Privacy policy: what data we collect and why

Who we are

The data controller is ARHAI SRL, a company registered in Romania, with its registered office at Str. Piatra Craiului 36G, 410605 Oradea, Bihor County, Romania. You can reach us at contact@arhai.ro or on +40 750 265 636.

What we collect

This site collects personal data in four situations, and only these:

1. When you fill in a form

Your name, email address, phone number, the service you are interested in and the message you write. Optionally, if you fill them in: your company name, a rough budget, your timeline, team size, the software you use and how you found us. We also record the page you sent the form from and the language of the site. We collect exactly what you enter — nothing more, no profiling and no enrichment from external sources.

Legal basis: your consent, given through the checkbox on the form, and our legitimate interest in answering a business enquiry you send us.

Purpose: to reply to you, to prepare a quote and, if it gets that far, to enter into a contract.

How long we keep it: 24 months from our last interaction if you do not become a client. If you do, for the duration of the contract plus the archiving periods required by law. You can ask us to delete it at any time.

2. When you subscribe to the newsletter (Radar AI)

Your email address, language, the page you subscribed from, your browser type and proof of consent: the text you ticked, the date you subscribed and the date you confirmed. We do not store your IP address in clear, only a cryptographic fingerprint from which it cannot be reconstructed.

Subscription is double opt-in: you receive an email with a link, and you are added to the list only after you press the confirmation button. Every newsletter email contains an unsubscribe link.

Legal basis: your consent. How long we keep it: for as long as you are subscribed. After you unsubscribe, we keep your address, the date you unsubscribed and the record of your original consent, so that we do not write to you by mistake and can show that we had your consent. We delete them entirely if you ask us to.

3. When you write in the chat on this site

The chat in the corner of the page runs on Leaply, a conversation platform developed and operated by us. We receive the messages you write, any contact details you choose to give us (name, phone number, email), the page you are on and where your visit came from: the page you landed on, the referring site and any campaign parameters in the URL (for example utm_source, gclid, fbclid).

The first replies are generated automatically by an AI assistant (a “virtual agent”), and a member of our team can take over the conversation at any time. To write each reply, the conversation text is sent to Anthropic’s Claude models and, as a fallback, to OpenAI’s models (see “Who else has access to the data” below). If you leave contact details, the conversation goes into our internal CRM, just like a form submission.

Legal basis: steps taken at your request before a possible contract, and our legitimate interest in answering you. Purpose and retention: the same as for the form — 24 months from our last interaction if you do not become a client.

4. If you accept measurement

The site loads no measurement or advertising scripts and sets no cookies until you explicitly press “Accept” in the bar at the bottom of the page. If you choose “Essential only”, none of this loads and the site still works in full.

If you accept, we load Google Tag Manager, which in turn activates Google Analytics 4, the Meta pixel and the Google Ads conversion tag. These collect data about your browsing: the pages you visit, where you came from, your device type and identifiers stored in cookies.

Again, only if you have accepted: when you submit a form or confirm your newsletter subscription, our server also notifies Meta (through the Conversions API) that a conversion took place, so we know which ads bring in enquiries. Your email address, phone number and first name are sent only as a cryptographic fingerprint (SHA-256 hash), never in clear. Along with them, Meta receives your IP address, browser type and the identifiers from Meta’s cookies, if present. Without “Accept”, nothing is sent.

Until you press “Accept”, your browser receives an explicit instruction from us (Consent Mode v2, default state denied) telling Google’s services not to store anything and not to use advertising identifiers. This is not just a promise on a page: it is a setting you can check yourself in your browser console.

Legal basis: your consent. You can withdraw it at any time from Cookie settings, the link in the footer of every page.

Who else has access to the data

Resend (Plus Five Five, Inc.): a service the site may use to send email, alongside our own mail server — the notification to us when you submit a form, the confirmation to you and the newsletter emails (subscription confirmation and welcome message). When Resend is used, emails are sent from its data centre in Ireland, under a data processing agreement (DPA).
ArhAI CRM: our internal system for tracking enquiries, hosted on our own infrastructure. Form submissions, and chat conversations in which you leave contact details, go there so that no conversation gets lost.
Leaply: our own conversation platform, which powers the chat on this site. The application and its database are hosted in Romania by Acvile Tech S.R.L. (Cloudify.ro). Backups are kept encrypted with Hetzner Online GmbH (EU). When continuous replication is switched on, a database replica is also kept in Cloudflare R2 (Cloudflare, Inc., USA, with storage preferably in Europe).
Anthropic (Anthropic PBC, USA): the Claude models that write the chat replies. They receive the conversation content and the assistant’s instructions, only to generate the reply. OpenAI (OpenAI, L.L.C., USA) is the fallback provider for replies and may also be used to search the information loaded into the assistant. Under their API terms, neither uses this data to train models by default; they may keep it temporarily to prevent abuse. Transfers to the US rely on the safeguards provided by the GDPR (the EU-US Data Privacy Framework and/or standard contractual clauses).
Mailchimp (Intuit Inc., USA): only the addresses of subscribers who have confirmed their newsletter subscription, so that we can send it. Transfers to the US rely on the safeguards provided by the GDPR (the EU-US Data Privacy Framework and standard contractual clauses).
Google Ireland Limited and Meta Platforms Ireland Limited: only if you have accepted measurement (for Meta, this includes the conversions sent from our server, with contact details only in hashed form).
Our data centre: the site, our CRM and Leaply run on servers we manage, in a data centre in Romania operated by Acvile Tech S.R.L. (Cloudify.ro).

We do not sell data. We do not pass it on for anyone else’s marketing. We do not train artificial intelligence models on your data.

Fonts and external resources

The fonts used on this site are hosted by us, not loaded from Google. This means your IP address does not reach a third-party server just because you opened a page.

Your rights

Under the General Data Protection Regulation (GDPR) you have the right of access, rectification, erasure, restriction of processing, data portability and objection, as well as the right to withdraw your consent at any time.

Write to contact@arhai.ro and we will reply within 30 days at the latest — usually within the same week. If you are not satisfied with our answer, you can complain to the Romanian data protection authority, which supervises us because our company is established in Romania: ANSPDCP (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal), B-dul General Gheorghe Magheru 28–30, Sector 1, Bucharest, Romania (dataprotection.ro). If you live or work in another EU country, you may also lodge a complaint with the data protection authority there.

Security

Traffic to the site is encrypted over HTTPS. Access to the messages received through the forms is limited to the two founders. The infrastructure the site runs on is monitored automatically, and backups are verified by actually restoring them, not just scheduled.

Changes

If we change anything material in how we process data, we will update this page and the date at the top. We do not send notifications for minor wording changes.

What we collect and what we do with it