Privacy

This page says what personal data we collect through this site and our services, why and on what legal basis, who processes it for us and where, and for how long we keep it. Three tables at the end put the periods, the providers outside the European Economic Area and what the site stores in your browser in one place; the sections refer to them.

What we collect

When you request a briefing, the form asks for your name, your work email address, your company, which kind of organisation you are (a bank, an insurer, a telecom operator, an AI vendor or other), and a short description of what should be in production that isn't yet. Nothing else is collected from what you type. If you reached the form from the Partners page, the request records that. If you came from a link with campaign tags (UTM parameters), we record those tags with your request; they say which campaign or page the link belonged to, nothing about you. This site sets no advertising cookies, runs no behavioural tracking and runs no visit statistics. It does store a few things in your browser, for a service you asked for or a setting you chose; the section Cookies and browser storage lists every one of them. On every form of this site, the fields marked as required are needed to answer you; without them we cannot.

Why we collect it

Only to answer your request, to confirm by email that it arrived, and to hold the briefing you asked for. The confirmation is written in Polish if you wrote to us in Polish, and in English otherwise. The basis is the steps you ask us to take before a contract (Article 6(1)(b) GDPR) and, for the confirmation email and for keeping the form free of automated submissions, our legitimate interest in running the site securely (Article 6(1)(f)). We do not add you to a mailing list because you sent a request (our newsletter has a sign-up of its own, described under The week in five), and we do not sell or share your details; the providers named on this page handle them on our behalf, and the section Providers outside the EEA says which of them are based outside the European Economic Area and on what safeguard.

How it is sent and stored

The form sends your message to an automation server we run (n8n, on a server we rent from Hetzner in Falkenstein, Germany), which saves it in our own database on that server and sends the founder a short notification through Telegram that a request has arrived. The notification carries the number of the request, its state and its category, never your name, address, company or message; we read the request itself in our own systems, not on Telegram (see Our internal tool below). The confirmation email is sent from [email protected] through Google Workspace (Gmail). Our databases are backed up every night; the section Backups below says how, where and for how long. To keep out automated submissions, the form runs a Cloudflare Turnstile check, for which Cloudflare processes your IP address and browser signals, and the email address and IP address of each attempt are kept for 24 hours to limit repeated submissions, then deleted; both rest on our legitimate interest in keeping the forms free of automated submissions (Article 6(1)(f)). The automation server's run log keeps the data of each run, including what you typed, for 14 days.

Your message is kept for as long as the conversation is live and is deleted at the latest 12 months after you sent it. What we agree in a project is recorded in the project itself, not in the briefing request.

Your rights

You can ask to see, correct, delete or restrict what we hold about you, receive what you gave us in a portable form, and object to any processing we base on legitimate interest, at any time by writing to [email protected] (the section Controller has the full details). Where we rely on your consent, you can withdraw it at any time, and what we did before then stays lawful. We answer within a month. If you believe your data has been handled wrongly, you have the right to complain to a data protection authority: the authority for us is the Hellenic Data Protection Authority (dpa.gr), and you can also complain to the authority of the country you live in.

Automation Audit requests

What we collect. On the Automation Audit page, step 1 takes the numbers you enter about one process (cases a month, minutes per case, the cost of an hour, the minutes a person still spends, or the people on the process and their yearly cost), the share of the work you expect AI to handle, the process category and a short description of it. Nothing from step 1 leaves your browser until you send step 2. Step 2 asks for your name, your work email address, your company, its company registration number, its website (optional), your country, the company size, your role, whether you decide on spending for this, when you want it solved, the budget you have in mind, the tools you use today, what you have tried already, whether you want a second opinion on another supplier's offer, and whether you agree to occasional updates by email. Your result from step 1 travels with the request as the numbers you entered; the values are recomputed on our side. If you came from a link with campaign tags, we record the tags with the request (see What we collect). If we talk, we keep our notes from the call. If you go ahead with an audit, we also keep your payment and invoice details, your answers to the audit questionnaire, and the report and offer we deliver.

Why we collect it. To reply to your request, to say honestly whether an audit would pay back for you, and to prepare for the call. To prepare, we also look at public information about your company: its own website, public business registers, search results, job postings, customer review portals and news. We do not use LinkedIn, and we do not research or profile the person who wrote to us; the AI model that summarises the public information is given your first name and role only. The registration number is used to identify the company in public registers. Each request gets a score from a fixed set of rules; the score decides whether we research the company before replying and in which order we reply. A person reads every request and writes every reply, so no decision about you is made solely by automated means.

Legal bases. Steps taken at your request before entering into a contract, for the reply and the call (Article 6(1)(b) GDPR), and our legitimate interest in preparing for the call from public information about your company and in ordering our queue (Article 6(1)(f)). Where you write to us on behalf of a company, the contract is with the company, and the basis for your own details (name, work email address, role) is our legitimate interest in dealing with the company through the person it names (Article 6(1)(f)). Invoices and payment records rest on our legal obligation under Greek tax law (Article 6(1)(c) GDPR, with Article 13(2) of the Code of Tax Procedure, law 5104/2024, and Article 7 of the Greek Accounting Standards). Occasional updates by email are sent only with your separate consent (Article 6(1)(a)), which you can withdraw at any time.

Who processes it for us. Your request is received and handled by an automation server we run (n8n, on a server we rent from Hetzner in Falkenstein, Germany). The same server keeps our database and turns the report into a PDF; nothing leaves it for that. Within that process:

• Anthropic, in the United States: an AI model summarises the public information about your company, drafts our reply and, for an audit, drafts the report and the offer, and, after a call, summarises our notes from the call and drafts the next message. A person reviews every draft before anything is sent. Anthropic processes this for us under standard contractual clauses (see Providers outside the EEA) and does not use it to train models.
• Telegram FZ-LLC: notifications to the founder. Until our internal tool is live, the cards on which he decides a step (whether and how we reply, the follow-up after a call, the report, the offer) reach him through Telegram and carry what that decision needs: your request, our research about your company, the drafted reply, the report draft or the offer. Every other notification carries only the request number, its state and its category. Telegram is a separate controller of what passes through its service (see Our internal tool and Providers outside the EEA).
• Google Ireland Limited (Google Workspace), with processing by Google LLC in the United States: the email we send you from this domain, our calendar, which holds the calls you book, and the video link for each call (Google Meet). Google keeps the sent emails and the calendar events for the periods in the table How long we keep it.
• Stripe: the payment of the audit fee. For its own fraud prevention and anti-money-laundering checks Stripe acts as a controller of its own.
• Elorus (Greece): our invoices. Each invoice is reported to the Greek tax authority (AADE) through myDATA, as the law requires of every Greek business.
• Supabase (Supabase Pte. Ltd., Singapore; the data itself is hosted on Amazon Web Services in Ireland): your client account, if you open one, and the documents we deliver in it (see Client account below).
• Cloudflare, Inc. (United States): this site's hosting and domain, so it processes the connection data of every visit (IP address, browser headers, time); the Turnstile check on the forms; the sign-in to our internal tool and its connection to the automation server; and the storage of our encrypted backups in the European Union.
• Toggl (European Union): we record the time we spend on your project under a client code, without names or message content.

Anthropic, Google, Stripe, Cloudflare, Supabase and Telegram are based outside the European Economic Area or may process data there; the section Providers outside the EEA names the safeguard for each.

Backups. Every night the automation server's databases and the client account (its database and its document storage) are copied. Each copy is checked, encrypted with a key whose private half is not on the server, kept encrypted on the automation server for 14 days (the Sunday copies for 8 weeks), and stored with Cloudflare in the European Union, where it is overwritten on the same schedule, so what we delete at your request also leaves the backups within about two months. Hetzner, from whom we rent the server, keeps an image of the whole server each day for seven days, so that we can restore it quickly after a failure; the image includes the encrypted copies. A copy cannot be edited, so we keep a register of deletion requests in our database: for each deletion we carry out at someone's request (of their requests, their client account, their newsletter subscription or another account with us), for each refusal or complaint in partner outreach and for each unsubscribe from our newsletter, it holds a cryptographic fingerprint (a SHA-256 hash) of the email address, never the address itself, with the time, the systems the data was deleted from and a reference to the request, for 6 months, longer than any copy lives. A restore would roll the register back with the rest, so every night its entries of the last 30 days are also exported, encrypted with the same key, and stored outside the databases, on the server and with Cloudflare; the exports of the last 90 days are kept. After any restore, including a restore of the Hetzner server image, we apply the register again before the system goes back to work, so that nothing we deleted at your request comes back from a copy. The register rests on our legal obligation to honour the deletion and our legitimate interest in being able to prove it (Article 6(1)(c) and (f)). The server also runs another project of the founder; the two are separated by their own system users and containers, and this site's data and backups are not readable by the other project. The basis for the backups is our legitimate interest in being able to restore our systems (Article 6(1)(f)) and our duty to keep the data secure (Article 32).

Keeping out automated submissions. The form uses Cloudflare Turnstile to keep out automated submissions, and Cloudflare processes your IP address and browser signals for that check. The email address and IP address of each attempt are kept for 24 hours to limit repeated submissions, then deleted. Both rest on our legitimate interest in keeping the forms free of automated submissions (Article 6(1)(f)).

Booking a call. Our emails link to a booking page on this site. The link carries a code of its own, works for 14 days and opens only your booking; you can ask for a new one on the page when it has expired, and we send it to the email address on your request. The page shows the free times from our calendar in the time zone of your device, which you can change; your browser remembers the zone you chose (see Cookies and browser storage), and nothing else. When you book, we keep the time, the kind of call and your time zone with your request, and our calendar gets an event with your name and email address as the guest and a Google Meet link. We email you a confirmation with a calendar file, and reminders before the call. You can move or cancel the call on the same page until two hours before it. To limit misuse of the page, the IP address and a fingerprint of the link of each attempt are kept for 24 hours, then deleted. Bookings are deleted with your request. The calendar event and the emails about the call stay in our Google Workspace account and are deleted when your request is deleted, at the latest 12 months after the last call. We do not record calls.

