Privacy Policy
DRAFT — requires review by a qualified legal professional before publication. Last updated: [DATE].
1. Who we are
AI Savings Finder is operated by [Company Name], registered at [address], [country]. We are the data controller responsible for your personal data under the EU General Data Protection Regulation (GDPR). Contact: [privacy@example.com].
2. What data we collect
When you use our AI Savings Assessment, we collect:
- Company information: website/domain, company name (from public sources or your input), industry, company size
- Assessment answers: your role, department, team size, work repetitiveness, systems used, main goal, and optional free-text description of a process
- Contact details: first name and work email address
- Consent records: which checkboxes you ticked, the exact text shown, and timestamp
- Technical data: IP address (for consent logging), QR source tag, timestamps
We do not use tracking cookies. Our analytics are cookie-less and do not collect personal data. No personal data appears in report URLs (slugs are random identifiers).
3. Why we process your data (purposes & legal bases)
| Purpose | Legal basis |
|---|---|
| Generate and deliver the AI Savings Map you requested | Performance of your request (Art. 6(1)(b) GDPR) |
| Send you the report by email | Performance of your request (Art. 6(1)(b) GDPR) |
| Send marketing follow-ups and AI automation ideas | Your consent (Art. 6(1)(a) GDPR) — only if you actively tick the marketing checkbox |
| Follow up personally after a live conversation at the event | Legitimate interest (Art. 6(1)(f) GDPR) — B2B context, existing relationship, expected by you; opt-out always available |
| Aggregate analytics (funnel performance, source tracking) | Legitimate interest (Art. 6(1)(f) GDPR) — no personal data in analytics |
4. How we use AI
Your savings estimate is calculated using a deterministic formula (no AI involvement in the numbers). We use an AI language model (Anthropic Claude API) solely to write the narrative text sections of your report, based on your assessment answers and industry benchmarks. The AI does not make decisions about you and does not alter the calculated figures. No automated decision-making with legal or significant effects takes place.
5. Who we share your data with
We use the following processors under data processing agreements (DPAs):
| Processor | Purpose | Location |
|---|---|---|
| [Hosting provider, e.g. Vercel/Railway] | Application hosting | [EU/US — specify] |
| [Database provider, e.g. Supabase] | Data storage | [EU/US — specify] |
| [Email provider, e.g. Resend] | Transactional email delivery | [US — SCCs/DPF] |
| Anthropic (Claude API) | AI text generation for report narratives | [US — SCCs/DPF] |
| [CRM, e.g. Airtable/HubSpot] | Lead management | [US — SCCs/DPF] |
For US-based processors, data transfers are safeguarded by Standard Contractual Clauses (SCCs) and/or the EU-US Data Privacy Framework (DPF) where applicable.
We do not sell your personal data. We do not share it with third parties beyond the processors listed above.
6. Data retention
- Assessment data and reports: 12 months from creation, then deleted
- If you become a client: retained for the duration of the business relationship + legal obligations
- Marketing consent records: retained as long as consent is active, plus 3 years after withdrawal (for compliance evidence)
- You can request earlier deletion at any time (see Your Rights below)
7. Your rights
Under GDPR, you have the right to:
- Access your personal data and obtain a copy
- Rectify inaccurate or incomplete data
- Erase your data ("right to be forgotten")
- Restrict processing in certain circumstances
- Object to processing based on legitimate interest, including direct marketing
- Data portability — receive your data in a structured, machine-readable format
- Withdraw consent at any time, without affecting the lawfulness of prior processing
To exercise any of these rights, email [privacy@example.com]. We will respond within 30 days.
You also have the right to lodge a complaint with a supervisory authority. If you are in Spain, this is the Agencia Espanola de Proteccion de Datos (AEPD): aepd.es.
8. Cookies & tracking
This website does not use cookies for tracking or analytics. We use cookie-less analytics that do not collect personal data. No cookie consent banner is required.
9. Changes to this policy
We may update this Privacy Policy from time to time. The "Last updated" date at the top will always reflect the most recent version. Material changes will be communicated via the email address you provided, if applicable.
10. Contact
For any questions about this Privacy Policy or how we handle your data:
[Company Name]
[Address]
Email: [privacy@example.com]
This privacy policy is a draft prepared for internal review. It must be reviewed and approved by a qualified legal professional familiar with GDPR, Spanish LOPDGDD, and LSSI-CE requirements before publication. Placeholder values in [brackets] must be filled in with actual company details.