Your data,
handled properly.
What we collect, why we need it, who helps us run things, and how you stay in control.
We collect very little, and never sell it.
- Analytics and marketing cookies only run if you accept them. Reject, and neither Google Analytics nor the Meta Pixel loads.
- What you send us through a form, the audit, a booking or an email is used to reply and to help you. If you switch Marketing on, we also tell Meta when you get in touch, to measure our ads.
- A few trusted providers help us run things. Some are in the USA, under EU-approved safeguards.
- You can see, correct or delete your data any time. Email hello@zeroarc.ai.
Who we are
This policy explains how ZERO ARC AI LIMITED, a private company limited by shares registered in Ireland, Company No. 807786, Tipperary, Ireland ("ZERO ARC AI", "we", "us") collects and uses personal data. We are the controller of the personal data described here.
It covers this website (zeroarc.ai), our free AI Opportunity Finder at audit.zeroarc.ai, and what happens when you email us or book a call with us. When we work for a client under a contract, the contract and a separate data processing agreement cover the client's own data.
Registered in Ireland, Company No. 807786
We work with clients remotely.
We're a small company and aren't required to appoint a Data Protection Officer. Our founder is responsible for privacy and answers every request personally.
We're based in Ireland and also work with businesses in the United Kingdom. If you're in the UK, the UK GDPR and the Data Protection Act 2018 protect your data as well, and everything in this policy applies to you in the same way.
What we collect, why, and our legal basis
We only collect what we need to answer you, run the site and do the work. Here is every situation where we handle personal data, what we collect, why, and the lawful basis under the GDPR.
| When | What we collect | Why | Lawful basis |
|---|---|---|---|
| You browse the site | Your IP address, browser and device type, the page you asked for and the time. This is recorded in our hosting provider's technical logs. | To deliver the pages, keep the site secure and fix problems. | Legitimate interests (running a secure website), Art. 6(1)(f) |
| You accept analytics | Pages you view, how you arrived (for example a search or a link), rough location (country and city, worked out from your IP address, which Google Analytics doesn't store), device and browser, and a random ID kept in a cookie. If you accept, Promptwatch also records your visit, to show us which visits come from AI assistants such as ChatGPT. | To see which pages are useful and improve the site. | Your consent, Art. 6(1)(a), and Regulation 5 of the ePrivacy Regulations (S.I. 336/2011). Nothing is collected if you reject. |
| You accept marketing cookies (Meta Pixel) | Pages you view on zeroarc.ai and audit.zeroarc.ai, the ad click that brought you here, a random browser ID kept in a cookie, your IP address and browser. If you then send an enquiry or start the AI Opportunity Finder, our server also tells Meta directly, through Meta's Conversions API: your email address, phone number, name and country, scrambled (hashed) before they are sent, and our reference number for your enquiry. Later, whether you booked a call, became a likely client or paid an invoice, and the amount paid. Never what you wrote in a form. | To measure which Facebook and Instagram ads bring enquiries and clients, and to help Meta show our ads to people likely to be interested. | Your consent, Art. 6(1)(a), and Regulation 5 of the ePrivacy Regulations (S.I. 336/2011). Nothing is sent if Marketing is off. |
| You reply to one of our Facebook or Instagram lead ads | What you enter in Meta's form (usually your name, email and phone number) and which ad and campaign you came from. Later, whether you booked a call, became a likely client or paid an invoice, and the amount paid, sent back to Meta. | To reply to you, and to tell Meta which of our ads led to real clients so it can improve them. | Steps you ask us to take before a possible contract, Art. 6(1)(b), for replying. Our legitimate interest in measuring and improving our advertising, Art. 6(1)(f), for what we send back to Meta. You can object at any time. |
| You send the "See what we'd change" form | Your name, email, company, website, type of business, team size, the jobs that keep coming back, your written answers, the systems you use, the page you sent it from and the site that referred you. | To reply with the changes we'd make and decide together whether working with us makes sense. | Steps you ask us to take before a possible contract, Art. 6(1)(b), and our legitimate interest in answering business enquiries, Art. 6(1)(f) |
| You use the AI Opportunity Finder (audit.zeroarc.ai) | Your name, email, the type of audit you choose, your answers (industry, role, team size, where time goes, admin hours, tools, AI experience, 90-day goal) and the report we generate. We also record the campaign tags and ad-click ID in the link you followed (utm_source, utm_medium, utm_campaign, utm_content, utm_term and fbclid), the page you landed on and the time you sent your details. These are read from the link itself, not from a cookie, so we record them whether or not you accept cookies. | To create your report, email it to you, and follow up about it. The campaign tags tell us which of our ads and campaigns bring people to the finder. | Providing the free report you asked for, Art. 6(1)(b); following up about it, and measuring which campaigns bring enquiries, are our legitimate interests, Art. 6(1)(f). |
| You book a call (cal.com) | Your name, email, company name, how many people work in the business, what you'd like off your plate, how you heard about us (if you say), and the time you pick. We get a calendar invitation. | To arrange and run the call. | Steps you ask us to take before a possible contract, Art. 6(1)(b) |
| You email us | Your email address and name, your message and any attachments. | To reply and keep a record of the conversation. | Legitimate interests, Art. 6(1)(f), or steps before a contract, Art. 6(1)(b) |
| You join our newsletter or marketing emails (Brevo), for example by ticking the optional email box on the "See what we'd change" form | Your email address, your name if you give it, when and how you signed up (including the exact wording you agreed to), and whether you open our emails or click links in them. | To send newsletters and marketing emails to people who opted in, and to see which emails are useful. | Your consent, Art. 6(1)(a). For existing clients, emails about services like the ones you already use under the "soft opt-in" in Regulation 13 of the ePrivacy Regulations (S.I. 336/2011), with a way to opt out in every email. |
| You become a client | Contact details, the contract, invoices and payment records, and the work we do together. | To deliver the work, bill for it and meet our legal duties. | Contract, Art. 6(1)(b), and legal obligation (tax and company law), Art. 6(1)(c) |
Please don't send us sensitive information (for example health details) in forms or the audit. We don't need it.
