Privacy policy

Draft awaiting legal review. This text has not yet been checked by a lawyer.

This policy explains what personal data we handle when you visit this site, request the AI Act checklist or book a call with us. It describes only what the site does today. Data handled in client projects is governed by the contract and the data-processing agreement signed with each client. The Portuguese version of this policy is the governing version.

Who is the controller

The controller is Ontia Labs.

For any question about your data, write to hello@arqmetrica.com.

What data we handle and why

When you visit the site

The site is hosted by Vercel, with its server functions in the Frankfurt region (fra1). Every request to the site passes through Vercel's servers, which handle technical data such as your IP address, your browser and the page requested, to deliver the page and protect the service.

• Purpose: to run the site and keep it secure.
• Proposed legal basis: legitimate interests, GDPR Article 6(1)(f).

Request limits on forms

To prevent abuse, the site's forms count how many requests arrive from each IP address. The counter stores the IP address and the form's name in a Vercel storage service (Vercel KV) and deletes itself after one hour.

• Purpose: to stop bulk submissions and misuse.
• Proposed legal basis: legitimate interests, GDPR Article 6(1)(f).
• Retention: up to one hour.

When you request the AI Act checklist

The checklist form asks for your email address and, if you choose to give it, the size of your company. We also record the language in which you asked for the checklist and where the request came from. This data is kept in a database hosted by Supabase. The PDF checklist is sent to your email through Resend, an email delivery service.

• Purpose: to send the document you asked for and to know which companies are interested in the subject.
• Proposed legal basis for sending it: steps taken at your request, GDPR Article 6(1)(b).

The form does not sign you up to any newsletter.

When you book a call

The free 30-minute call is booked through a Cal.com calendar embedded in the site. The calendar loads on the contact page and when you use a booking button. What you type into the booking form, such as your name, email address and any notes, is received by Cal.com, which sends the confirmation and the calendar invitation.

• Purpose: to arrange and hold the call you asked for.
• Proposed legal basis: pre-contractual steps at your request, GDPR Article 6(1)(b).

When you write to us

If you email us, we use your address and the content of your message to reply.

• Proposed legal basis: our legitimate interest in replying to people who contact us, or pre-contractual steps when you ask for a proposal.

Statistics and measurement, only with your consent

We load the following tools only after you allow them in the cookie notice. Until then, Google Consent Mode keeps every category denied and Google's script is not loaded.

• Google Analytics, for site statistics (pages viewed, how visitors arrive).
• Google Ads, to measure campaign conversions, only when it is switched on.
• LinkedIn Insight Tag, to measure LinkedIn campaign conversions, only when it is switched on.
• HubSpot, to record the pages you view. It can link those visits to details you send in a form on this site. The HubSpot code is loaded from HubSpot's European data centre.

Legal basis: your consent, GDPR Article 6(1)(a), and Article 5 of Portuguese Law 41/2004 of 18 August, as amended. You can withdraw consent at any time. The details are in the cookie policy.

Record of your cookie choice

We store your cookie choice in a cookie and in your browser's local storage, with the date of the decision, for one year. This record stays in your browser and lets us respect and demonstrate the choice you made.

Data collected by earlier versions of the site

An earlier version of this site, under the Arqmetrica name, had a self-assessment tool that asked for an email address. Any such addresses are kept in the same database and are deleted when you ask us to erase your data.

Who we share data with

We do not sell personal data. Data is handled by the following providers, acting on our behalf under GDPR Article 28 or as independent controllers, depending on the service:

• Vercel: site hosting and request limits.
• Supabase: database for checklist requests.
• Resend: email delivery.
• Cal.com: call booking.
• Google: statistics and, if active, conversion measurement, with consent.
• HubSpot: visit records, with consent.
• LinkedIn: conversion measurement, with consent and only when active.

Transfers outside the European Economic Area

Some of these providers are based outside the European Economic Area or may handle data outside it. In those cases data is transferred only under Chapter V of the GDPR, on the basis of an adequacy decision (Article 45) or appropriate safeguards (Article 46).

Your rights

Under GDPR Articles 15 to 22, you can ask us for:

• access to your data;
• correction of inaccurate data;
• erasure of your data;
• restriction of processing;
• portability of the data you gave us;
• objection to processing based on legitimate interests.

We make no automated decisions that have legal effects on you, and no profiling with that effect.

To use any of these rights, write to hello@arqmetrica.com. We may ask you to confirm your identity, for example by replying from the address concerned.

Where processing is based on your consent, you can withdraw it at any time without affecting processing carried out before then. For cookies, use the "Manage cookies" button in the site footer.

Complaints to the supervisory authority

You have the right to lodge a complaint with a supervisory authority under GDPR Article 77. In Portugal the supervisory authority is the Comissão Nacional de Proteção de Dados (CNPD), designated by Article 3 of Law 58/2019 of 8 August. The CNPD is at Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa, and takes complaints through www.cnpd.pt.

Security

The site uses encrypted connections (HTTPS). The database tables can be reached only from the site's server, and direct public access is blocked. We keep only the data we need for each purpose.

Changes to this policy

We may update this policy when the site or its providers change. The date of the latest update is shown at the top of the page.

Applicable law

• Regulation (EU) 2016/679 (GDPR)
• Portuguese Law 58/2019 of 8 August, which gives effect to the GDPR in Portuguese law
• Portuguese Law 41/2004 of 18 August, as amended, on privacy in electronic communications