Privacy Policy

1. Who is responsible for your data

The controller for the personal data described in this policy — the person who decides why and how it is processed — is:

I am a sole practitioner and handle these requests personally. There is no data protection officer, because the scale and nature of this processing does not require one under Art. 37.

2. Getting in touch

There is no contact form on this site. The only way to reach me is to email me directly, which means this site never collects your details at all — no fields, no submission, nothing sent to a server here. The email link simply opens your own mail client with the subject and a few prompts filled in; you write it, and your mail provider sends it to mine.

I therefore hold whatever you choose to put in that email — typically your name, your email address and a description of your process — for as long as section 9 sets out. Nothing more is captured, because there is nothing here to capture it.

Legal basis. Taking steps at your request before entering into a contract (Art. 6(1)(b)), and my legitimate interest in answering people who write to me (Art. 6(1)(f)). No consent is needed for me to read and reply to an email you chose to send.

Your email is not written to a database, added to a mailing list, or pushed into a CRM. It sits in my inbox and gets a reply.

3. The live demo

The demo on the home page takes the workflow description you type and sends it to a language model, which returns a suggested agent design. That text leaves this site and is processed by OpenRouter, Inc. in the United States and by the model provider it routes to.

This site does not store what you type into the demo — it exists only for the duration of the request. I have no way to read it afterwards. What the providers retain is governed by their own policies, linked in section 5.

Please do not paste personal data, client information or anything confidential into the demo. Describe the shape of the process instead. If the real detail matters, email me instead.

Legal basis. Your consent, given by choosing to run it (Art. 6(1)(a)). Nothing runs until you press the button.

4. Server logs and abuse prevention

Like any website, requests to this one are logged by the hosting platform. Those logs contain your IP address, the page requested, timestamp, and browser user-agent. They are operational records held briefly by the host, not something I mine or analyse.

The demo is rate limited to stop automated abuse. To do that without holding your IP address, the address is passed through a salted one-way hash the moment it arrives; only the hash is kept in memory, and it is discarded when the server restarts.

Legal basis. Legitimate interests (Art. 6(1)(f)) — keeping the site available and preventing abuse. You can object to this under Art. 21, though it is difficult to serve a website without it.

5. Cookies

This site keeps one first-party cookie, named eliasbolo_consent. It stores nothing but your own answer to the cookie question: which optional categories you allowed, the version of that question, and when you answered. It carries no identifier, and it is never read by anyone but this site.

It lasts 30 days, then expires on its own and the question is asked again. A cookie is used rather than local storage on purpose: the thing being consented to is cookies, and a cookie lapses by itself.

Legal basis. This cookie is strictly necessary to honour your choice, so it does not itself require consent. Everything in the optional categories does, and none of it runs unless you switch it on.

You can change or withdraw your answer at any time using the control at the end of this policy. Withdrawing deletes the cookie outright.

6. What this site deliberately does not do

• No cookie is set beyond the one recording your own choice, described in section 5.
• No analytics, no tag manager, no tracking or conversion pixels, no session recording.
• No advertising networks and no data brokers.
• No contact form, and nothing anywhere that asks for your name, email or company. The demo's box is the only input on the site, and it wants a description of a process, not you.
• Fonts are served from this domain, not from Google — loading a page sends no request to a third party on your behalf.
• No profiling, no behavioural scoring, no automated decisions with legal effect (Art. 22).
• Your data is never sold, rented, shared for advertising, or used to train a model.

7. Who else processes your data

I use a small number of service providers. They act as processors on my instructions under Art. 28 and may not use your data for their own purposes.

8. Transfers outside the EEA

I am established in Greece, so this processing sits under the GDPR regardless of where you are. Your enquiry is delivered to a mailbox held inside the European Economic Area.

Some of the providers listed above are established in the United States — the host, the email delivery service, and the model router behind the demo. Data reaching them is transferred outside the EEA. Each transfer is covered by the European Commission's Standard Contractual Clauses in that provider's data processing agreement, and where the provider is certified under the EU–US Data Privacy Framework, by that adequacy decision as well.

You can request a copy of the safeguards that apply to a specific transfer by emailing me.

9. How long it is kept

• Emails you send me: 12 months from the day you send them, then deleted — unless we go on to work together, in which case the line below applies.
• Demo input: not stored by this site at all.
• Server logs: retained briefly by the hosting provider under their own schedule.
• If we go on to work together, correspondence is kept for as long as the engagement and any statutory record-keeping obligation require.

10. Your rights

Under the GDPR you have the right to:

• Access (Art. 15) — a copy of the personal data I hold about you.
• Rectification (Art. 16) — correction of anything inaccurate.
• Erasure (Art. 17) — deletion of your data — for an enquiry, simply ask.
• Restriction (Art. 18) — processing paused while a dispute is resolved.
• Portability (Art. 20) — your data in a machine-readable format.
• Object (Art. 21) — to processing based on legitimate interests.
• Withdraw consent (Art. 7(3)) — at any time, as easily as it was given. This does not affect processing already carried out.

To exercise any of these, email hello@arkhitas.com. I will respond within one month, as Art. 12(3) requires. There is no charge, and I will not ask you to justify the request.

If you are unhappy with how I have handled your data, you can complain to a supervisory authority — in the country where you live, where you work, or where the issue arose. The authority for where I am established is the Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα).

11. Security

The site is served over HTTPS. API credentials are held as server-side environment variables and are never exposed to the browser. IP addresses are hashed on arrival rather than stored. Form input is length-limited and validated on the server, and the demo wraps your text so the model treats it as data rather than instructions.

No transmission over the internet is perfectly secure, and email in particular is not a confidential channel. Bear that in mind before sending anything sensitive through the form.

12. Changes to this policy

This is version 2026-08-19, last updated 19 August 2026. If it changes materially, the version above changes with it. Consent records store the version that was in force when you gave consent, so a later revision is never applied retroactively to something you already agreed to.

13. Contact

Questions about any of this go to hello@arkhitas.com. A real person reads it.