Privacy policy.

01In short

This website has no account, no login, no newsletter, no analytics, no advertising and no third-party script of any kind. We set no cookies. There is no consent banner because there is nothing to consent to.

The contact page holds a form, and that form sends us nothing by itself: it prepares a message in your own mail application, which you then send or do not send. Typefaces are served from our own domain. No request leaves this Site to any party we have not named in this policy.

Separately from this website, we build a Brain for a small number of firms. The client records inside a Brain belong to the firm it was built for and stay in that firm's environment. Our position on those records is set out in section 17.

02Who is responsible for this policy

ACE Intelligence, operating from Amsterdam, the Netherlands and Dubai, United Arab Emirates, is responsible for the processing described in this policy in relation to this website.

Write to info@aceintelligence.io about anything in this document, including any request to exercise a right set out below.

We have not appointed a data protection officer. The processing connected to this website is minimal, involves no sensitive data and no profiling, and does not meet the thresholds at which an appointment is required. If our processing changes in a way that meets them, we will appoint one and name them here.

03The law this policy is written to

This policy is written to Regulation (EU) 2016/679, the General Data Protection Regulation, which applies to our processing because we operate from the Netherlands. Where we deal with people in the United Arab Emirates, Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data may also apply, and we hold ourselves to whichever of the two sets the higher standard on any point.

04What this website collects from you

Nothing that you type reaches this website's servers. The contact form assembles your message locally in your browser and hands it to your own mail application. Until you press send in that application, nothing has left your device; when you do, you are sending us an email, and section 07 applies.

No third-party script runs on this Site. We do not use analytics, tag managers, advertising pixels, session recorders, heat maps, split testing or fingerprinting of any kind. We do not build a profile of you, because we hold nothing from which one could be built.

If we ever change the form so that it submits through a delivery service instead of your mail application, this section and section 09 change first, and the service is named here before it handles a single message.

05What our hosting provider records

Serving a web page requires a server to receive a request, and receiving a request means seeing where it came from. Our hosting provider, Vercel Inc., records technical information about requests made to this Site, which typically comprises an IP address, a browser user agent string, the page requested, a timestamp and a response status.

That information exists so that the Site can be delivered, kept available and protected against attack and abuse. We do not use it to identify visitors, we do not combine it with anything else, and we do not sell it or share it for marketing. Vercel acts for us under its data processing terms; its own privacy documentation is at vercel.com/legal/privacy-notice.

06Cookies and similar technologies

This Site sets no cookies and uses no local storage, session storage or similar technology to store anything on your device.

If that ever changes, this section changes first and a consent mechanism arrives with it. Any non-essential cookie would be set only on your free, specific and unambiguous consent, given by a clear affirmative action before the cookie is set, and would be as easy to refuse and to withdraw as it is to give.

07If you write to us

If you contact us by email, including through the form on the contact page, we hold your message, your email address and anything you choose to put in it, for as long as needed to deal with the matter and to keep a proper record of our dealings with your firm.

Email to and from our addresses is handled for us by Hostinger, our mail provider, which processes it on our instructions and under its own data processing terms.

08The grounds on which we process

Where we process personal data in connection with this Site or with correspondence arising from it, we rely on the following grounds.

• Steps taken at your request before entering into a contract, and the performance of a contract once one exists.
• Compliance with a legal obligation to which we are subject.
• The establishment, exercise or defence of legal claims.
• Our legitimate interests in operating, securing and maintaining this Site and in keeping proper business records, where those interests are not overridden by your rights.
• Your consent, where we ask for it, which you may withdraw at any time without affecting anything done before you withdrew it.

09Who we share it with

We do not sell personal data, and we do not share it for anyone else's marketing.

We share personal data only with the two processors this policy names, Vercel for hosting and Hostinger for email, each acting on our instructions under written terms, and with professional advisers, regulators or law enforcement where we are required or permitted to do so by law.

10Transfers out of the EEA

Vercel serves this Site from a global network, and Hostinger routes email internationally, so technical data and correspondence can be processed outside the European Economic Area. Where that happens, it happens under the safeguards those providers maintain for exactly this purpose, including the European Commission's standard contractual clauses.

11How long we keep it

We do not keep personal data beyond the purpose it was collected for. Where we no longer need it we delete it, or we anonymise it so that it can no longer be connected to any person.

Correspondence about a prospective or existing engagement is kept for the duration of our dealings and for as long afterwards as our records and any legal or regulatory requirement make necessary.

12How we protect it

We apply technical and organisational measures appropriate to the nature and scope of what is being processed, designed to protect personal data against loss, destruction, alteration, unauthorised access and tampering, including encryption in transit.

Access is limited to those who need it for their work, and it is removed when they no longer do. No system is perfectly secure, and we do not claim that ours is.

13If something goes wrong

If a breach of personal data occurs that creates a risk to the people it concerns, we will notify the competent supervisory authority without undue delay and, where the law requires it, the people affected. The notification will set out the nature of the breach, its likely consequences, the measures taken or proposed, and a contact for enquiries.

14Your rights

You have the following rights in respect of personal data we hold about you.

• Access. To be told whether we process your personal data, and to receive a copy of it together with the purposes, recipients and retention involved.
• Rectification. To have inaccurate or incomplete personal data corrected or completed.
• Erasure. To have your personal data deleted, subject to the limits the law places on that right.
• Restriction. To require us to limit processing in defined circumstances, including while a dispute about accuracy or grounds is resolved.
• Portability. To receive personal data you have provided in a structured, commonly used and machine-readable format, where processing rests on consent or contract.
• Objection. To object to processing based on our legitimate interests, and to any processing for direct marketing, which we do not do.
• Withdrawal. To withdraw consent at any time, where consent is the ground we rely on.

15How to exercise a right, and how to complain

Write to info@aceintelligence.io. We will not charge you for making a request, and we will respond within the period the applicable law allows. We may ask you for enough information to be satisfied who you are before we act, which protects you rather than us.

If you are not satisfied with how we have handled a request, you may complain to a supervisory authority. In the Netherlands that is the Autoriteit Persoonsgegevens; in the United Arab Emirates, the UAE Data Office.

16Automated decision-making

This website makes no automated decisions about you of any kind.

Within a firm we work for, a Brain may rank, prioritise or suggest. Those outputs are visible to that firm's own people and are acted on by people; the arrangements governing them are a matter for that firm's own privacy notice and for the engagement between us.

17Client firms, and whose data it is

This section is about the work rather than the website, because it is the part that matters most to the firms we serve.

A Brain is built for one firm, on that firm's own records, and those records remain that firm's property throughout. One firm, one Brain, one memory: nothing is pooled between firms, nothing is shared between them, and nothing is sold. Access is scoped source by source, every action is logged with its reasoning, and when an engagement ends the firm leaves with everything, in a readable form, and what we hold is deleted.

In that work we act on the firm's instructions under a written engagement, and the engagement, not this policy, governs it. Questions about personal data inside a client firm's Brain belong first to that firm, whose own notices cover its clients.

18Children

This Site is addressed to businesses. It is not directed at children, and we do not knowingly collect personal data from anyone under 18. If you believe a child has sent us personal data, write to us and we will delete it.

19Changes to this policy

When this policy changes, the date at the top of this page changes with it, and where a change is material we will make that plain here. Each version applies from the date it is published.