Privacy Policy

This Privacy Policy explains how AI SAFE LABS S.R.L. ("AISafe", "we", "us"), a company established in Romania, collects and processes your personal data when you visit our website. AI SAFE LABS S.R.L. is the data controller responsible for your personal data. We process personal data in accordance with the EU General Data Protection Regulation (Regulation (EU) 2016/679, the "GDPR") and applicable Romanian data-protection law.

Your use of AISafe's website is also subject to our Terms of Use. This policy does not ask you to waive any right, and it does not treat your continued use of the site as consent. Where we rely on consent, we ask for it separately and you can withdraw it at any time.

Data Controller

AI SAFE LABS S.R.L., established in Romania.

Privacy contact: privacy@aisafe.io

Because we are established in the European Union, we do not act through an Article 27 EU representative; you can reach us directly at the address above for any privacy request.

1. What this Privacy Policy Covers

This Privacy Policy covers how we treat personal data that we gather when you access or use our website. "Personal data" means any information relating to an identified or identifiable natural person, as defined in Article 4 GDPR. This Privacy Policy does not cover the practices of companies we don't own or control or people we don't manage.

2. Personal Data We Collect

2.1 Categories of Personal Data

Category	Examples	When collected
Contact data	Name, email address	When you email us, subscribe to our newsletter, or apply for a role
Professional data	Employer, job title, CV/résumé content	When you contact us or apply for a role
Usage and analytics data	Pages viewed, referring page, approximate location, device/browser information, IP address, and a cookieless visitor identifier	Only after you accept analytics via our cookie banner

We do not deliberately collect special categories of data (Article 9 GDPR) through this website. Please do not send us such data in free-form fields.

3. Purposes and Legal Bases

We only process personal data where we have a legal basis under Article 6 GDPR. The table below sets out each purpose and the basis we rely on.

Purpose	Legal basis (Art. 6 GDPR)
Operating and securing the website, and remembering your cookie choice	Legitimate interests (Art. 6(1)(f)): running a secure, functional website
Website analytics and measuring how our content performs	Consent (Art. 6(1)(a)): set via the cookie banner and withdrawable at any time
Sending our newsletter and marketing communications	Consent (Art. 6(1)(a)): given when you subscribe and withdrawable at any time
Responding to your enquiries and correspondence	Legitimate interests (Art. 6(1)(f)): answering people who contact us
Recruitment and evaluating job applications	Steps prior to entering a contract (Art. 6(1)(b)) and our legitimate interests (Art. 6(1)(f))
Complying with legal obligations and defending legal claims	Legal obligation (Art. 6(1)(c)) and legitimate interests (Art. 6(1)(f))

Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms. You can object to processing based on legitimate interests at any time (see Your Rights).

4. Cookies and Analytics

We do not load analytics or any non-essential tracking until you accept it through our cookie banner. If you decline, no analytics tools are placed on your device and no analytics identifiers are created. You can change your choice at any time via the "Manage Cookie Settings" control in our Cookie Policy.

Subject to your consent, we use the following analytics providers as processors on our behalf:

PostHog: product and web analytics, used to understand how visitors use the site.
Peek (trypeek.dev): cookieless web analytics that measures page views and engagement using a first-party visitor identifier.

Our full list of cookies and tracking technologies, including how to opt in and out, is in our Cookie Policy.

5. How We Share Your Personal Data

We share personal data only with the following categories of recipients, and only as needed:

Processors acting on our behalf

These providers process personal data under a written data-processing agreement and only on our instructions:

Cloudflare: hosting (Cloudflare Pages), content delivery, DNS, and security/WAF for our website. As both host and edge network, Cloudflare processes technical data such as your IP address and request metadata for every visit, in order to serve and protect the site.
Google Cloud (EU region): infrastructure for our wider platform and for information you submit to us.
PostHog (EU region) and Peek (EU region): website analytics, loaded only with your consent.
Email and productivity providers we use to receive and respond to your messages.

Legal obligations and claims

We may disclose personal data where required by law, to comply with legal process, or to establish, exercise or defend legal claims.

Business transfers

If we are involved in a merger, acquisition, or sale of assets, personal data may be transferred as part of that transaction. We will notify you and, where required, seek your consent.

We do not sell your personal data.

6. International Transfers

We are based in the European Union. Our analytics providers (PostHog and Peek) and the systems that handle information you submit to us are located in the EU.

Our website itself is hosted on Cloudflare Pages and delivered through Cloudflare's global edge network. Cloudflare is a US-based provider; it serves EU visitors from edge locations within the EEA where possible, and any transfer of personal data (such as your IP address) outside the EEA is governed by its data-processing agreement and the European Commission's Standard Contractual Clauses. Wherever any other provider processes personal data outside the EEA, we rely on the same safeguards under Chapter V GDPR: the Standard Contractual Clauses (with any supplementary measures needed) or an adequacy decision. You can ask us for details about the safeguards in place for a specific provider by contacting privacy@aisafe.io.

7. Data Retention

We keep personal data only for as long as we need it for the purpose it was collected:

Analytics data: retained for up to 24 months, or until you withdraw consent, whichever comes first.
Newsletter data: retained until you unsubscribe or withdraw consent.
Recruitment data: retained for the duration of the recruitment process and up to 12 months afterwards, unless you ask us to delete it sooner.
Correspondence: retained for as long as needed to handle your request and a reasonable period afterwards.

We may keep data for longer where required to comply with a legal obligation or to defend legal claims. When data is no longer needed, we delete or anonymise it.

8. Data Security

We protect your personal data using appropriate technical and organisational measures, taking into account the nature of the data and the risks of processing. No method of transmission or storage is perfectly secure, but we work to safeguard your data against unauthorised access, use, alteration and disclosure.

9. Personal Data of Children

We do not knowingly collect personal data from children under 16 years of age. If you are under 16, please do not use this website or send us personal data. If we learn that we have collected personal data from a child under 16, we will delete it as quickly as possible. If you believe a child may have provided us personal data, please contact us at privacy@aisafe.io.

10. Your Rights

If you are in the European Union, the United Kingdom, Liechtenstein, Norway or Iceland, you have the following rights over your personal data under the GDPR:

Access: Request confirmation that we process your data and a copy of it.
Rectification: Request correction of inaccurate or incomplete data.
Erasure: Request deletion of your data ("right to be forgotten").
Withdrawal of consent: Withdraw consent at any time, without affecting processing already carried out.
Portability: Receive data you provided in a structured, machine-readable format.
Objection: Object to processing based on legitimate interests, and to direct marketing at any time.
Restriction: Request that we restrict processing in certain circumstances.

To exercise any of these rights, contact us at privacy@aisafe.io. We will respond within the timeframes required by law.

You also have the right to lodge a complaint with a supervisory authority. Our lead authority is the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP, dataprotection.ro), and you may also complain to the authority in your country of residence.

11. US State Privacy Rights

If you are a US resident, you may have rights under your state's privacy laws. California residents may, under California Civil Code Sections 1798.83-1798.84, request that we not disclose personal data to third parties for their direct-marketing purposes. Nevada residents may opt out of the sale of certain personal data. We do not sell personal data, but you can exercise these rights by contacting us at privacy@aisafe.io.

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the effective date above and, where appropriate, notify you by a notice on the website or by email.

13. Contact Information

If you have questions about this Privacy Policy or how we handle your personal data, or you wish to exercise your rights, contact us:

Controller: AI SAFE LABS S.R.L. (Romania)

Email: privacy@aisafe.io

Website: https://aisafe.io