We sell GenAI-first marketing. Our own privacy policy, until this week, told visitors that Claude's AI agents scored every Hexagram Diagnostic answer, drafted the written explanation for each pillar, and that I personally reviewed every Gap Map before it reached them.
Neither sentence was true. The code scores every answer with fixed rules in our own software. No AI model scores or interprets a single response. The Gap Map goes out by email the moment the quiz finishes. There is no review step, by me or anyone else, between that moment and your inbox. I get a notification, and I sometimes follow up by hand, but that is a different claim from "reviewed before it is sent."
We do not know how long that sentence was live. Our own repository history for that page does not reach back far enough to settle it, and we are not going to put a number on something we cannot check. What we know is what the code does now, and what the old policy said it did, and those two things did not match.
What the policy actually promised
The old version named Anthropic as a processor "whose Claude models power the AI agents that score Hexagram Diagnostic answers and draft your Gap Map, under human review before it is sent." It also said we do not use visitor data to train AI models, which was true, buried next to two claims that were not. The policy was missing processors entirely: Neon and Cloudflare, both of which handle Diagnostic data, had no entry at all. There was no itemised legal basis for each piece of data collected, no international transfer section, and no stated retention period.
A policy that overstates what your AI does is not a safer thing to publish than one that understates it. It is a specific, checkable claim, and a visitor who reads it carefully has every right to expect it to be accurate.
Nothing fires until you choose
While rewriting the policy, we found that it described consent machinery that did not exist yet, so we built it. GA4, the Meta Pixel and first-touch attribution storage now wait behind a banner with an Accept all and a Reject all button of equal weight, plus a preferences panel and a footer link to change your mind later. A Global Privacy Control signal counts as a refusal and skips the banner entirely. Withdraw consent and the tag is disabled, its cookies are deleted, and the remembered record of how you first arrived is forgotten, not just hidden.
Our own first-party event log, the one that feeds our internal site score, keeps its session id in memory rather than in storage, drops the referrer source without storing it, and is skipped outright for Global Privacy Control and Do Not Track. That path needed no consent because it was rebuilt to need none.
The contact form was not telling the truth either
Our contact form promised no drip sequence. It was adding every enquiry to the marketing list anyway. We fixed the form, not the promise, because the promise was the correct one. Completing the Hexagram Diagnostic or sending an enquiry no longer adds anyone to the marketing audience by default. The Diagnostic now carries a separate, unticked checkbox for marketing emails, and consent is stored with a timestamp and the notice version it was given under. Lead magnets still deliver the download every time; the two follow-up emails only start if that checkbox was ticked.
Every nurture email now carries a signed unsubscribe link, a one-click List-Unsubscribe header, and a postal address. The unsubscribe page and its API stop the sequence, record a hashed suppression entry, and mark the contact unsubscribed in Resend, failing loudly rather than silently if either step does not complete. The weekly cron that sends these refuses to run at all without its own unsubscribe secret configured, and any sequence still open after 400 days expires on its own.
Honouring a rights request used to mean opening five systems by hand
scripts/compliance/subject-request.mjs now exports or erases everything held about one email address across Neon, Redis and Resend in a single run. Erasure defaults to a dry run; it only deletes with --yes. The script also prints a checklist of the places outside our own code, the ones no script can reach, that still need a human to act. A separate weekly job deletes Diagnostic submissions and site events once they pass the retention period our own policy now states, while leaving paying clients' records untouched.
Four checks that fail on purpose
Our internal self-score gained four checks built to fail: a tracker loading without consent, a form missing its privacy link, an address joining the mailing list without consent on record, a marketing email with no unsubscribe link. Each one was tested by removing the control it watches for and confirming the score caught it. The classifier that decides which site changes may merge themselves now treats every line of consent, tracking or data-collection code as something a person has to look at, full stop. We built that fence the same week, and this is exactly the kind of change it was built to stop from shipping unreviewed.
A privacy policy is a claim. The code is the evidence. When we found the two disagreeing, the honest fix was not a better sentence. It was infrastructure that makes the sentence true.
If you want to know whether your own Architect pillar would survive the same check, that structural read is exactly what the Hexagram Diagnostic was built to surface, alongside the rest of our analytics and AI work. For the regulatory groundwork this sits on, we wrote about it in privacy policy and DPDP compliance for Indian websites. The team behind this build is the same one that gets its own backstories checked before publishing, not always successfully on the first try.
