Privacy Policy

1. Who is responsible for your data

The controller for the personal data described in this policy — the person who decides why and how it is processed — is:

I am a sole practitioner and handle these requests personally. There is no data protection officer, because the scale and nature of this processing does not require one under Art. 37.

2. The contact form

When you send an enquiry, I receive the fields you filled in: your name and email address, optionally your company, project type and budget range, and the message you wrote.

Alongside it I store a consent record: the time you submitted, the version of this policy in force, the exact wording you agreed to, and whether you also opted in to follow-up. This is how I can demonstrate consent was given, as Art. 7(1) requires.

Legal basis. Your consent, given by ticking the required box (Art. 6(1)(a)), together with taking steps at your request before entering into a contract (Art. 6(1)(b)). The second, optional box is separate consent to keep your details on file for follow-up about related work — leaving it unticked has no effect on whether you get a reply.

The enquiry is delivered to my inbox by email. It is not written to a database, added to a mailing list, or pushed into a CRM.

3. The live demo

The demo on the home page takes the workflow description you type and sends it to a language model, which returns a suggested agent design. That text leaves this site and is processed by OpenRouter, Inc. in the United States and by the model provider it routes to.

This site does not store what you type into the demo — it exists only for the duration of the request. I have no way to read it afterwards. What the providers retain is governed by their own policies, linked in section 5.

Please do not paste personal data, client information or anything confidential into the demo. Describe the shape of the process instead. If the real detail matters, use the contact form or email me.

Legal basis. Your consent, given by choosing to run it (Art. 6(1)(a)). Nothing runs until you press the button.

4. Server logs and abuse prevention

Like any website, requests to this one are logged by the hosting platform. Those logs contain your IP address, the page requested, timestamp, and browser user-agent. They are operational records held briefly by the host, not something I mine or analyse.

The contact form and the demo are rate limited to stop automated abuse. To do that without holding your IP address, the address is passed through a salted one-way hash the moment it arrives; only the hash is kept in memory, and it is discarded when the server restarts. The consent record carries this hash — not your IP.

Legal basis. Legitimate interests (Art. 6(1)(f)) — keeping the site available and preventing abuse. You can object to this under Art. 21, though it is difficult to serve a website without it.

5. Cookies

This site keeps one first-party cookie, named eliasbolo_consent. It stores nothing but your own answer to the cookie question: which optional categories you allowed, the version of that question, and when you answered. It carries no identifier, and it is never read by anyone but this site.

It lasts 30 days, then expires on its own and the question is asked again. A cookie is used rather than local storage on purpose: the thing being consented to is cookies, and a cookie lapses by itself.

Legal basis. This cookie is strictly necessary to honour your choice, so it does not itself require consent. Everything in the optional categories does, and none of it runs unless you switch it on.

You can change or withdraw your answer at any time using the control at the end of this policy. Withdrawing deletes the cookie outright.

6. What this site deliberately does not do

• No cookie is set beyond the one recording your own choice, described in section 5.
• No analytics, no tag manager, no tracking or conversion pixels, no session recording.
• No advertising networks and no data brokers.
• Fonts are served from this domain, not from Google — loading a page sends no request to a third party on your behalf.
• No profiling, no behavioural scoring, no automated decisions with legal effect (Art. 22).
• Your data is never sold, rented, shared for advertising, or used to train a model.

7. Who else processes your data

I use a small number of service providers. They act as processors on my instructions under Art. 28 and may not use your data for their own purposes.

8. Transfers outside the EEA

I am established in Greece, so this processing sits under the GDPR regardless of where you are. Your enquiry is delivered to a mailbox held inside the European Economic Area.

Some of the providers listed above are established in the United States — the host, the email delivery service, and the model router behind the demo. Data reaching them is transferred outside the EEA. Each transfer is covered by the European Commission's Standard Contractual Clauses in that provider's data processing agreement, and where the provider is certified under the EU–US Data Privacy Framework, by that adequacy decision as well.

You can request a copy of the safeguards that apply to a specific transfer by emailing me.

9. How long it is kept

• Enquiries and their consent records: 12 months from the day you send them, then deleted. Every enquiry email carries its own deletion date so this does not depend on memory.
• Demo input: not stored by this site at all.
• Server logs: retained briefly by the hosting provider under their own schedule.
• If we go on to work together, correspondence is kept for as long as the engagement and any statutory record-keeping obligation require.

10. Your rights

Under the GDPR you have the right to:

• Access (Art. 15) — a copy of the personal data I hold about you.
• Rectification (Art. 16) — correction of anything inaccurate.
• Erasure (Art. 17) — deletion of your data — for an enquiry, simply ask.
• Restriction (Art. 18) — processing paused while a dispute is resolved.
• Portability (Art. 20) — your data in a machine-readable format.
• Object (Art. 21) — to processing based on legitimate interests.
• Withdraw consent (Art. 7(3)) — at any time, as easily as it was given. This does not affect processing already carried out.

To exercise any of these, email hello@arkhitas.com. I will respond within one month, as Art. 12(3) requires. There is no charge, and I will not ask you to justify the request.

If you are unhappy with how I have handled your data, you can complain to a supervisory authority — in the country where you live, where you work, or where the issue arose. The authority for where I am established is the Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα).

11. Security

The site is served over HTTPS. API credentials are held as server-side environment variables and are never exposed to the browser. IP addresses are hashed on arrival rather than stored. Form input is length-limited and validated on the server, and the demo wraps your text so the model treats it as data rather than instructions.

No transmission over the internet is perfectly secure, and email in particular is not a confidential channel. Bear that in mind before sending anything sensitive through the form.

12. Changes to this policy

This is version 2026-08-18.3, last updated 18 August 2026. If it changes materially, the version above changes with it. Consent records store the version that was in force when you gave consent, so a later revision is never applied retroactively to something you already agreed to.

13. Contact

Questions about any of this go to hello@arkhitas.com. A real person reads it.