Signing an agreement. This paragraph describes the signing service as designed. If we agree on a project, the agreement and its statement of work are signed online, in a signing service we run ourselves (DocuSeal, on our own automation server in Falkenstein, Germany); its pages are served through Cloudflare, like this site. For each person who signs, it keeps the name, email address and job title, the signature as drawn, typed or uploaded, and a record of the signing: when the document was sent, opened and signed, with the IP address, browser and time zone. The statement of work also records your company's address and the people on your side who take part in the project (name, role, work email address). The signature is an ordinary electronic signature, not a qualified one; where the law requires a qualified signature, for example for a transfer of copyright, we ask for it separately. The signing service emails the link to sign and the signed copy from this domain through Google. Our automation server records only that the agreement was signed, when, and the terms of the statement of work, without the signers' details. If you sign for yourself as a sole trader or freelancer, the basis is the contract with you (Article 6(1)(b) GDPR). If you sign on behalf of a company, the basis for your details is our legitimate interest in knowing who was authorised to sign and in being able to prove the agreement (Article 6(1)(f)). The signed agreement, the statement of work and the signing record are kept for 20 years after the agreement ends, the period in which claims under it can be brought under Greek law (Articles 249 and 250 of the Greek Civil Code; the statutory minimum for the records is 5 years), and are backed up like our other data; the invoices are kept for the tax period below. A copy of your data and a deletion request cover the signing service too; we handle that part by hand.

How long we keep it. A request that does not lead to a call is deleted 12 months after it was sent, and one that leads to a call but not to an audit, 12 months after the call. A request that leads to an audit stays with your client account and is deleted with it (see Client account below); a request with a paid audit that is not in an account (because we agreed another way with you, or because you have not opened one) is deleted automatically 24 months after its last step. Invoices and the record of a paid audit are kept for 10 years after the end of the year in which the tax return for that year was due (the statutory minimum is 5 years, Article 13(2) of the Code of Tax Procedure; we keep them longer as a precaution), or longer while a tax audit, an appeal or an unpaid amount is open. The automation server's run log keeps the data of each run for 14 days; this covers the forms, the booking page, the briefing and the client account. The table How long we keep it at the end of this page lists every period.

Your rights. You can ask to see, correct, delete or restrict what we hold about you, object to the processing we base on legitimate interest, and receive the data you gave us in a portable form, by writing to [email protected]. Deleting a request removes it from the automation server, the client account and the document storage; invoices and the record of a paid audit stay for the tax period above, and in the sale record we replace your details with a pseudonymous identifier and keep the payment identifier that links to the invoice. You can complain to your data protection authority (see Your rights above).

Business case PDF

What we collect, why and on what basis. On the Automation Audit page you can ask for your calculator result as a PDF business case. For that we take your email address, the company name if you add one, the numbers and the short process description from step 1, the tick in the consent box with the time and the version of the wording, the time you click the link in our confirmation email, and the IP address of the attempt, kept for 24 hours. We use them for one purpose: to make the PDF and email it once to that address. We send the PDF only after you click the link in a confirmation email, so that nobody can order it to your address; if the link is not clicked within 14 days, the request is deleted and nothing is sent. We never send it to anyone else, and the form has no field for another address; forwarding the PDF is up to you. The basis is your consent (Article 6(1)(a) GDPR), which you can withdraw at any time by writing to us. The PDF adds no email address or name of yours; it shows the company name if you add one and the process description you wrote, in your own words. If you received it and did not ask for it, ignore the email and write to us: we delete the request.

Who processes it. The automation server, its database and the PDF maker described above; Google sends the confirmation email and the PDF from this domain; Cloudflare runs the Turnstile check; Telegram tells the founder that a PDF was sent, or that something failed, with the number of PDFs sent in the last 24 hours and the technical number of the run, without your details. No AI model is used to make the PDF.

How long we keep it. The request, with the record of your consent and of your click on the link, is deleted automatically 30 days after you sent it; a request whose link is never clicked is deleted 14 days after you sent it. The record of the attempt (email address and IP address, kept only to limit how often one address or one connection can ask) is deleted after 24 hours. Our encrypted backups (see Backups above) hold a copy of the database for up to about two months, so a deleted request also leaves them within that time. The automation server also keeps a technical record of each email it sends, which can hold the address, the confirmation link and the PDF, and removes it within 14 days. The copies of the emails in our Google Workspace account (the confirmation and the PDF) are deleted after 30 days. The mechanism that deletes the sent email after 30 days (a Vault retention rule or a documented monthly procedure) is not yet in place.

Client account

Only if you choose it. We open a client account only when you ask for one. That holds for a colleague whom an owner of a company account invites, too: the colleague's sign-in account is created only when they accept the invitation on a page of this site (see Colleagues in your company's account below). Our reply to your Automation Audit request (an invitation to a call, a question about the details or an answer without a call) carries a personal link to a page on this site that says what the account holds, why, for how long and what your rights are; the account is created only when you press the button on that page ("Create my account", or "Add it to my account" when your address already has an account with us). Opening the page creates nothing. Without an account nothing changes for your request: we answer it, and send every later step, by email, and nothing about you is stored in the account system. The paid audit is delivered in the account (the questionnaire, the report and the invoices), so if you buy it before you have one, our payment confirmation carries a link to the same page; if you would rather not use an account, reply to that email and we agree another way. Each of these emails carries a link of its own, which works for 30 days after that email; we keep only a fingerprint of each link, not the link itself, and our record of the emails we sent shows it shortened. On the page you can ask for a new link when yours has expired, and we send it to the email address on your request. To limit misuse of the page, the IP address and a fingerprint of the link of each attempt are kept for 24 hours, then deleted. When you open the account, we record when you did it, which of our emails carried the link you used, and which version of the page's information you saw; that record stays with your request. A link that has opened an account no longer shows your email address. No account is created for a request we decline.