How the AI Opportunity Finder uses AI
When you finish the AI Opportunity Finder, your answers are sent to Anthropic's Claude API, which drafts your report and the personal part of the email we send you. Under Anthropic's commercial terms, data sent through its API isn't used to train its models.
The report is a set of suggestions. It doesn't make any decision about you with legal or similarly significant effects, so the rules on solely automated decisions in Art. 22 GDPR don't apply. A person at ZERO ARC AI reads it before we suggest any work.
Transfers outside the EU and UK
Some providers above are based in the USA. Where personal data leaves the European Economic Area, we rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework (for certified companies) and on the Commission's Standard Contractual Clauses, with the extra safeguards each provider offers, such as encryption in transit and at rest. For people in the UK, we rely on the UK's adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework) and the UK Addendum to the Standard Contractual Clauses. You can ask us for a copy of the relevant safeguards at hello@zeroarc.ai.
How long we keep it
We keep personal data only as long as we need it, then delete or anonymise it.
| Data | How long |
|---|---|
| Hosting logs | A few days, under our hosting provider's log settings |
| Google Analytics data | 2 months, then Google deletes it automatically |
| Enquiries, form answers, AI Opportunity Finder results, booking details and emails that don't lead to work | 2 years from our last contact with you |
| Client records, contracts, invoices and payments | 6 years after the end of the financial year the work ended, as Irish tax and company law requires |
| Newsletter and marketing email list | Until you unsubscribe. After that we keep only your email address on a suppression list, so we never email you marketing again by mistake |
| Our record of what we sent to Meta (whether it arrived, never your raw email or phone) | 90 days |
| Your cookie choice | 6 months in your browser, then we ask again |
If you ask us to delete your data earlier, we will, unless the law requires us to keep it.
Your rights
Under the GDPR, and the UK GDPR if you're in the UK, you have the right to:
- Access the personal data we hold about you and get a copy.
- Correct data that is wrong or incomplete.
- Delete your data ("right to be forgotten").
- Restrict how we use it while a concern is checked.
- Object to uses based on our legitimate interests, and to direct marketing at any time.
- Port data you gave us, in a common machine-readable format.
- Withdraw consent at any time, for example by turning analytics or marketing off in . This doesn't affect anything done before.
Email hello@zeroarc.ai to use any of these rights. It's free. We reply within one month, and may ask you to confirm your identity first.
Complaints
If you're unhappy with how we handle your data, please tell us first so we can put it right. You also have the right to complain to the Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland, www.dataprotection.ie. If you're in the UK, you can complain to the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, ico.org.uk, 0303 123 1113. Elsewhere, you can complain to the data protection authority where you live or work.
Cookies
We only use analytics and marketing cookies if you accept them. Strictly necessary storage remembers your cookie choice. The full list, with names and durations, is in our Cookie Policy.
Emails from us
We reply to the messages you send us and email the reports you ask for.
Newsletters and marketing emails. We only send these if you've opted in (for example by ticking the optional, unticked email box on our "See what we'd change" form; sending the form without ticking it doesn't sign you up), or if you're an existing client and the email is about services like the ones you already use (the "soft opt-in" allowed by Regulation 13 of the ePrivacy Regulations, S.I. 336/2011). We send them through Brevo (Sendinblue SAS, France), and your data is stored in the EU.
Open and click tracking. Like most email tools, Brevo can tell us whether an email was opened (using a tiny image in the email) and which links were clicked (using tracked links). We use this only to see which emails are useful. You can block it by turning off images in your email app.
Changing your mind. Every marketing email has an unsubscribe link, or you can email hello@zeroarc.ai. You can withdraw consent at any time, and it doesn't affect emails we sent before. When you unsubscribe, we keep your email address on a suppression list only so we don't email you again.
Keeping data safe
The whole site is served over HTTPS with modern encryption (TLS 1.2 and 1.3), and browsers are told to always use a secure connection. Access to enquiry and client records is limited to the people who need it. Our providers are established companies with their own security programmes and certifications.
Children
Our site and services are for businesses. They aren't aimed at children, and we don't knowingly collect data from anyone under 16. If you think a child has sent us personal data, email us and we'll delete it.
Changes to this policy
We'll update this page when our data handling changes, and change the date at the top. If a change is significant, we'll make it clear on the site, or tell you directly if we have your email.
Questions about this policy? Email hello@zeroarc.ai.