Privacy policy

This page explains which personal data aitroniclab.com collects, why, where it goes and for how long we keep it. It describes what the site actually does: there is no tracking beyond what is listed here.

Last updated: 7 October 2026

Who is responsible for your data

Aitroniclab Ltd (company no. 16972861), 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom, is the controller of personal data processed through aitroniclab.com, its Latvian version and the free tools on the site. You can reach us at hello@aitroniclab.com.

We work with clients in the European Union and the United Kingdom, so we follow the EU General Data Protection Regulation (GDPR) and the UK GDPR. Article references below point to the GDPR; the UK GDPR has the same numbering.

Enquiries and the contact form

What we collect: Your name, email address, the topic and your message are required. Company and phone number are optional. If you choose to attach a calculator, planner or check result, it is sent with the message. The form also records the page you arrived on, the referring website and campaign (UTM) parameters, so we know which page prompted the enquiry. The site removes anything that looks like an email address or phone number from these technical fields before they are used.
Where it goes: The form is delivered by email to our mailbox over an encrypted connection. The website does not keep a copy of your enquiry in a database.
Why we process it: To answer your request and prepare a proposal, which are steps before a possible contract (Article 6(1)(b)), and our legitimate interest in knowing which pages bring enquiries (Article 6(1)(f)).
How long we keep it: Enquiry emails are kept while the conversation is open and for up to 24 months after our last contact. If we start working together, the data becomes part of the client record and is kept for the duration of the contract plus the statutory retention period for business records, normally six years after it ends.
Spam protection: A hidden form field catches automated submissions. It collects nothing from real visitors, and we do not use a third-party CAPTCHA.

Free tools: checks, planner and calculator

What you enter: A website address in the SEO & AI visibility check and the website quality & security check; answers about your project and your team in the project scope planner and the business flow calculator.
Website addresses: Our server fetches the public pages of the address you enter and runs the checks. For the browser measurement it sends the same address to Google's PageSpeed Insights API, which loads the site in a test browser. Results are cached on our server for up to six hours and are keyed by the address only, not by who asked. We do not store who checked which site.
Planner and calculator answers: Your answers stay in your browser until you decide to attach the result to a contact request. Nothing is sent to us before that.
Rate limiting: To keep the tools available to everyone, the server counts requests per IP address in memory for ten minutes. Nothing is written to disk and the counter resets by itself.
Legal basis: Our legitimate interest in providing and protecting the tools (Article 6(1)(f)).

Analytics and cookies

Google Analytics 4 with Consent Mode: On your first visit a banner asks for your choice. Analytics cookies (named _ga and _ga_ followed by an identifier, valid for up to two years) are set only after you accept.
If you decline or make no choice: No analytics cookies are set and nothing is stored in your browser for analytics. The Google tag still loads and sends cookieless, aggregated signals (Google calls them consent mode pings) that Google uses for modelled statistics. They do not identify you across websites.
What analytics records: Pages viewed, approximate location derived from the IP address (Google does not store the IP address in Analytics 4), device and browser type, and events such as a completed check, planner or calculator result and clicks on calls to action. We never send names, email addresses, phone numbers or form contents to analytics, and the code removes values that look like personal data from event parameters.
No advertising tracking: Advertising storage is permanently denied. The site uses no advertising, remarketing or social media pixels.
Legal basis and withdrawal: Your consent (Article 6(1)(a)). You can change your choice at any time in the box below. The change applies immediately.
Processor: Google Ireland Limited, with Google LLC in the United States as a sub-processor under the EU-US Data Privacy Framework and its UK extension.

Storage in your browser

aitronic_cookie_consent (local storage): Your cookie choice. Kept until you clear your browser data or change the choice on this page.
aitroniclab-attribution (session storage): The landing page, referring site and campaign parameters of your visit, so an enquiry sent later can be attributed to the right page. Deleted when you close the tab.
aitroniclab-estimate (session storage): A calculator, planner or check result you chose to take to the contact form. Deleted when the form is sent or the tab is closed.
aitronic_admin_session (cookie): Set only for Aitroniclab staff who sign in to the administration area. Visitors never receive it.
Fonts, scripts and the map: Fonts are served from our own server. The home and experience pages embed a Google Maps frame showing our operating region; it loads only when you scroll to it, and Google receives your IP address and may set its own cookies inside that frame. Apart from that frame, the Google Analytics tag and, when you use a check tool, the PageSpeed Insights request made by our server, the site loads nothing from third parties.

Hosting, logs and security

Where the site runs: On a server we manage at Hetzner Online GmbH in Helsinki, Finland, inside the European Union.
Technical logs: The web server keeps access logs with the IP address, time, requested address, browser type and response code. We use them to keep the site running and to detect abuse. They are kept for a limited period and then overwritten; we do not analyse them for marketing.
Legal basis: Our legitimate interest in the security and operation of the site (Article 6(1)(f)).
Security measures: All traffic is encrypted (HTTPS with HSTS). The site sends the security headers we recommend to clients, including a Content Security Policy that only lets scripts from our own server and Google Analytics run, access to the mailbox and the server is limited to the people who need it, and we run our own check tools against the site.

Who else receives data

Google Ireland Limited: Analytics (only with your consent), the PageSpeed Insights API (website addresses entered in the check tools) and the embedded map on the home and experience pages.
Our email service provider: Delivers the contact form to our mailbox and stores our correspondence with you.
Hetzner Online GmbH: Server hosting in Finland.
Nobody else: We do not sell personal data and do not share it with advertisers. We disclose data only when the law requires it. Links to LinkedIn and Facebook lead to those platforms, where their own policies apply; the site embeds no social media widgets.

International transfers

Our server is in the European Union. Google may process analytics data in the United States; this relies on the EU-US Data Privacy Framework, its UK extension and Google's standard contractual clauses. As a UK company we may access data from the United Kingdom, which the European Commission recognises as providing adequate protection.

Your rights

You can ask us at any time to:

confirm whether we hold data about you and receive a copy of it;
correct inaccurate or incomplete data;
delete your data, where we have no legal reason to keep it;
restrict processing while a question about it is resolved;
object to processing based on legitimate interests;
receive the data you gave us in a machine-readable format;
withdraw consent at any time, without affecting processing that happened before.

Write to hello@aitroniclab.com. We reply within one month. You also have the right to complain to a supervisory authority: the Information Commissioner's Office (ico.org.uk) in the United Kingdom, the Data State Inspectorate (dvi.gov.lv) in Latvia, or the authority in your own country.

Children

Our services are for businesses. The site is not aimed at children under 16 and we do not knowingly collect their data.

Changes to this policy

We update this page whenever the site's data processing changes, for example when a tool or provider is added. The date at the top shows the current version. Material changes are noted here.