What is stored. The account is a sign-in account without a password for the email address you gave. We keep it so that you can follow the request you sent us and receive the audit you order, steps you asked for (Article 6(1)(b) GDPR); where you act for a company, the basis for your own details is our legitimate interest in dealing with the company through the person it names (Article 6(1)(f)). When you open it, it shows your request as it stands that day, and every later step as it happens; what we sent you by email before stays in your email. No sign-in link is sent until you ask for one on the account page. The account holds your name and role, your company's name, registration number, country, website and size, its EU VAT number if an owner adds one and what the EU's VIES register says about it, its billing address, its billing country and, for a company outside the EU, its tax number if an owner adds them, your request with the numbers you entered and the values worked out from them, your orders with their price, VAT and status, the documents we deliver to you (the report, the offer and the invoices), your answers to the audit questionnaire and who in your company sent them, the implementation projects you go ahead with (their milestones, status, history and the results measured in your system, which are numbers only), a timeline of what happened with your request, whether you asked for email updates, and whether you want an email when something new is in the account. Nothing else from our work for you is in the account: our research notes, drafts and internal assessments stay in our own systems.

Emails about your account. When a project you follow in the account moves (a milestone ready for your acceptance, a pause and what we wait for, the launch), we email the owners and members of your company's account, through the same email service as our other messages. Several changes close together come as one email. Each person can turn these emails off in Settings; billing contacts do not get them.

Your VAT number. An owner can add the company's EU VAT number on the Company page. We check it in VIES, the European Commission's register of VAT numbers: our automation server sends VIES the number, and may send our own VAT number with it so that the check gets a reference, and keeps the answer: whether the number is valid, the name and address registered to it, and when we checked. A new number is checked once, and again only if VIES did not answer. We use the number for your invoices.

Your billing details. An owner can add the company's billing address, its billing country and, for a company outside the EU, its tax or business registration number on the Company page. We use them to issue your invoices: they appear on each invoice, the billing country, with the VAT number, decides which VAT rules apply to it, and they go with the invoice to our invoicing service (Elorus), which reports it to the Greek tax authority (AADE) through myDATA. The basis is the contract with your company (Article 6(1)(b) GDPR) and our legal obligation to issue invoices with the buyer's details under Greek tax law (Article 6(1)(c)). In the account they stay until an owner changes them or the account is deleted; on each invoice they are kept with the invoice data for 10 years after the end of the year in which the tax return for that year was due, or longer while a tax audit, an appeal or an unpaid amount is open (see How long we keep it).

A Special Code. When you enter a Special Code under the payment of an order, we keep a fingerprint of the code (a SHA-256 hash, not the code itself), your account and the time for 24 hours to prevent misuse of the codes, then delete them. The basis is our legitimate interest in preventing that misuse (Article 6(1)(f) GDPR).

Signing in. You sign in with a link sent to your email address. There is no password. Each link works once and expires after an hour, and a new one can be requested once a minute. Changing the email address on the account is confirmed from both the old and the new address.

Colleagues in your company's account. An owner of the account can invite colleagues by their work email address, as a member, who sees the requests, orders, reports and offers, or as billing, who sees the invoices and payment receipts. The owner sees everything, edits the company details, and can change roles and remove people. For an invitation we keep the colleague's email address, the role, who invited them and when, and email the colleague a personal link to a page on this site that says what the account holds, what we keep about them, why, for how long and what their rights are; we create the colleague's sign-in account and add them to the account only when they press the button on that page ("Join the account"). Opening the page creates nothing, and nothing is created for an invitation that is never accepted. The link works for 30 days after the email; we keep only a fingerprint of it, and our record of the email shows it shortened. On the page the colleague can ask for a new link when the latest one has expired (once a day, at most three times), and we send it only to the invited address. To limit misuse of the page, the IP address and a fingerprint of the link of each attempt are kept for 24 hours, then deleted. When the colleague joins, we record when, and which version of the page's information they saw; that record stays with their access to the account for as long as they have it. An owner can cancel an invitation that has not been accepted; its link then stops working at once. The invitation email itself tells the colleague who invited them, what we hold about them (their work email address, the role, who invited them and when), why, for how long, and where this policy is (Article 14 GDPR). The contract is with your company; the basis for the details of the people who use the account is our legitimate interest in giving access to the people your company names (Article 6(1)(f)). Everyone in the account sees the names and roles of the others; only an owner sees their email addresses. An invitation that is never accepted, or is cancelled, is deleted, with its address, 30 days after its last link stopped working (a cancelled invitation's link stops when it is cancelled), and at the latest 180 days after it was made; our copy of each email to it goes 90 days after that email. An invitation that is accepted, or could not be sent, is deleted, with its address and our copy of the email, 90 days after it was made. If you were invited and did not expect it, ignore the email, or reply to it and we delete the invitation; if you have joined, leave the account in its Settings or reply and we remove your access.

