Privacy Policy

1. Introduction

This Privacy Policy explains how 01AI LTD (“we”, “us”, “our”, “the Company”) collects, uses, stores, and protects personal data when you visit our websites 01ltd.com and app.01ltd.com (collectively, the “Website”), use our client login area, or otherwise interact with us. We are committed to protecting your privacy in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”), the Data Protection Acts 1988 to 2018, and all applicable Irish and European data protection legislation.

Our services are provided to businesses and organisations. However, in the course of our business activities, we collect and process personal data belonging to natural persons, including employees, directors, and representatives of our client organisations, sole traders, individuals who contact us through the Website, and individuals who apply for employment or other opportunities with us.

2. Data Controller

The data controller responsible for your personal data is: 01AI LTD (CRO 811501), registered in Ireland. Registered Office: 60 Merrion Square South, Dublin 2, D02 HE24, Ireland. Email: privacy@01ltd.com

3. Categories of Personal Data We Collect

We may collect and process the following categories of personal data:

• Website browsing data: IP address (anonymised, two bytes masked), browser type, operating system, referral source, pages visited, and duration of visit. This data is collected without cookies using Matomo Analytics in cookieless mode. When you are logged in to the client area, it is also linked to a pseudonymised identifier (see Section 6).
• Server and security logs: the full IP address, the page or file requested, the browser user agent and the time of each request, recorded by our web servers and security tools.
• Registration data: company name and business email address, collected during self-service account creation.
• Newsletter data: business email address and, if you give it, company name, collected when you subscribe to our newsletter, with the date you confirmed your subscription and the wording you agreed to, kept as the record of your consent.
• Contact and enquiry data: name, email address, telephone number, company name, job title, and any information you provide when contacting us.
• Business contact data: professional details of employees, directors, or representatives of client organisations and business partners.
• Client login area data: username, email address, hashed password, login timestamps, session data, and information submitted within the client login area.
• Transactional and contractual data: billing information, invoicing details, correspondence, and records relating to the provision of our services.
• Recruitment and job applicant data: CV, cover letter, qualifications, employment history, references, and other information provided as part of an application process.
• Data from third parties: publicly available sources (CRO filings, LinkedIn), third-party business intelligence providers, and referrals.

We do not intentionally collect any special categories of personal data (such as data revealing racial or ethnic origin, political opinions, health data, or biometric data).

4. Legal Bases for Processing

We process your personal data only where we have a lawful basis under Article 6 GDPR:

• Consent (Art. 6(1)(a)): for the use of client data to train or improve our AI models (explicit opt-in required; see Section 5A), talent pool participation, newsletter subscriptions, and any future non-essential cookies. Our website analytics operate without cookies and without consent under the CNIL analytics exemption (see Section 6). You may withdraw consent at any time.
• Performance of a contract (Art. 6(1)(b)): to provide access to the client login area and deliver the services you or your organisation have engaged us to provide.
• Legitimate interests (Art. 6(1)(f)): for Website security (including server and security logs), fraud prevention, service improvement, managing business relationships, processing job applications, and cookieless website analytics (Matomo), including the pseudonymised identifier used for logged-in users of the client area (see Section 6).
• Legal obligation (Art. 6(1)(c)): where we are required by law to process or retain certain data, including for tax, accounting, or regulatory compliance purposes.

5. How We Use Your Personal Data

• To operate, maintain, and provide the functionality of the Website and client login area
• To respond to your enquiries and communicate with you
• To fulfil our contractual obligations to clients and manage business relationships
• To send administrative communications such as service updates and security alerts
• To send you our newsletter and updates, where you have subscribed
• To analyse website usage and improve performance using cookieless, anonymised analytics
• To train, test, and improve our artificial intelligence models and services (see Section 5A below)
• To evaluate job applications and manage recruitment processes
• To comply with applicable legal and regulatory obligations
• To protect our rights, property, and safety, and those of our users and the public

5A. Use of Data for AI Training and Improvement

As an artificial intelligence company, we may process certain data submitted through our client login area (such as text inputs, prompts, support queries, and feedback) to train, test, and fine-tune our AI algorithms. Where possible, we take steps to aggregate, de-identify, or anonymise this data before it is used for model training.

Legal basis: explicit consent (Art. 6(1)(a)). We will never use your data for AI model training without your prior, explicit, affirmative opt-in. This consent is collected separately from any other terms and can be withdrawn at any time.

By default, no client data is used for training. If you choose to opt in, you can withdraw consent at any time by contacting us at privacy@01ltd.com. Withdrawal will not affect data that has already been fully anonymised prior to your request.

For paying clients under a Master Services Agreement (MSA), AI training data usage is governed exclusively by the terms of that agreement.

6. Website Analytics

We use Matomo, an open-source analytics platform self-hosted on our own European infrastructure (Paris, France). Matomo operates in cookieless mode for every visitor, including logged-in users of our client area: no analytics cookies are placed on your device and no consent banner is required.

Technical configuration:

• Cookies: disabled (disableCookies() in the JavaScript tracker)
• IP anonymisation: 2 bytes masked (e.g. 192.168.xxx.xxx)
• User identification: none for visitors who are not logged in; a pseudonymised identifier for logged-in users of the client area (see below)
• Session tracking: daily hash reset (no long-term profiling)
• Cross-site tracking: disabled
• Data sharing: none (all data remains under our exclusive control)
• Data retention: maximum 25 months, reviewed periodically

This configuration qualifies for the analytics exemption under CNIL (France), AEPD (Spain), Garante (Italy), and AP (Netherlands) guidance. Any visitor can opt out using the mechanism below.

Legal basis: legitimate interest (Article 6(1)(f)), specifically cookieless, anonymised analytics for service improvement. No personal identifiers are collected from visitors who are not logged in.

Logged-in users: when you are logged in to the client area at app.01ltd.com, each page view also carries a pseudonymised identifier, a one-way keyed hash of your account's internal ID computed on our platform. It is sent with the page view and is not stored on your device. The key is held separately from Matomo, so Matomo cannot connect the identifier to your name or email address; we can, which is why it remains personal data. We use it to understand how the client area is used across visits, so that we can improve it. The legal basis is our legitimate interest (Article 6(1)(f)) in improving the service we provide to you. You can object at any time using the opt-out below or your browser's Do Not Track setting, and when we delete your account we also delete the analytics records linked to it.

Opt-out: If you wish to opt out of anonymised analytics tracking, you may enable the “Do Not Track” setting in your browser. Our Matomo installation honours this preference. You may also use the opt-out form below:

For the cookies used to log in to our client area, and those set by the opt-out form above, please refer to our Cookie Policy.

6A. Identity and Account Management

Authentication on our platform is handled by Keycloak, a self-hosted open-source identity management system running on our EU infrastructure. Keycloak processes the following personal data:

• Email address
• Hashed password (we never store plaintext passwords)
• Account role and permissions
• Company name (provided during registration)
• Login timestamps and session tokens

Legal basis: contractual necessity (Article 6(1)(b)); you cannot access the platform without authentication.

We collect only the minimum fields required. We do not collect phone numbers, physical addresses, or location data during registration.

We keep registration data while your account is in use, and afterwards for as long as needed to deal with queries and to bring or defend legal claims (see Section 9). You may request full account deletion at any time by contacting privacy@01ltd.com. When we delete your account at your request, we also delete the analytics records linked to it.

6B. Online Purchases of the AI Diagnostic

When a business buys the AI Diagnostic online under our Terms of Sale, we process the following personal data as controller.

We do not use a fixed retention period for this data. How long we keep it depends on the criteria in the table: whether we still need it to provide the Service, whether a legal claim arising from the order could still be brought, and whether tax or company law still requires us to keep the record.

You can ask us to erase your personal data at any time at privacy@01ltd.com. We will do so unless we need to keep it for one of the reasons in the table, and we will tell you if that is the case.

Questionnaire answers describe your organisation. We ask you not to enter personal data in free-text answers, and we never use answers, Reports or Evidence Files to train AI models.

Stripe Payments Europe Ltd (Ireland) processes payments and issues invoices on our behalf as our processor. Stripe also acts as an independent controller when it uses payment data for its own purposes, including fraud prevention, compliance with its own legal obligations and some payment processing. Stripe's privacy policy explains that use. Resend (email delivery) and Scaleway (hosting, France) act as our processors.

International transfers: data hosted by Scaleway stays in France. Stripe and Resend transfer personal data from the EEA to the United States on two bases: certification under the EU-US Data Privacy Framework, which the European Commission has found to provide an adequate level of protection, and the European Commission's standard contractual clauses. Details are in Stripe's privacy policy (section 6) and Data Privacy Framework notice, and in Resend's data processing addendum.

