Policies

Privacy Policy

This policy explains what data we collect, why, and what rights you have under the GDPR and the Irish Data Protection Act 2018.

1. What We Collect

a) Project Enquiry Form

When you submit the onboarding form, we collect:

• Name, business name, email, phone number (optional), website (optional)
• Services you're interested in, problem description, budget range
• Industry, team size, tools you use
• Referral source and additional notes

b) Chatbot Conversations

When end-users interact with a chatbot we built for a client, we store:

• Conversation messages (user and assistant)
• Session identifiers (randomly generated, not tied to identity)
• Lead data if voluntarily submitted (name, email, phone)

c) Admin Accounts

If you are a client with an admin account, we store:

• Email address and name
• Password (hashed with bcrypt — we never store or see your plaintext password)

d) What We Do Not Collect

• We do not use cookies for tracking or analytics
• We do not use third-party analytics (no Google Analytics, no Meta Pixel)
• We do not collect payment card details directly — payments are handled by third-party processors (Stripe, Revolut, etc.)

2. Why We Collect It (Legal Basis)

3. Third-Party Data Processors

We use the following third-party services to operate:

We only share the minimum data necessary for each service to function. Hosting and email are handled within the EU. US-based processors are covered by the EU-US Data Privacy Framework and, where it does not apply, by Standard Contractual Clauses.

Enquiry alerts: Where a business has switched them on, we text the enquiry to that business's own nominated number so they can call you back. Those alerts carry your name and number, and your enquiry unless the business has chosen to leave it out. They are sent through Twilio, and where the business uses the WhatsApp channel, delivered over WhatsApp by Meta.

OpenAI: Chatbot messages are sent to OpenAI's API for processing. Per OpenAI's API data usage policy, API inputs and outputs are not used to train their models. We do not send personal identifiers to OpenAI — only the conversation text.

4. How Long We Keep Your Data

5. Data Security

• All traffic encrypted via TLS (HTTPS)
• Passwords hashed with bcrypt (never stored in plaintext)
• Authentication via signed JWT tokens with expiration
• Rate limiting on all endpoints to prevent abuse
• Input sanitization and prompt injection filtering
• Security headers (CSP, HSTS, X-Frame-Options, etc.)
• Invite-only registration — no public account creation

6. Cold Outreach & Marketing

If we contact you by email without a prior relationship:

• We only use publicly available business contact details (e.g. info@ addresses listed on your website)
• Every email includes a clear opt-out mechanism — reply "stop" to be removed
• We maintain a suppression list and will never contact you again once removed
• We do not sell, share, or trade contact lists

This processing is based on legitimate interest (Art. 6(1)(f)) for B2B marketing, in line with Irish Data Protection Commission guidance on electronic marketing.

7. Chatbot End-Users (Client Websites)

If you interact with a chatbot on a third-party website that was built by Alsatorix:

• The website owner (our client) is the data controller for the data collected through their chatbot
• Alsatorix acts as a data processor on behalf of the client
• The client's own privacy policy governs how your data is used
• We process data strictly as instructed by the client and in accordance with our Data Processing Agreement
• Conversation data is automatically deleted after 30 days

8. Children's Data

Our services are not directed at individuals under the age of 16. We do not knowingly collect data from children. If you believe a child has submitted data through our services, contact us and we will delete it immediately.

9. Changes to This Policy

We may update this policy from time to time. Changes will be reflected by updating the "Last updated" date at the top of this page. For significant changes, we will notify affected parties by email.

Terms of Service

Plain-English terms that govern a project engagement with Alsatorix. By paying the deposit and/or replying "approved" to a proposal, you agree to these terms.

1. Scope

Work is limited to what's described in the project proposal. Anything not listed is outside scope.

2. Changes & Add-Ons

Want something extra after we've started? No problem — we'll quote the addition separately with a new price and timeline. Changes don't happen without your written approval and additional payment.

3. Payment

• Under €300: 100% upfront before work begins.
• €300–€700: 50% deposit before work begins, 50% before final delivery/deployment.
• €700+: Milestone-based. Each phase paid upfront before that phase starts.