Who processes it for us. Supabase Pte. Ltd. (Singapore) hosts the account's database, sign-in and document storage on Amazon Web Services in the European Union (Ireland); see Providers outside the EEA. Google (Google Workspace) delivers the sign-in links from [email protected], and the invitations and the emails about your account from [email protected]. Cloudflare serves the pages. Our automation server creates your sign-in account when you press the button on the page, writes your request, orders, documents and timeline into the account, and creates the sign-in account of an invited colleague when the colleague presses the button on their invitation page; its run log keeps the data of each run for 14 days. Nothing is written to the account from the page itself apart from the details you edit there, your answers to the audit questionnaire and, for an owner, the invitations and roles of colleagues.

How long. The account stays for as long as you use it, and is deleted 24 months after the last activity on it: a request or an order, a step in either, a document, a sign-in or a change you make. We email you three days before, and a reply keeps the account. Invoices are kept for 10 years after the end of the year in which the tax return was due (see How long we keep it).

A copy of your data, and closing the account. In Settings you can ask for a copy of what the account holds about you and of what your role lets you see of your company, which we send as a download link within 24 hours (the link works for seven days). The copy holds what the account shows and, from our own records, your briefing requests, your business case requests and the records of every other service described on this page that you used; the signing service is covered by hand (see Signing an agreement). You can also close the account, which deletes it, your requests, your documents and the research we did for you within 30 days. Closing the account replaces your details on the sale record with a pseudonymous identifier; the invoice itself, with the buyer details the law requires, stays in our invoicing system for the tax period, and the PDF of each invoice and receipt stays in the account's document storage, where nobody signs in to it any more, until the end of the same period (longer while a tax audit, an appeal or an unpaid amount is open). If colleagues use the same company account, closing yours deletes only your sign-in and your profile, and the company's account stays with them until the last of them closes theirs; if you were its only owner, the colleague who joined first becomes the owner (a member before a billing contact). You can also ask for either by writing to [email protected].

Signal note

What we collect. On the Signal note page: your work email address and the domain of your company, when you agreed and which wording of the consent you saw, when you clicked the link in our confirmation email, and the IP address of the attempt, kept for 24 hours. We then keep the note we prepare, the public pages it rests on, what the run cost, who at Sophixum decided and when, and, if we do not send a note, a short reason written without names. A company domain can itself name a person (a sole trader's surname, for example); the model receives it only to read the public pages behind it.

Why we collect it. To prepare the one-page note you asked for and send it to you. It is about your company's public website, not about you. The AI model is given the domain, not your email address. A person at Sophixum reads every note before it is sent and may decide not to send one, without giving you a reason. We send one note per domain every 90 days, and only to an address you have confirmed by clicking the link in a confirmation email, so that nobody can order a note to your address; nothing is prepared before that click, and a request you do not confirm within 14 days is deleted. Every note carries a link to say no to any further note; replying also works.

Legal basis. Your consent (Article 6(1)(a) GDPR), given by ticking the box on the page and confirmed with the link in the confirmation email. You can withdraw it at any time with the link in a note or by writing to [email protected]. We then delete the request, the note, its card in our internal tool and the copy of the email in our sending log, and keep the record of your consent and of its withdrawal for 6 months (see How long we keep it below); for those 6 months we take no new request from that address, so nothing more is sent to it. The server's run log and the copies in our Google Workspace account go after 14 and 30 days, as described below.

Who processes it for us. The request is received and kept on our automation server (n8n, on a server we rent from Hetzner in Falkenstein, Germany). Within that process:

• Anthropic, in the United States: its search tool reads the public pages of your domain and an AI model drafts the note. It receives the domain, not your email address, and processes it under standard contractual clauses (see Providers outside the EEA).
• Our internal tool: the card on which a person at Sophixum reads the note and decides, with your address, the domain and the note; it is deleted 30 days after the decision, or at once if you withdraw your consent.
• Telegram: a notification to the founder that a note is waiting, with a link to its card in our internal tool, or, if a run fails, the technical number of the run, without your details.
• Google: the confirmation email and the email with the note, sent from this domain.
• Cloudflare: this site's domain and the Turnstile check on the form (see Keeping out automated submissions above).

How long we keep it. The request and the note are deleted automatically 90 days after you sent it at the latest. The email address and IP address of each attempt are kept for 24 hours to limit repeated submissions. The server's run log keeps the request and the note for 14 days, with the links of our emails. The copy of the email in our sending log is deleted after 30 days, and so are the copies of the emails in our Google Workspace account (the confirmation and the note). The mechanism that deletes these emails in Google Workspace after 30 days (a Vault retention rule or a documented monthly procedure) is not yet in place. The record of your consent (when you agreed, the wording, your click on the link, the last note and, if it comes to that, your withdrawal) is kept apart from the request and deleted 6 months after its last event: your confirmation, the last note or your withdrawal. A deletion request removes it at once. Encrypted backups are overwritten within about two months (see Backups above).

