Privacy Policy

01Data we collect

Beyond presenting our work, this site runs an AI assistant that helps scope your project and produce an estimate. Depending on how you use it, we process:

• Account data — when you sign in (by email code or with your Google account), we process your email address and, if provided, your name. If you use the assistant without signing in, we create an anonymous session identifier for you.
• Chat content — the messages you exchange with the AI assistant, including any project details you choose to share, are stored so the conversation can continue and be reviewed.
• Voice data — if you use voice mode, your microphone audio is streamed to our AI provider for real-time processing, and transcripts of the conversation are stored like chat messages. We do not keep audio recordings ourselves.
• Uploaded files — images and PDF documents you upload (up to 8 MB) are stored on our infrastructure and analysed by our AI provider to help scope your project.
• Lead and enquiry data — the project brief, requested services, price estimate and the contact details (email, name) you provide so we can follow up, as well as emails you send us directly.
• Technical data — IP address, browser type, pages requested and similar server-log data recorded to deliver the service and keep it secure, including short-lived rate-limiting records keyed by IP address to prevent abuse.

02Why we use it and legal basis

• To provide the scoping service — run the AI assistant, keep your conversation history, analyse uploaded files and produce project estimates — legal basis: performance of a contract / steps taken at your request prior to a contract.
• To follow up on your project enquiry and discuss potential work — legal basis: steps prior to a contract and our legitimate interest in responding to leads.
• To operate accounts and authenticate you (email codes, Google sign-in, anonymous sessions) — legal basis: performance of a contract.
• To operate, secure and maintain the website, including rate limiting and abuse prevention — legal basis: our legitimate interest in running a safe, functional service.
• To load optional marketing pixels — legal basis: your consent, which you may refuse or withdraw at any time.
• To meet our legal and accounting obligations where applicable — legal basis: compliance with a legal obligation.

03AI processing

Chat messages, voice audio and transcripts, and uploaded files are processed by OpenAI (OpenAI, L.L.C. / OpenAI Ireland Ltd) acting as our data processor, to generate the assistant's responses and analyses. We use OpenAI's API services; under their API terms, data submitted this way is not used to train their models.

The assistant's output (including price estimates) is generated automatically and is indicative only; any engagement is confirmed by a human and governed by a separate written agreement.

04Cookies and tracking

We use cookies or similar storage that are strictly necessary to operate the service, such as keeping you signed in and remembering your session.

The website may also use optional marketing pixels from providers such as Meta, TikTok and Google to measure campaigns and build retargeting audiences. These pixels load only after you accept marketing cookies via the consent banner.

If you decline, we keep the site fully functional and do not load advertising pixels. You can withdraw consent by clearing this site's local storage or browser data, then choosing Decline when asked again.

05Sharing your data and processors

We do not sell your personal data. We share it only with service providers (processors) that help us operate the service, and only as needed:

• Cloudflare, Inc. — hosting, storage of conversations, leads and uploaded files, and content delivery on its EU/global edge network (https://www.cloudflare.com).
• OpenAI — AI processing of chat messages, voice audio/transcripts and uploaded files, as described above.
• Resend (and, as a fallback, Plunk) — sending transactional emails such as sign-in codes.
• Google — only if you choose to sign in with your Google account (Google acts as your identity provider under its own privacy policy).

06International transfers

Some of these providers are located outside the EU (notably in the United States). Where personal data is transferred outside the EU/EEA, transfers are covered by appropriate safeguards such as the EU Standard Contractual Clauses or an applicable adequacy decision (e.g. the EU–US Data Privacy Framework).

07How long we keep it

We keep account data, conversations, transcripts, uploaded files and lead records for as long as your account exists or as long as needed for the purposes described above (providing the service, following up on your enquiry, and our business relationship), and thereafter only as required to meet legal obligations. We delete your data on request.

Rate-limiting records and server logs are kept for a short period only, for security purposes.

08Your rights

Under the GDPR you have the right to access, rectify and erase your data, to restrict or object to its processing, and to data portability. You can exercise these rights, or withdraw any consent, at any time.

To do so, email hello@0bs.ai. You also have the right to lodge a complaint with the French supervisory authority, the CNIL (www.cnil.fr).

09Security

We take reasonable technical and organisational measures to protect personal data against loss, misuse and unauthorised access. The site is served over HTTPS and data is stored with our hosting provider's security controls.

10Changes to this policy

We may update this policy from time to time. The current version is always available on this page, with the date it was last updated shown above.

11Contact

For any question about this policy or your data, contact us at hello@0bs.ai.