Payment is due within 3 days of invoice. Late payment pauses the project.

4. Revisions

Your package includes the agreed number of revision rounds. A "revision" is a set of feedback on the current deliverable. Additional revision rounds are available at a per-round rate stated in your proposal. Revisions apply to the agreed scope — requests that change the scope are treated as add-ons (see section 2).

5. Timeline

Timelines in the proposal are working-day estimates. They assume prompt feedback from you (within 48 hours), materials/content provided on time, and no scope changes mid-project. Delays on your side push the deadline by the same number of days.

6. What You Own

After final payment, you own the full source code, all custom assets built for the project, and the right to modify, deploy, and resell your product. We retain the right to show the work in our portfolio (anonymised if you prefer).

7. Hosting & Maintenance

• 1 month of hosting is included in the project price.
• After that, hosting is your responsibility or available as a monthly add-on (quoted separately).
• We are not responsible for downtime caused by third-party services (APIs, hosting providers, etc.).

8. Confidentiality

We will not share your business data, internal documents, or project details with anyone. We are happy to sign a separate NDA if required.

9. Refunds & Cancellation

• Before work starts: full refund of deposit.
• After work starts: the deposit is non-refundable (it covers time already spent). Any additional payments for undelivered phases will be refunded.
• If we can't deliver: you get a full refund of everything paid. No questions.

10. Liability

We build software, not business guarantees. We cannot guarantee specific revenue increases, lead numbers, or business outcomes. We guarantee the deliverable works as described in the proposal.

11. Communication

We respond within 24 hours on working days. Preferred channels are email or an agreed messaging platform. For urgent issues, note "URGENT" in the subject line.

12. Termination

Either side can end the project with written notice. If you cancel mid-project, payment for completed work is still due. If we cancel, you get a full refund of any undelivered work.

Cookie Policy

We keep cookies to the absolute minimum.

What we use

• Essential cookies only. The admin dashboard uses a single session cookie (a signed authentication token, stored as an httpOnly cookie that page scripts cannot read) so you stay logged in. It is strictly necessary for the dashboard to function and is not used for tracking.
• The public marketing site, demo pages, and the HYDRA project page store a small amount of data in your browser only where needed (e.g. remembering your selected currency on the pricing page or dismissing a notice). This never leaves your device and is not shared.

What we do not use

• No advertising or tracking cookies.
• No third-party analytics (no Google Analytics, no Meta Pixel).
• No cross-site tracking or profiling.

Because we only use strictly necessary cookies, no consent banner is required under the ePrivacy Regulations (SI 336/2011). You can clear or block cookies in your browser settings at any time; doing so may log you out of the dashboard.

Data Processing & Your GDPR Rights

Your rights under the GDPR

You have the following rights regarding your personal data:

• Access (Art. 15) — request a copy of the data we hold about you
• Rectification (Art. 16) — ask us to correct inaccurate data
• Erasure (Art. 17) — ask us to delete your data ("right to be forgotten")
• Portability (Art. 20) — request your data in a machine-readable format
• Restriction (Art. 18) — ask us to limit how we process your data
• Objection (Art. 21) — object to processing based on legitimate interest

To exercise any of these rights, email [email protected]. We respond within 30 days.

Data Processing Agreement (for business clients)

When we build and run a chatbot or automation for a business, that business is the data controller and Alsatorix acts as a data processor on its behalf. Our engagements are governed by a Data Processing Agreement (DPA) under Article 28 GDPR, covering sub-processors, security measures, retention, and international transfers.

A copy of our DPA is provided to business clients on request before onboarding — email [email protected].

International Transfers

Some of our processors are based in the United States. These transfers are protected by the EU-US Data Privacy Framework (adequacy decision by the European Commission) and, where the Framework does not apply, by Standard Contractual Clauses (SCCs).

Complaints

If you believe your data protection rights have been violated, you have the right to lodge a complaint with:

We encourage you to contact us first at [email protected] so we can resolve your concern directly.