Your rights. As above: to see, correct, delete or restrict what we hold about you, to withdraw your consent, and to complain to your data protection authority. Deleting a request removes it, its note and its log entries from the automation server.

The week in five

This section describes the newsletter as designed. It goes live with the sign-up form, once our newsletter server is running.

What we collect. To get The week in five, our email on Sundays, you give your email address and, if you like, your name, and tick a box to say you agree. The consent box stands on its own; it is not joined to the terms or to this policy, and it is not ticked in advance. We keep them with the time you signed up and confirmed, the version of the consent wording, the list you are on and whether you are still subscribed. We do not record your IP address with the subscription.

Confirmation. The form sends one email to the address you gave. You are subscribed only when you click the link in it, and until then we send nothing else. After you confirm we send a short welcome email, and then The week in five. Every email carries a link to unsubscribe and a link to your preferences, where you can also choose your lists and download what we hold about you; to have it deleted, write to [email protected].

Legal basis. Your consent (Article 6(1)(a) GDPR). You can withdraw it at any time by unsubscribing, and what we did before then stays lawful.

Who processes it for us. The form is received by our automation server (see Automation Audit requests above): Cloudflare Turnstile checks it, the email address and IP address of each attempt are kept for 24 hours to limit repeated sign-ups, and the server's run log keeps the request for 14 days. The list itself is kept in Listmonk, a newsletter program we run on the same server, in a database of its own. The emails are sent through Brevo SAS (France), our sending provider, which receives your email address, your name if you gave it and the content of each email. Brevo records delivery only: we have turned off the tracking of opens and clicks before sending, a test email checks that before the sign-up form opens, and until that test is clean the form stays closed; our own newsletter program records no opens or clicks either. Brevo is bound to us by the data processing agreement in Appendix 3 of its terms of service; its US affiliate Brevo, Inc. is certified under the EU-US Data Privacy Framework (no. 10010) and, as a reserve, standard contractual clauses apply; Brevo's sub-processors include companies in the United States and India (see Providers outside the EEA).

How long we keep it. For as long as you are subscribed. If you unsubscribe, your subscription stays in our newsletter program for 6 months with the time you unsubscribed, as the record of your consent and of its withdrawal, as the Greek guideline on marketing consent allows. When you unsubscribe, a fingerprint (a hash) of your address, and nothing else, also goes into our register of deletion requests within about an hour, for 6 months (see Backups, under Automation Audit requests), so that restoring a backup cannot put you back on the list. After those 6 months an hourly clean-up on our automation server deletes the subscription from the newsletter program, and so that we never email you again by mistake, it first puts a cryptographic fingerprint (a hash) of your address, and nothing else, on an exclusion list for 24 months, on the basis of our legitimate interest in honouring your refusal (Article 6(1)(f) and Article 21(3)); the list is reviewed every 24 months, a new refusal renews the entry, and you can ask us to remove the fingerprint. While the fingerprint stands, a new sign-up with that address receives no email; write to us to have the fingerprint removed. A sign-up that is never confirmed receives nothing more and is deleted automatically after 14 days, by the same hourly clean-up.

Your rights. As above: you can ask to see, correct, delete or restrict what we hold about you, and to receive it in a portable form, by writing to [email protected]; a deletion we carry out on your request also goes into the register of deletion requests. You can unsubscribe and download your data yourself on your preferences page.

Our internal tool

Who works on your request. Requests, client accounts and our decisions on them are handled in an internal tool that only people working for Sophixum can open, signed in with their company Google account and a second sign-in step. Each person sees only what their role needs. The founder sees everything. An employee works on requests and client accounts, but not on our internal pricing. External technical support sees only identifiers, statuses and times, never names, addresses or what you wrote. A specialist from our network sees only the requests assigned to them, until that work ends. A contractor who helps with partner outreach works from outside the European Economic Area (Bangladesh) under a contract with us that includes the EU standard contractual clauses; they have access only to the Outreach section of the tool, within their role, and to a dedicated outreach mailbox in our Google Workspace, with no exports, and no access to our databases, the automation server or the requests you send us (see Partner outreach and Providers outside the EEA). Each person who can open the tool is bound in writing to confidentiality and to our instructions; an outside provider with regular access signs a data processing agreement with us. The basis for the tool, its log and the notifications is our legitimate interest in handling requests securely and being able to show who did what (Article 6(1)(f) GDPR).

The access log. Every action in the tool, such as opening a request, a client account, a decision or a data request, is recorded with who did it, when and from which IP address. The log can only be added to, and each entry is deleted after 24 months. A decision card (the request, our research and our internal pricing) is kept for 30 days after the decision, then deleted.

Notifications. The founder receives notifications through Telegram. Until this tool is live, the cards on which he decides a step (whether and how we reply to a request, the follow-up after a call, the report, the offer, closing an account, a case study draft) reach him there and carry what that decision needs: the request, our research, the drafted answer, the report draft or the offer; the card about closing an account carries only the request number and counts, and the case study card only project codes. Every other notification carries only the number of a request, its state and its category, never a name, an address, a company or a message. A notification about an email our assistant prepared (see Our assistant) carries only the number of that email, at most the name of its template, and its state (waiting for approval, about to leave, sent or not sent); the email itself, with the one-time code that releases it, is shown only in this tool, to the founder. When the tool goes live, the decision cards move into it, and on Telegram only a notification without personal data says that a decision is waiting. Telegram FZ-LLC is a separate controller of what passes through its service, and it offers no processing agreement for bots, which is why the decision cards move to the tool; messages for users in the European Economic Area are stored in the Netherlands and may be transferred within the Telegram group under its own standard contractual clauses. We delete the chat history after 30 days.

