Everything youare agreeing to.

• 01Privacy PolicyHow Troy handles personal data. Troy is the controller for its own site visitors, enquirers and client contacts, and a processor for the personal data inside a client’s connected advertising and commerce accounts.Draft
• 02Cookie PolicyTroy sets no cookies on this site and runs no analytics. It saves the appearance settings you choose in your own browser, where they stay. This page lists exactly what is stored, what is not, where the site is served from — Vercel's Washington, D.C. region, in the United States — the one question about the host that is still open, and what has to happen before anything else, including the analytics chosen for launch and not yet installed, is added.Draft
• 03Website Terms of UseThe terms for using troy-agency.com itself: what you may do with what is on it, what it does and does not promise, and where Troy’s responsibility starts and stops. Buying Troy’s work is covered by the service terms, not by these.Draft
• 04Terms for Troy's ServicesThe master terms behind everything Troy sells: the free Troy Score, the Fix Sprint, Troy's team retainers and, later, the platform and Agents. They bind Troy and the business named in an order.Draft
• 05Data Processing AddendumThe Article 28 terms for personal data Troy processes inside a client’s connected advertising, commerce and email accounts. It says what Troy may do with that data, who else may touch it, and what happens to it when the work ends.Draft
• 06Sub-processorsThe companies Troy brings in to help process a client’s personal data, and the rules for adding one. There are four on the list today — the company that hosts this site, the group company whose systems client data sits on, and the two AI vendors Troy drafts with — and this page says what is still unchosen rather than inventing the rest.Draft
• 07Acceptable Use PolicyThe marketing Troy will not do, and the marketing you may not ask it for. It covers this website today, and the platform and the agents from the day either exists.Draft
• 08AI Use and Disclosure StatementWhere AI sits in Troy’s work, where it does not, what gets recorded and labelled, and who decides whether a piece of advertising says so.Draft
• 09SecurityWhat Troy is designing its security around, and what it has not built. Troy is pre-launch, so this is a statement of intent rather than a description of controls that exist.Draft
• 10Accessibility StatementWhat troy-agency.com has been built to do for people using a keyboard, a screen reader or a reduced-motion setting; how it has and has not been tested; and the problems Troy already knows about. WCAG 2.2 AA is the target. No conformance is claimed.Draft
• 11Legal Notice and Company DetailsWho Troy is, in the sense a register would recognise: the company behind troy-agency.com, the group it sits in, how to reach a person, and where a legal notice would be served. The name, the address and the jurisdiction are settled. The incorporation is not finished, so there is no corporation number yet.Draft

1. 01companyNumberThere is no corporation number yet, which means the federal incorporation has not completed. Until it has, Troy Agency Inc. is an intended name rather than a company: it cannot sign a contract, and calling itself “Inc.” in one would be wrong. This is the first thing to finish.
2. 02intraGroupBasisWhat makes the sharing lawful, and how is it disclosed? Under PIPEDA, using someone's personal information for a purpose they were not told about needs meaningful consent, and a Louin customer has not agreed to their data being used for Troy's marketing. This needs, at minimum: a written agreement inside Lunari Group, notice to the customers whose data moves, a way for them to say no, and a record of consent. This is the most serious open item on this page — the site now discloses the sharing, but disclosure alone is not a lawful basis.
3. 03aiVendorTermsWhich plan is each of OpenAI and Anthropic used under, and does that plan allow the provider to train on what Troy sends? Both say their business and API terms exclude training by default, but the answer depends on the plan and has to be confirmed rather than assumed — a client will ask, and the sub-processor list has to state it.
4. 04hostCookiesWhether Vercel sets a strictly necessary cookie of its own on this project once deployed — routing, load balancing or a bot check. Confirm at deploy and list it in the cookie policy.

4 open decisions. They live in one file, lib/legal/entity.ts, and every document reads from it.

1. 01transferMechanismthe Standard Contractual Clauses, with the UK Addendum where the United Kingdom is involved, entered into through each supplier's own data processing agreementTroy is Canadian but the site runs in the United States, so Canada's adequacy recognition does not carry the transfer on its own — the data lands in the US. Confirm which mechanism each supplier actually offers, and whether any of them relies on the EU–US Data Privacy Framework instead.
2. 02retentionEnquiries24 months from your last contact with us, unless you ask us to delete it soonerA conventional business-development period. Shorten it if you would rather hold less.
3. 03retentionClients7 years after the engagement endsChosen to clear the six-year limitation period in Ontario and the records Canadian tax law expects you to keep. Confirm the exact minimum with your accountant.
4. 04retentionAccountDatadeleted within 30 days of the account being disconnected or the engagement ending, whichever is firstA short window is the point of the product promise. Confirm nothing in the reporting depends on holding it longer.
5. 05retentionLogs90 daysLong enough to investigate an incident, short enough not to become a liability. Check it against what Vercel keeps by default.
6. 06retentionProvenancekept for as long as the client record, so a question about a piece of work can always be answeredThe record of what was AI-made outlives the campaign. Confirm this is what you want, and that it matches the change log.
7. 07paymentTerms14 days from the date of invoiceConventional for a retainer. Longer terms mean funding the work yourself.
8. 08billingCyclemonthly in advance, on the first working day of each monthIn advance is the norm for a retainer and is what the cash-flow assumptions in the plan imply.
9. 09latePaymentInterest1.5% a month (18% a year) on any overdue amount, or the maximum the law allows if that is lowerThe common Canadian commercial rate. It has to be stated to be chargeable.
10. 10noticePeriod30 days' written notice, on either sideMatches the monthly billing cycle. The step-down offer in the plan happens inside this window.
11. 11curePeriod30 days to put it right after written noticeStandard. Shorter for non-payment is common if you want it.
12. 12liabilityCapthe total fees paid under the affected order in the 12 months before the claimThe usual services cap. It never excludes the things that cannot lawfully be excluded, and a client with large media spend may push back — that is a negotiation, not a drafting error.
13. 13nonSolicitPeriod12 months after the engagement ends, and only for people who actually worked on itKept mutual and narrow so it stays enforceable in Ontario.
14. 14forceMajeureExit30 days, after which either side may end the affected orderStandard.
15. 15breachNotificationWindowwithout undue delay and in any event within 48 hours of becoming aware of itGives you room inside the client's own 72-hour duty under the GDPR. Canadian law requires notification of breaches of security safeguards that pose a real risk of significant harm. Confirm you can actually meet 48 hours.
16. 16subProcessorNoticePeriod30 days' notice before a new sub-processor starts, with a right to object in that periodConventional. If a client objects and it cannot be resolved, they can end the engagement without penalty.
17. 17auditFrequencyonce in any 12 months, and again after a personal data breach, at the client's own cost unless the audit finds a material failureConventional and proportionate for a company of this size.
18. 18analyticsProviderVercel Analytics, which is cookieless and does not track anyone across sitesCHOSEN BUT NOT YET INSTALLED. Nothing is running on the site today, and the cookie policy says so. Switch this to decided() on the day it is turned on, not before.

18 proposed defaults.