Privacy Policy

Aivarize ("we", "our", "us") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, and safeguard information when you visit www.aivarize.com or engage with our services. It also says plainly which processing runs today and which is planned but not yet live.

1. Who We Are

Aivarize builds and runs AI systems for owner-led businesses and operates in accordance with the EU General Data Protection Regulation (GDPR).

2. Data We Collect

2.1 Information You Provide

We collect personal data that you share with us directly:

• • The assessment: your name, email address, business name, your five answers, and your website address if you choose to share it, when you take the assessment on our assessment page
• • Call bookings: your name, email address, and anything you write in the booking notes, when you book a call through our scheduling form
• • Direct contact: anything you send us by email

2.2 Information Collected Automatically

With your consent (see Cookies below), we use analytics tools to gather limited technical data, including:

• • IP address, browser type, device information, operating system
• • Pages visited, session duration, and referral sources

This data helps us understand how visitors use our website and improve its performance.

2.3 Payment Information

Payments, when applicable, are processed through secure third-party payment providers. We do not store payment card details.

3. How We Use Data, and On What Legal Basis

We process personal data only for the purposes below, each with its GDPR legal basis:

• • Assessment data and follow-up emails: used to score your assessment, send you your result, and follow up with a short email sequence about it. No newsletter. Legal basis: consent (Art. 6(1)(a)), given through the required checkbox before you submit. Every email includes an unsubscribe link, and you can also withdraw consent by emailing us; we then stop and delete your data.
• • Lead enrichment: publicly available business context added to assessment submissions so follow-up is relevant. Legal basis: legitimate interest (Art. 6(1)(f)), with the right to object at any time.
• • Call bookings: used to schedule, hold, and follow up on the call you asked for. Legal basis: steps taken at your request prior to entering a contract (Art. 6(1)(b)).
• • Client work: used to deliver contracted services. Legal basis: contract performance (Art. 6(1)(b)).
• • Analytics: used to improve website performance and user experience. Legal basis: consent (Art. 6(1)(a)), given through the cookie banner.

We do not use your data for purposes beyond these without telling you first.

4. Use of Automation and AI

We use AI-enabled systems to assist with internal analysis, drafting, and workflow support. These systems may process limited business-related information to improve speed and accuracy. All processing follows GDPR principles of data minimization and purpose limitation. We do not make automated decisions that produce legal or similarly significant effects about you.

5. What Runs Today, and What Is Planned

We would rather be precise than vague about this:

Running today:

• • The assessment: a five-question assessment with a scored result. It stores your answers together with your contact details. Consent is a required checkbox at the point of capture, and nothing is stored without it.
• • Lead enrichment: we add publicly available business context (such as company name and role) to leads who take the assessment, so follow-up is relevant instead of generic. Legal basis: legitimate interest (Art. 6(1)(f)), with the right to object at any time. If you object, we stop and delete the enriched data.
• • Automated email follow-up: a short sequence of emails for people who take the assessment. Every email includes an unsubscribe link, and unsubscribing stops the sequence immediately.
• • Call bookings: processed through our scheduling provider.
• • Analytics: runs only with cookie consent.

Planned, not yet live. When this launches, this policy will be updated first and the feature will carry its own consent notice:

• • Messaging follow-up: follow-up over messaging channels (such as WhatsApp) for people who explicitly opt in to it.

Until an item in the planned list is live, none of that processing happens.

6. Cookies and Tracking

We use essential and analytics cookies to operate and measure the effectiveness of our website. Non-essential cookies are only activated after you give consent through our cookie banner. You can change or withdraw your consent at any time in your browser or cookie settings.

7. Data Storage and Security

Personal data is stored securely in trusted cloud infrastructure within the European Economic Area (EEA) or with providers offering adequate data protection safeguards. We apply appropriate technical and organizational measures to prevent unauthorized access, alteration, or disclosure.

8. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes outlined above:

• • Assessment data: up to 12 months after your last interaction, or immediately on request or unsubscribe when there is no other reason to keep it
• • Booking and inquiry data: up to 12 months after last interaction
• • Client data: for the duration of the relationship and as legally required thereafter
• • Analytics data: retained in aggregated, non-identifiable form

Earlier versions of this site included a contact form; it has been removed. Submissions received through it are retained under the inquiry rules above, and no new submissions are collected.

9. Data Sharing and Sub-Processors

We may engage carefully selected service providers to host, process, or analyze data on our behalf. These providers act as data processors under GDPR and are bound by contractual data-protection obligations. The current categories of such processors are:

• • Cloud hosting and database services
• • Call scheduling
• • Transactional email delivery
• • Analytics and performance monitoring
• • Payment and invoicing providers

We do not sell or share personal data for marketing by third parties.

When data is transferred outside the EEA, we rely on Standard Contractual Clauses (SCCs) or other lawful transfer mechanisms.

9.1 Data Processing Agreements and Safeguards

We maintain Data Processing Agreements (DPAs) and/or rely on Standard Contractual Clauses (SCCs) with our key service providers to ensure GDPR-compliant data handling. Our main processors include:

• • Database provider (assessment and booking data): EU hosting
• • Website hosting (site delivery): Standard Contractual Clauses in place
• • Email delivery provider (assessment result and follow-up emails): GDPR-compliant data processing terms
• • Scheduling provider (call bookings): GDPR-compliant data processing terms
• • Google Cloud Platform (analytics): Covered by Google's GDPR compliance framework
• • OpenAI/Anthropic (AI processing): Enterprise agreements with data protection addendums

You may request copies of these agreements by contacting support@aivarize.com.

10. Your Rights

You have the right to:

• • Access and receive a copy of your data
• • Request correction or deletion of your data
• • Object to or restrict certain processing activities
• • Withdraw consent where processing is based on consent
• • Lodge a complaint with your local supervisory authority or the Finnish Data Protection Ombudsman

11. Updates to This Policy

We may update this Privacy Policy from time to time to reflect changes in technology, law, or our business practices. The latest version will always be available on this page.

12. Contact

If you have any questions or concerns about this Privacy Policy or how we process your data, contact: