
• Some connectors work with your account at another service. You either give the connector an API key for that account or sign in to the other service. That key or sign-in token is stored encrypted inside your authorization, and it's used only to carry out your requests. It's never shown to the assistant, and it's deleted when your authorization ends.
• We act as an independent controller of connector data. The assistant provider (for example, Meta for Muse) is a separate, independent controller of the data it processes, under its own privacy policy.
• Each connector's documentation page lists the specific data it uses. Where that page is more specific, it controls.
• You can disconnect a connector at any time in your assistant's settings. An authorization ends when you revoke it, or automatically after 30 days without use. When it ends, we delete the tokens and any key stored with it.
• We don't infer sensitive characteristics about you, such as health, religion, political views, or sexual orientation.

Enroute (private charter connector)

Enroute is a GVV service (Gary Vision Ventures, LLC) that helps you find private charter flights. It is your assistant for finding and requesting flights. It isn't an airline, and the flights it shows are sold and operated by the company that lists them. Because Enroute has to remember your trips and watches to work, this section overrides the general connector section above where they differ.

• What we collect. Your searches and trip details (origin, destination, dates, number of passengers, preferences) and the price watches you set. Only if you give them: your name and email for a flight request, passenger names for a booking, and a passenger's date of birth or weight, but only when the operator asks for them.
• Searching listing sites. Many flights come from third-party listing sites such as SkyAccess and Villiers. When you search, Enroute may look up your route, dates and number of passengers on those sites in real time. We don't send your name, email or any other detail that identifies you with a search. If you open a listing's link to book, you're on that site, and its own privacy policy applies to what you give it.
• Requests to a listing site. If you ask Enroute to request a flight for you and say yes to sharing, we send your name, email, route, date and number of passengers to that listing's seller (SkyAccess, or Villiers for flights Villiers lists), so its specialist can reply with options. We send nothing until you say yes. Requests to Villiers are credited to Enroute as a Villiers affiliate, which may earn us a referral fee; it doesn't change your price.
• Where replies go. The seller replies either to the email you gave, or to a private Enroute reply address for that trip (trips+…@enrouteair.com) so the reply can reach you through Enroute. When a reply comes to Enroute, we store it, pull out what you need (for example "options ready" and the link to them), and show that to you. We delete the request, any replies and our stored copies of those emails one day after the travel date. From then on, the seller's own privacy policy covers what it holds.
• Operators. Enroute doesn't contact charter operators on your behalf at this time. If that changes, this section will say what is shared first. Passenger details you give us for a booking (names, and date of birth or weight if the operator asked) are shared only with the operator of that flight, and we delete them one day after the flight.
• Aggregate demand. Any demand statistics we show operators include at least three different travelers and never identify you. We never sell your trip data.
• Flight data. Enroute uses public FAA flight data internally, for example to find available aircraft and keep your day-of timing current. We never show aircraft positions or flight history, and we never unmask aircraft owners who have asked the FAA for privacy.
• Retention.
  • Passenger details, and flight requests with their replies: deleted one day after the travel date.
  • Watches: kept until you cancel them or they end.
  • Searches, trips and ended watches: deleted or made anonymous within 12 months.
  • Backups: our database backups roll off on their own. Nightly backup copies are deleted after 30 days, and server disk snapshots after 7 days. So deleted data can remain in a backup for up to 30 days before it's gone for good.
• Disconnecting. Your authorization ends when you disconnect Enroute in your assistant, or after 30 days without use, and we delete its access tokens. Disconnecting doesn't cancel anything you've booked with a seller. Your trips and watches follow the retention schedule above. If you want them deleted sooner, email us at the address under "Contact" and we'll delete them.

How long we keep it

We keep personal information only as long as needed for the purposes above:

• Security and technical logs: up to 30 days.
• Usage events: up to 24 months, then deleted or made anonymous.
• Messages and feedback: as long as needed to handle them and follow up.
• Purchase and billing records: as long as tax and accounting law requires, usually 7 years.
• Enroute data: as described in the Enroute section above (passenger details and flight requests one day after travel; searches, trips and ended watches within 12 months; backups within 30 days).
• Connector data: only as long as needed to complete your request. Authorizations, and any keys or tokens stored with them, are deleted when you revoke them, when you ask us to, or after 30 days without use, whichever comes first.

Your choices and rights

You can ask us to access, correct, delete, or give you a copy of your personal information. Depending on where you live, including California and other U.S. states with privacy laws, you may also have the right to opt out of the sale or sharing of personal information (we don't do either), to limit use of sensitive personal information, and to not be treated differently for using these rights. You can use an authorized agent. The only sensitive personal information we handle is account credentials you choose to give a connector, such as an API key or sign-in token for another service. We use them only to provide what you asked for, so there's nothing further to limit.

To make a request, email thegaryvisionfundllc@gmail.com. We'll verify your request and respond within 30 days (45 where the law allows). If we deny it, you can appeal by replying to our decision.

You can also clear your browser's local storage at any time to remove anything our apps saved there.

Do Not Track and Global Privacy Control

We don't track you across other websites, and we don't let third parties do so through our Services. Because of that, we treat all visitors the same whether or not their browser sends a Do Not Track signal. We honor Global Privacy Control signals as a request to opt out of sale and sharing, which we already don't do.

Security

We use reasonable administrative, technical, and physical safeguards. These include encryption in transit, encrypted or hashed storage of credentials and tokens, least-privilege access, and confirmation steps before consequential actions. No system is perfectly secure. If a security incident affects your personal information, we'll notify you and any affected platform as the law and our agreements require.

Children

The Services aren't directed to children under 13 (or a higher age where your local law sets one), and we don't knowingly collect their personal information. If you think a child gave us personal information, contact us and we'll delete it.

Map and location data

Some Services use open map data. FBO locations include data © OpenStreetMap contributors, available under the Open Database License (ODbL); the derived FBO table is available on request at thegaryvisionfundllc@gmail.com.

Where data is processed

We're based in the United States. Our providers may process data in the United States and other countries where they operate.

Changes

If we change this policy, we'll post the new version here with a new effective date. For material changes, we'll give notice before they take effect.

Contact

Gary Vision Ventures, LLC · 111 W Maple St, Chicago, IL 60610 · thegaryvisionfundllc@gmail.com