7. Data Sharing and Third Parties

We do not sell, rent, or trade your personal data to any third party. We may share your personal data with: service providers acting as our processors under data processing agreements, namely Scaleway (hosting, France), Resend (delivery of the emails our Website sends, United States) and IT support providers; professional advisers (solicitors, accountants, auditors) where necessary; regulatory and legal authorities where required by law; and authorised persons within your organisation where you are a contact person at a client organisation.

8. International Data Transfers

Your personal data is primarily stored and processed within the European Economic Area (EEA): our hosting (Scaleway) is in France, and our analytics (Matomo) and sign-in service (Keycloak) run on it. Resend, which delivers the emails our Website sends (contact and application messages, registration and verification emails, newsletter confirmations and issues), is based in the United States. That transfer relies on Resend's certification under the EU-US Data Privacy Framework, which the European Commission has found to provide an adequate level of protection, and on the European Commission's standard contractual clauses, as set out in Resend's data processing addendum. For any other transfer outside the EEA, we ensure appropriate safeguards are in place as required by the GDPR, such as standard contractual clauses or an adequacy decision.

9. Data Retention

• Website browsing data (anonymised, or pseudonymised for logged-in users): maximum 25 months, reviewed periodically. No consent required, as the data is collected without cookies.
• Registration and account data: we keep registration data while your account is in use and afterwards for as long as needed to deal with queries and to bring or defend legal claims. You can ask us to delete it at any time at privacy@01ltd.com.
• Contact and enquiry data: for as long as needed to deal with your enquiry and any follow-up, and afterwards for as long as needed to bring or defend legal claims. If a contractual relationship arises, the rows below apply. You can ask us to delete it at any time at privacy@01ltd.com.
• Newsletter data: until you unsubscribe, which you can do at any time with the link in every issue or at privacy@01ltd.com; your address is then deleted. A sign-up that is not confirmed within 30 days is deleted. An address that permanently stops receiving mail is no longer sent issues and is deleted when we review the list.
• Server and security logs: for as long as needed to keep the Website secure and to investigate incidents.
• Business contact data: for the duration of our business relationship, and afterwards for as long as needed to deal with queries and to bring or defend legal claims. You can ask us to delete it at any time at privacy@01ltd.com.
• Client login area data: duration of our contractual relationship plus 6 years thereafter
• Transactional and contractual data: minimum 6 years following end of the contractual relationship
• Recruitment data (unsuccessful applications): 12 months following conclusion of the recruitment process, unless you consent to longer retention

10. Data Security

We implement appropriate technical and organisational measures including encryption of data in transit (SSL/TLS), secure password hashing, access controls limiting personal data access to authorised personnel, regular security reviews, and secure hosting within the EEA. While we take all reasonable precautions, no method of transmission over the internet is completely secure.

11. Your Rights Under the GDPR

• Right of access (Art. 15): obtain confirmation of processing and a copy of your data
• Right to rectification (Art. 16): request correction of inaccurate or incomplete data
• Right to erasure (Art. 17): request deletion where one of the grounds in Art. 17 applies, for example where the data is no longer needed for the purpose it was collected for
• Right to restriction of processing (Art. 18): request restriction of processing in certain circumstances
• Right to data portability (Art. 20): receive your data in a structured, machine-readable format
• Right to object (Art. 21): object to processing based on legitimate interests
• Right to withdraw consent: withdraw consent at any time without affecting prior lawful processing
• Right not to be subject to automated decision-making (Art. 22): not to be subject to a decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you

To exercise any of these rights, please contact us at privacy@01ltd.com. We will respond within one month. We may ask you to verify your identity before processing your request.

12. Complaints

If you are dissatisfied with how we handle your personal data, you have the right to lodge a complaint with the Data Protection Commission (DPC), 21 Fitzwilliam Square South, Dublin 2, D02 RD28 (www.dataprotection.ie, info@dataprotection.ie, +353 (0)1 765 0100 / 1800 437 737). We would appreciate the opportunity to address your concerns before you approach the DPC.

13. Third-Party Links

Our Website may contain links to third-party websites. We are not responsible for the privacy practices or content of those websites. The inclusion of a link does not imply endorsement by 01AI LTD.

14. Children's Privacy

Our Website and services are intended for businesses and are not directed at individuals under the age of 18, in line with our Terms of Use. We do not knowingly collect personal data from anyone under 18. If we become aware that we have, we will delete it promptly.

15. Governing Law

This Privacy Policy is governed by and construed in accordance with the laws of Ireland. Any disputes arising in connection with this Policy shall be subject to the exclusive jurisdiction of the Irish courts.