Privacy policy

• We process what you enter in the estimate, the AI audit and the AI chat to answer your request, and what a web server logs with every visit.
• Without your consent, the site sets only what it needs to work. Google Analytics, Google Ads and the Meta Pixel load only if you allow them in the cookie banner, and you can change your choice at any time.
• The AI chat is an AI system: a language model writes its replies.
• Fonts, videos and 3D graphics load from our own server, not from Google or other third parties.

The controller under Art. 4 (7) GDPR is:

Our affiliated company BespokeIT Consultants OÜ (Tallinn, Estonia) provides IT services and software development for us. Where it handles personal data in doing so, it acts as our processor under Art. 28 GDPR and only on our instructions.

We have not designated a data protection officer. For any question about data protection, write to info@bespokeitconsultants.com.

This website is hosted by Vercel (details under “Who processes data for us”). Its server functions run in Vercel's Frankfurt region in Germany; static files are delivered through Vercel's global network, usually from a location near you.

With every request, Vercel processes what your browser sends: IP address, date and time, the page requested, the referring page, browser and operating system. This is needed to deliver the site and keep it secure, which is our legitimate interest (Art. 6 (1) (f) GDPR). The logs available to us are deleted automatically after 30 days at the latest.

Fonts, videos, images and 3D graphics are served from our own domain. No request goes to Google Fonts, YouTube or a similar service when a page loads.

We store information on your device or read it from there only where the site needs it to work, or where you have consented (§ 25 of the German Telecommunications Digital Services Data Protection Act, TDDDG).

Necessary (always on)

• NEXT_LOCALE: remembers the language you chose, so the site opens in it next time. Expires after one year.
• bespoke_consent: stores your choice in the cookie banner (which categories you allowed, and when). Expires after twelve months.
• Session storage: the estimate, the AI audit and the AI chat keep your answers and the conversation in your browser's session storage, so a reload or a step back loses nothing. This stays on your device and is deleted when you close the tab.

These are strictly necessary to provide the service you asked for (§ 25 (2) no. 2 TDDDG). Any personal data involved is processed on the basis of our legitimate interest in a working website (Art. 6 (1) (f) GDPR).

Statistics and marketing (only with your consent)

Google Analytics (statistics), Google Ads and the Meta Pixel (marketing) store or read information on your device only after you allow the matching category in the cookie banner (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG). Until then, none of their scripts is loaded. The banner appears only while at least one of these tools is switched on for this site, and the site works fully without your consent.

Changing or withdrawing your consent

You can change or withdraw your consent at any time with “Cookie settings” at the bottom of every page, with effect for the future. When you withdraw it, we delete the tracking cookies we can reach on our own domain (_ga, _ga_*, _gid, _gat*, _gcl_*, _gac_*, _fbp, _fbc) and load nothing further; a script that has already loaded stops after the next page load. Cookies that Google or Meta set on their own domains can only be deleted in your browser.

If you allow statistics, we use Google Analytics 4 to understand how the site is used, for example which pages are visited and how visitors move between them. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, which processes the data on our behalf (Art. 28 GDPR). We use Google Consent Mode: until you consent, no Google tag is loaded.

Google Analytics processes pseudonymous usage data: the pages you view, the time and length of your visit, the referring page, device, browser and your approximate location, and, when you send an estimate, an AI audit or your contact details in the chat, an event that names only which of the three it was. It stores an identifier in the cookies _ga and _ga_* (up to two years). Google Analytics 4 does not log or store IP addresses; it uses them only to derive the approximate location.

Event data in Google Analytics is deleted after 14 months at the latest.

Google may also process the data in the USA. Google LLC is certified under the EU-US Data Privacy Framework, for which the European Commission has adopted an adequacy decision (Art. 45 GDPR).

Legal basis: your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG), which you can withdraw at any time.

Google Ads conversion tracking and remarketing

If you allow marketing, we use Google Ads conversion tracking and remarketing from Google Ireland Limited (address above). It tells us whether an ad led to an enquiry and lets us show our ads again to people who visited this site. Google stores an identifier in the cookie _gcl_au (90 days) and may set or read cookies on its own domains. Google also uses this data for its own purposes, as an independent controller.

Meta Pixel

If you allow marketing, we use the Meta Pixel of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. It tells us whether ads on Facebook and Instagram lead to enquiries and lets us show our ads to people who visited this site. The pixel stores identifiers in the cookies _fbp and _fbc (90 days each) and sends Meta your IP address, browser data, the pages you visit and the events below. If you are logged in to Facebook or Instagram, Meta can link the visit to your account.

For collecting this data and transmitting it to Meta, we and Meta are joint controllers (Art. 26 GDPR); Meta is solely responsible for any processing after that. Our agreement with Meta is Meta's Controller Addendum.

