Privacy Policy

Section 1 of 15

Data Controller

Section 2 of 15

Data we collect

• Analysis inputs: job title, role description, daily tasks, salary or compensation data, country, industry sector, company size, weekly hours and any extra detail you supply through the analysis form.
• Lead and contact data: name, email address, company name, phone number and any free-text message submitted through the lead-capture forms (results page or PDF request).
• AI-generated outputs: the analysis report, automation score, ROI calculation and recommendations produced from your inputs.
• Technical data and engagement signals: IP address, browser, operating system, device type, referrer URL, anonymous visitor cookie identifier, view/like events on public example reports, page-level interaction events fired through Google Tag Manager, and timestamps. This data is collected automatically through server logs and, where applicable, cookies (see the Cookie Policy).

Section 3 of 15

Legal bases for processing (GDPR Art. 6)

• Pre-contractual or contractual measures (Art. 6(1)(b)): processing the inputs of the analysis form to deliver the report you requested, processing your contact details to honour a request you made (e.g. PDF email, callback).
• Consent (Art. 6(1)(a)): non-essential cookies and analytics tools (Google Analytics 4, Microsoft Clarity), email marketing follow-up beyond what is strictly necessary to satisfy your initial request. Consent is collected via the cookie banner and can be withdrawn at any time.
• Legitimate interest (Art. 6(1)(f)): server logging, abuse prevention (Cloudflare Turnstile bot screening), aggregated and anonymised analytics for product improvement, recording engagement events on public example reports.
• Legal obligation (Art. 6(1)(c)): retention required by tax, accounting or other applicable laws, responses to lawful requests from authorities.

Section 4 of 15

How we use your data

• Generate the AI-powered analysis report you requested and display it to you.
• Send you transactional emails (PDF report, lead confirmation, follow-up) tied to actions you took.
• Follow up commercially when you have explicitly requested an implementation roadmap or asked us to contact you.
• Improve the service, prompts and report quality through aggregated and anonymised analytics.
• Detect, prevent and address fraud, abuse, security incidents and technical issues.
• Comply with legal obligations (tax, accounting, regulatory, court orders).

Section 5 of 15

Third-party AI providers

• Process the inputs only to generate the response to that specific request.
• Apply technical and organisational security measures consistent with industry standards.
• Not retain the data beyond what is required to deliver the response and run abuse-monitoring as configured.
• Not use the data to train, fine-tune or improve any foundational AI model.

Section 6 of 15

AI training — your data is not used to train models

Section 7 of 15

Recipients of your data

• Microsoft Azure (cloud hosting, database, Azure OpenAI Service) — EU region.
• HubSpot Ireland Ltd (CRM, used to follow up commercially with leads) — EU.
• Resend Inc. (transactional email delivery for analysis confirmations, PDF reports, lead confirmations and admin notifications) — United States, with EU Standard Contractual Clauses.
• Cloudflare Inc. (Turnstile bot protection on the analysis and lead forms) — United States, with EU Standard Contractual Clauses.
• Google LLC (Tag Manager and Google Analytics 4, only after analytics consent) — United States, with EU Standard Contractual Clauses.
• Microsoft Corporation (Clarity session-replay and heatmaps, only after analytics consent) — United States, with EU Standard Contractual Clauses.
• Langfuse GmbH (LLM tracing and observability, used in aggregate; no personally identifying analysis input is forwarded other than what is required to debug a specific call) — EU.
• Public authorities and courts where required by applicable law, regulation, court order or governmental request.
• External professional advisors (auditors, lawyers, accountants) bound by confidentiality where strictly necessary.

Section 8 of 15

International data transfers

• Adequacy decisions of the European Commission where available (GDPR Art. 45).
• Standard Contractual Clauses approved by the European Commission (GDPR Art. 46(2)(c)) combined with supplementary technical and organisational measures.
• Other applicable derogations under GDPR Art. 49 only where no other mechanism is available.

Section 9 of 15

Retention

• Analysis inputs and AI-generated outputs: retained while you may want to access the report. Deleted on request, or anonymised after 24 months of inactivity, whichever comes first.
• Lead and contact data: retained for up to 24 months of commercial follow-up after the last interaction, after which the record is anonymised unless retention is required by law.
• Engagement events on public example reports (anonymous visitor identifiers, view and like events): retained for up to 12 months in identifiable form, after which they are aggregated.
• Server logs and security event records: retained for up to 12 months.
• Accounting and billing data linked to commercial follow-up: retained for the period required by applicable tax law (typically 6 years in Spain).
• When a retention period ends, data is securely deleted or irreversibly anonymised.

Section 10 of 15

Security

Section 11 of 15

Your rights under the GDPR

• Right of access (Art. 15) — confirmation that we are processing your data and a copy of it.
• Right to rectification (Art. 16) — correction of inaccurate or incomplete data.
• Right to erasure (Art. 17) — deletion of your data when no longer needed, when consent is withdrawn or when processing is unlawful.
• Right to restriction of processing (Art. 18).
• Right to data portability (Art. 20) — receive your data in a structured, commonly used and machine-readable format.
• Right to object (Art. 21) — to processing based on legitimate interest or for direct marketing.
• Right to withdraw consent at any time, without affecting the lawfulness of processing already carried out.
• Right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD) at www.aepd.es, or with the supervisory authority in your EU Member State of residence.

Section 12 of 15

Automated decision-making

Section 13 of 15

Children

Section 14 of 15

Cookies and tracking

Section 15 of 15

Changes to this policy