Privacy Policy

01Who we are and what this covers

Gray Park is a marketing agency for event industry businesses, operated by Event Pro Consulting LLC, doing business as Gray Park Agency, a United States company. This policy covers:

• The website at www.grayparkagency.com, including the blog, the free audit and contact forms.
• The operator console and client portal at app.grayparkagency.com.
• The public AI agent endpoint described on For agents, served from app.grayparkagency.com and from a backup host on vercel.app.
• Email we send you about any of the above.
• Lead forms and the attribution snippet we install on client websites. There we act for the client, under the client’s own privacy policy. See section 11.

02What we collect

When you visit the website

Standard web server logs (IP address, browser, pages requested, timestamps), analytics events, and the cookies and browser storage listed in section 6. The icon font on the site is loaded from a Google server, so your browser sends your IP address to Google when it fetches it. All other fonts are served from our own domain.

When you send a form

The free audit form asks for your name, company, website, email, an optional phone number, your type of event business and a message. The contact form asks for name, email, company, website and a message. Both forms also carry hidden attribution fields: how you arrived (source, campaign tags, the page you landed on and the referring site). A hidden anti-spam field catches bots; people never see or fill it.

When an AI assistant talks to our agent endpoint

Every call records the tool used, an identifier for the calling agent (the header it sends, or its user-agent string), the IP address, the question or inputs sent, the answer returned, how long it took and whether it succeeded. Audit requests made through the endpoint record the website, company, a name, an email address or phone number, the business type, what the company sells, the markets it serves and a message. Names, email addresses, phone numbers and the message are stored only in the encrypted lead record, never in the call log.

When you use the client portal or operator console

• Your email address, name, role and the client accounts you belong to.
• Sign-in link requests, including the IP address that requested the link. Sign-in is by emailed link only; we never store a password.
• Sessions, including the browser user-agent string and last activity time.
• Browser push subscriptions, if you turn notifications on.
• Questions, notes, approvals and changes you make, attributed to you so your team can see who did what.
• Report share links: the addresses a report was sent to, and how many times it was opened.

When you are a client

To do the work you hire us for, we hold the access you grant to your Google, Meta, LinkedIn and similar accounts (as revocable tokens), the documents and files you upload or we produce, performance data from those platforms, and the leads that arrive through your forms, calls and the endpoint. Lead contact details are encrypted at rest.

03How we use it

• To answer the request you made: deliver the free audit, reply to your message, book a call, run the services in your agreement.
• To run and protect the services: rate limits, abuse and spam prevention, duplicate detection, security logging.
• To improve the agent endpoint and the website. A person at Gray Park reviews what agents asked and where the answers were weak. That review uses the call log, which never contains contact details.
• To measure traffic and understand which pages and campaigns work.
• To send service email: audit results, portal invitations and sign-in links, notifications you opted into, weekly scorecards for clients, shared reports.
• To send marketing email only if you asked for it. Every marketing message carries an unsubscribe link.

We do not use personal data to make automated decisions that have legal or similarly significant effects on you.

04Automated systems and AI

Answers from the agent endpoint are generated by an AI model from Gray Park’s published website content and service catalog. To generate an answer we send the question text and that published content to our AI model provider (named in section 5). We do not send the calling agent’s identifier, IP address or any contact details with it. Answers can be wrong or incomplete, and nothing the endpoint says is a quote or a commitment; a person makes every commitment.

Our internal system, Gray Park Operator, uses AI models to draft research, copy, reports and proposed changes for client work. A person reviews and approves before anything is published, sent or changed. When that drafting involves client data such as leads or performance reports, that data is processed by the same AI model provider under its business terms, which do not permit training on our data.

Blog articles are drafted with AI and reviewed by a person before publication. Blog images are AI-generated. Neither process uses personal data.

05Who receives data

We use the following providers to run the services. Each receives only what its purpose needs.

We also disclose data when the law requires it, to protect our rights or safety, or as part of a sale or merger of the business, in which case this policy continues to apply. We do not sell personal data, and we do not share it for cross-context behavioral advertising.

06Cookies and browser storage

You can block or delete cookies in your browser settings. The public website works without them. The signed-in areas need their session cookie to function. To stop Google Analytics everywhere, Google offers a browser add-on at tools.google.com/dlpage/gaoptout.

07How long we keep it

08Security

All traffic is encrypted in transit. Lead contact details are encrypted at rest with a key held separately from the database. Sign-in links and API tokens are stored only as hashes. Uploaded files sit in private storage behind signed access. Access to client data is limited to Gray Park staff who work on the account and the client’s own portal users. No system is perfectly secure; if we learn of a breach affecting your data we will tell you and the authorities as the law requires.

09Your choices and rights

You can ask us at any time to tell you what personal data we hold about you, correct it, delete it, give you a copy, or stop marketing email. Write to hello@graypark.agency from the address we have on file, or tell us how to verify it is you. We answer within 30 days, or within the time your local law allows. We will not treat you differently for exercising these rights.

California residents

In the last 12 months we have collected the categories described in section 2: identifiers, commercial information (your inquiries and engagements), internet activity (analytics and logs) and professional information (your company and role). We collect them for the purposes in section 3 and disclose them to the providers in section 5. We do not sell personal information and do not share it for cross-context behavioral advertising, so there is nothing to opt out of. You may use an authorized agent to make a request; we will ask the agent for proof of authorization.

Outside the United States

Our services are offered from the United States and your data is processed here. If you are in the European Economic Area, the United Kingdom or Switzerland: we process your data to perform a contract or answer your request, for our legitimate interests in running and improving the services, and for marketing with your consent. You have the rights listed above plus the right to object, to restrict processing, to data portability and to complain to your supervisory authority. Transfers to the United States rely on standard contractual clauses with our providers.

10Children

Our services are for businesses and are not directed at anyone under 18. We do not knowingly collect data from children. If you believe a child has given us data, email hello@graypark.agency and we will delete it.

11Client websites

When we build or manage a client’s website, the lead forms, call tracking and attribution snippet on that site collect data on the client’s behalf. The client decides what is collected and why; their privacy policy governs; we process the data only to deliver the services in our agreement with them. Requests about data collected on a client website go to that client, and we help the client answer them.

12Changes and contact

The date at the top is the date of the current version. If we make a material change we will say so on this page, and for clients and portal users we will tell you by email. Questions, requests and complaints: hello@graypark.agency. Our Terms of Service describe the rules for using the website, the agent endpoint and the portal.