Our assistant. The founder also works with a private AI assistant in the Claude app, from Anthropic. As designed, when he asks, it reads requests and our calendar through our own connection on Cloudflare, which gives it the headers of our emails (sender, subject, date) and not their content; the content the founder reads in the Claude app through its own Gmail connection. Every weekday morning our automation server puts a summary for him into our own inbox; the assistant works under the same access log as a person in the tool, and never sees our internal pricing. When the founder works on the system itself, the app may also read the automation server's run records and the client account database through connections we run; each such reading happens on his instruction and is logged. It can email you only from one of our fixed templates, such as a meeting confirmation, to the address on your request, and only after the founder has read the email in this tool, where the one-time code that releases it is shown next to it, and given the assistant that code. That email is sent and kept like our other emails: through Google, in our mailbox, and for 14 days in the logs of our automation server. What the founder discusses with the assistant is kept in our Claude account with Anthropic. From the migration of our Claude account to a plan under Anthropic's Commercial Terms with its data processing addendum (standard contractual clauses, Irish law), Anthropic does not use what the founder discusses with it to train models. Until that migration, the assistant is not used on client data: it does not read client requests, client emails (not even their headers), the automation server's run records or the client account, and it prepares no email to a client; it reads only our own registers (see Our suppliers and contacts) and our calendar, where a booked call shows the name of the company or of the person in its title. The sentence on the Claude plan applies from the migration to the Team plan under the Commercial Terms; until then the assistant is not used on client data, as described above.

Who processes it for us. Cloudflare serves the tool, checks every sign-in (Cloudflare Access) and connects the tool to our automation server. Google provides the staff accounts. The data itself stays in our database on the automation server and in the client account; the tool keeps no copy of it.

Our suppliers and contacts

Our assistant also keeps our own registers: the contacts we work with (our accountant, suppliers, partners: name, role, work email address and telephone), the bills we receive (supplier, amount, due date, the supplier's bank account) and our deadlines. The basis is the contract or dealings with you (Article 6(1)(b) GDPR) or, for the people who represent a supplier or a partner, our legitimate interest in running the business (Article 6(1)(f)). Bills and the records of their payment are tax documents and are kept for 10 years after the end of the year in which the tax return was due; contact details are kept until the end of our cooperation and for 12 months after our last dealings. When an entry in the deadlines or the bills changes, its previous values (for a bill, also the supplier's bank account) are kept so that a mistake can be undone, and removed once they are 24 months old, with the next change in these registers. These registers live on our automation server and are backed up like our other data. The assistant reads and updates them in the Claude app at the founder's request, so Anthropic (in the United States, see Our assistant and Providers outside the EEA) receives what it reads. The people in them have the same rights as everyone else on this page.

Partner outreach

What this is. We write to companies that serve many small and mid-sized businesses, such as accountants, IT providers and resellers, to tell them about our referral programme, which pays a fee for introductions. People run these relationships; the automation only keeps the records, the legal rules and the sending limits. Our automated outreach emails, and those the person who runs the outreach for us writes, come from addresses at sophixum.net, a domain we own and use only for partner outreach.

What we collect. The company's name, website and country, a contact address (a general company address such as info@, or a named person's work address), the name of a named contact, where we found it and when, and what happened: which template was sent and when, and how the company answered, as a category only (interested, a question, no, and the like). If a company agreed to hear from us through another channel (a form, a call we noted, a meeting confirmed in writing), we record when, how and which wording it agreed to. We keep neither the text of our messages nor the text of the answers in our database. To judge whether a company could be a referrer, an AI model (Anthropic) reads the company's own public website and writes a short description and a score; Bouncer Sp. z o.o. (Poland, data on Amazon Web Services in Frankfurt) checks that an address exists before we write to it and keeps the address for up to 60 days.

Where the addresses come from. Public company websites, public business registers, public materials of industry events, and contacts our people made personally at events and meetings. Participant lists from events are used only where the organiser was entitled to share them and told you so; an AI model (Anthropic) reads such a list to turn it into contact records. We do not import contact lists from anyone's previous employment, and we do not scrape services whose terms forbid it.

Countries. In Greece, in Poland and in most EU countries an unsolicited email to a company needs its prior consent, so there we write only after the company has agreed through another channel, or where we already know each other. Today we write first only to addresses in the United States (company and named work addresses, with the identification, the postal address and the opt-out that United States law requires, honoured within 10 business days) and to company addresses in the United Kingdom (named people there only with consent). Every other country is closed to a first message until we have checked its law; Australia and New Zealand, whose rules rest on consent, stay closed. Where one of our people already knows a contact through a messenger, they may write there in person; we record only that a message was sent and the category of the answer.

