Privacy Policy

Last updated: 26 May 2026

Alsatorix ("we", "us", "our") is a sole trader business registered in Ireland. We take the protection of your personal data seriously. This policy explains what data we collect, why, and what rights you have under the General Data Protection Regulation (GDPR) and the Irish Data Protection Act 2018.

1. What Data We Collect

a) Project Enquiry Form

When you submit the onboarding form, we collect:

• Name, business name, email, phone number (optional), website (optional)
• Services you're interested in, problem description, budget range
• Industry, team size, tools you use
• Referral source and additional notes

b) Chatbot Conversations

When end-users interact with a chatbot we built for a client, we store:

• Conversation messages (user and assistant)
• Session identifiers (randomly generated, not tied to identity)
• Lead data if voluntarily submitted (name, email, phone)

c) Admin Accounts

If you are a client with an admin account, we store:

• Email address and name
• Password (hashed with bcrypt — we never store or see your plaintext password)

d) What We Do Not Collect

• We do not use cookies for tracking or analytics
• We do not use third-party analytics (no Google Analytics, no Meta Pixel)
• We do not collect payment card details directly — payments are handled by third-party processors (Stripe, Revolut, etc.)

2. Why We Collect It (Legal Basis)

Data	Purpose	Legal Basis (GDPR Art. 6)
Enquiry form data	To assess your project, prepare a proposal, and communicate with you	Legitimate interest (Art. 6(1)(f)) and pre-contractual steps (Art. 6(1)(b))
Chatbot conversations	To provide the chatbot service to our clients and their end-users	Contract performance (Art. 6(1)(b))
Lead data	To pass enquiries from end-users to the client business	Legitimate interest (Art. 6(1)(f))
Admin account data	To provide secure access to the dashboard	Contract performance (Art. 6(1)(b))

3. Third-Party Data Processors

We use the following third-party services to operate:

Service	Purpose	Location
OpenAI	AI-powered chatbot responses	United States
Railway	Application hosting	United States
Google (Gmail SMTP)	Email notifications	United States

All US-based processors are covered by the EU-US Data Privacy Framework. We only share the minimum data necessary for each service to function.

OpenAI: Chatbot messages are sent to OpenAI's API for processing. Per OpenAI's API data usage policy, API inputs and outputs are not used to train their models. We do not send personal identifiers to OpenAI — only the conversation text.

4. How Long We Keep Your Data

Data	Retention Period
Enquiry form submissions	12 months, or until project is completed/declined
Chatbot conversations	90 days (auto-deleted)
Lead data	90 days (auto-deleted)
Admin accounts	Until account is deleted or contract ends

5. Your Rights Under GDPR

You have the following rights regarding your personal data:

• Access (Art. 15) — Request a copy of the data we hold about you
• Rectification (Art. 16) — Ask us to correct inaccurate data
• Erasure (Art. 17) — Ask us to delete your data ("right to be forgotten")
• Portability (Art. 20) — Request your data in a machine-readable format
• Restriction (Art. 18) — Ask us to limit how we process your data
• Objection (Art. 21) — Object to processing based on legitimate interest

To exercise any of these rights, email samihammarit@gmail.com. We will respond within 30 days.

6. Data Security

We implement the following measures to protect your data:

• All traffic encrypted via TLS (HTTPS)
• Passwords hashed with bcrypt (never stored in plaintext)
• Authentication via signed JWT tokens with expiration
• Rate limiting on all endpoints to prevent abuse
• Input sanitization and prompt injection filtering
• Security headers (CSP, HSTS, X-Frame-Options, etc.)
• Invite-only registration — no public account creation

7. Cold Outreach & Marketing

If we contact you by email without prior relationship:

• We only use publicly available business contact details (e.g. info@ addresses listed on your website)
• Every email includes a clear opt-out mechanism — reply "stop" to be removed
• We maintain a suppression list and will never contact you again once removed
• We do not sell, share, or trade contact lists

This processing is based on legitimate interest (Art. 6(1)(f)) for B2B marketing, in line with Irish Data Protection Commission guidance on electronic marketing.

8. International Transfers

Some of our processors are based in the United States. These transfers are protected by:

• The EU-US Data Privacy Framework (adequacy decision by the European Commission)
• Standard Contractual Clauses (SCCs) where the DPF does not apply

9. Chatbot End-Users (Client Websites)

If you interact with a chatbot on a third-party website that was built by Alsatorix:

• The website owner (our client) is the data controller for the data collected through their chatbot
• Alsatorix acts as a data processor on behalf of the client
• The client's own privacy policy governs how your data is used
• We process data strictly as instructed by the client and in accordance with our Data Processing Agreement
• Conversation data is automatically deleted after 90 days

10. Children's Data

Our services are not directed at individuals under the age of 16. We do not knowingly collect data from children. If you believe a child has submitted data through our services, contact us and we will delete it immediately.

11. Changes to This Policy

We may update this policy from time to time. Changes will be reflected by updating the "Last updated" date at the top of this page. For significant changes, we will notify affected parties by email.

12. Complaints

If you believe your data protection rights have been violated, you have the right to lodge a complaint with:

We encourage you to contact us first at samihammarit@gmail.com so we can resolve your concern directly.