What we report

When you successfully send an estimate, an AI audit or your contact details in the AI chat, we report a “Lead” conversion to Google Ads and Meta. It carries no name, email address or phone number.

Google LLC and Meta Platforms, Inc. in the USA may receive the data. Both are certified under the EU-US Data Privacy Framework (Art. 45 GDPR).

Legal basis: your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG), which you can withdraw at any time.

Estimate

The service, your scope answers, data sensitivity, hosting requirement and timeline, a short description if you write one, and your name, work email, company and, if you give it, phone number. We use them to calculate an indicative range, send it to you by email and follow up on it.

Free AI audit

Company size, industry, and the use cases, systems, data and hosting situation, timeline and goal you select, plus your name, work email, company and, if you give it, phone number. We use them to calculate your readiness score, send you the written audit by email and follow up on it.

AI chat (Bespoke One Coworker)

Your messages go to our AI provider Groq so a language model can write the replies. If you share your work email or phone number on the chat's contact card, we store them with your name and company if given, a short summary of your request, the page you came from and the conversation so far, so that we can follow up. Later replies in the same conversation (for example an estimate) are added to that record.

Booking a call

Sam's calendar on the contact page and in the AI chat is provided by Cal.com. Nothing loads from Cal.com until you click to show the calendar; from then on Cal.com receives your IP address and browser data and may store information in your browser. In the chat, the name and email address you shared are passed on to fill in the booking form. If you book, Cal.com processes your name, email and what you write in the booking form, so that we can hold the call.

Emails

Every enquiry reaches our sales inbox and our customer database (Airtable). For the estimate and the AI audit, we also email you your result (sent through Resend). The AI chat sends you no email. If you write to us by email, we process your address and your message to answer you.

Legal basis

We process this data to answer your request and prepare a possible contract (Art. 6 (1) (b) GDPR). Where you ask a general question, our legitimate interest in answering it is the basis (Art. 6 (1) (f) GDPR).

Bespoke One Coworker is an AI system: its replies are written by a language model, not by a person, and they can be wrong. Figures and price ranges in the chat come from our estimate model, not from the language model's own text.

We process your messages only to write the replies, to protect the chat against abuse and, if you share your contact details, to follow up on your request. Please do not enter special categories of personal data (Art. 9 GDPR), such as health data, in the chat.

To stop automated abuse, the estimate, the AI audit and the AI chat use your IP address (for IPv6, only its network part) as a key in a rate limiter at Upstash. The estimate and the AI audit each accept five submissions per hour, the chat's contact card five per hour and ten per 24 hours; the chat itself answers 30 messages per 10 minutes and 150 per 24 hours, and one conversation up to 50 messages per 24 hours. This is our legitimate interest in a secure, available service (Art. 6 (1) (f) GDPR).

Each entry is deleted automatically when its window ends, after 24 hours at the latest. The chat's daily usage counter and the count of blocked messages contain no personal data.

We use these service providers. Each processes personal data only on our behalf, under a data processing agreement (Art. 28 GDPR); Google Analytics only if you consent.

Beyond these, we pass on personal data only where the law requires it, for example to authorities.

Enquiries from the estimate, the AI audit, the AI chat and by email: as long as we need them to handle your request and follow up on it, and at the latest 3 years after our last contact, unless a contract follows. If one does, the statutory retention periods apply (up to ten years for commercial and tax records, § 257 of the German Commercial Code, HGB, and § 147 of the German Fiscal Code, AO).

• Server logs: 30 days at the latest.
• Rate limiter entries: when their window ends, after 24 hours at the latest.
• Session storage: when you close the tab.
• Language cookie: one year. Consent cookie: twelve months.
• Google Analytics: 14 months at the latest; marketing cookies as stated above.

You have the right to:

• access the data we hold about you (Art. 15 GDPR)
• have it corrected (Art. 16 GDPR)
• have it deleted (Art. 17 GDPR)
• restrict its processing (Art. 18 GDPR)
• receive it in a portable format (Art. 20 GDPR)
• withdraw any consent you gave at any time, with effect for the future (Art. 7 (3) GDPR)

Your right to object

Where we process your data on the basis of legitimate interests (Art. 6 (1) (f) GDPR), you can object at any time on grounds relating to your particular situation (Art. 21 (1) GDPR). You can object to the use of your data for direct marketing at any time, without giving reasons (Art. 21 (2) GDPR).

To use any of these rights, email info@bespokeitconsultants.com.

You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the one responsible for us:

The readiness score of the AI audit and the range of the estimate are calculated automatically from your answers. They are recommendations, not decisions: they have no legal or similarly significant effect on you (Art. 22 GDPR).

No. But without a name, an email address and your request, we can't reply to you.

This website is aimed at businesses. It is not directed at children, and we do not knowingly process the data of children under 16.

We update this policy when the site or the law changes. The date at the top shows the current version.