Legal bases. Our legitimate interest in proposing a business partnership for IT and automation services to companies (Article 6(1)(f) GDPR), assessed in writing and reviewed by a lawyer; where a company agreed through another channel, that consent (Article 6(1)(a)). Our first message says who we are, that we write on the basis of that legitimate interest, where your address comes from (your company's website, a public register or the public materials of an event), what we hold (your name, if we have it, your work address, your company, your country and where we found the address), that you have the right to object at any time by replying with the word object or no, and where this policy is (Article 14). We write within 30 days of recording an address, or not at all: a cold contact we have not written to within 30 days is deleted.

Saying no. Every automated message says that replying no ends it, and carries an unsubscribe header. A no, a complaint or a failed delivery puts the address on our exclusion list: we store only a cryptographic fingerprint (a hash) of the address with a do-not-contact mark, for 24 months, reviewed every 24 months and renewed by any new refusal, on the basis of our legitimate interest in honouring your refusal (Article 6(1)(f), Article 21(3)); the record of your reply itself is deleted after 6 months.

Who processes it for us. Our automation server (n8n, Hetzner, Falkenstein, Germany) keeps the records. Anthropic (United States) reads the public pages of a company's website and classifies the category of an answer; the text of an answer is handled by the model but never stored by us. Bouncer checks addresses before sending. Google (Google Workspace: Gmail, on a separate sending domain, never this one) sends and receives the messages, in a dedicated outreach mailbox used for nothing else: the replies arrive there, our automation puts the drafts of our answers and the daily list of contacts there, and the person who runs the outreach writes from it in person. Telegram tells the founder that something needs attention, with counts only, never a name or an address. A contractor based in Bangladesh runs the outreach, with access only to the Outreach section of our internal tool and to that dedicated outreach mailbox, with no exports, under the conditions described in Our internal tool.

How long. A contact that never answers is deleted 6 months after our last message. The category of an answer, and the record of a consent and of its withdrawal, are kept for 6 months. The exclusion fingerprints: 24 months as above. The tasks of the person who runs the outreach are deleted 30 days after they are done, and the outreach journal (identifiers, counts and reasons, never an address, a name or any text) after 24 months. Replies, and our answers to them, stay in the outreach mailbox for 6 months. The mechanism that deletes the messages in the outreach mailbox after 6 months (a Vault retention rule or a documented monthly procedure) is not yet in place. A company that joins the referral programme becomes a referrer under the programme's terms; the outreach records about it are then deleted.

Your rights. You can ask to see, correct or delete what we hold, and object to this processing, by replying to any of our messages or writing to [email protected]. An objection or a deletion request removes the records and puts the address fingerprint on the exclusion list, so we never write again.

Case studies

We publish a case study about a project only with the client's written consent, and it does not name the client unless the client agrees separately. The consent of your company is not consent for the people in it: a person on your side is named or described in a case study only with their own consent; otherwise the study contains no personal data, and we check before publishing that nobody can be recognised from the context. If the company withdraws its consent, we stop distributing the study and remove it from our own channels within 30 days; if a person withdraws theirs, we remove or anonymise what describes them. We keep a minimal record of the consent and of its withdrawal (who, when, for what) in a separate register with restricted access, to be able to show that the publication was lawful (Article 6(1)(f), Article 17(3)(e)), for 6 months after the withdrawal; a deletion request removes everything else.

Cookies and browser storage

This site uses no advertising cookies, no behavioural tracking and no visit statistics. The table lists everything the site stores in your browser. None of it needs your consent: each entry is needed for a service you asked for, such as signing in or the check that keeps our forms free of automated submissions, or holds a setting you chose. Only this site reads its entries; the two Cloudflare cookies are read only by Cloudflare's bot protection, which works for us.

Providers outside the EEA

Where a provider is outside the European Economic Area, the transfer rests on one of the safeguards in Chapter V GDPR: the EU-US Data Privacy Framework (Commission Decision (EU) 2023/1795) for a certified provider, or the European Commission's standard contractual clauses. The table lists every provider that handles personal data for us, where it is, and the safeguard. You can ask us for a copy of the clauses we rely on. We watch the status of the Data Privacy Framework; if it is withdrawn, the standard contractual clauses apply alone.

The table is also the current list of the sub-processors we use for the personal data in our clients' projects, under Annex 1 of our master service agreement: they are marked "yes" in the last column, together with the subcontractors named in a statement of work. We tell our clients in writing at least 30 days before we add or replace one of them. The providers marked "no" handle only our own records (payments, invoices, our newsletter, our notifications, partner outreach), never the data of a client's project.

How long we keep it

Each period is counted from the event in the table. Where tax law sets a minimum, we keep the record for the longer period in the table as a precaution, and longer while a tax audit, an appeal or an unpaid amount is open. A record we delete leaves the backups within about two months (see Backups).

Controller

The controller is Sophixum IKE, a private capital company (ιδιωτική κεφαλαιουχική εταιρεία) registered in Greece, with its registered office at 28 Chalidon Street, 731 31 Chania, Crete, Greece; tax number (ΑΦΜ) 196834447, VAT number EL196834447; GEMI number to follow. Email for everything on this page, including your rights: [email protected].

No representative under Article 27 GDPR is required, as we are established in the European Union. We have not appointed a data protection officer; our processing is not large-scale monitoring of people.