Privacy Policy

Company

ZAPTOS LTD trading as AI Labs

Address

5th Floor, 167–169 Great Portland Street, London, W1W 5PF, United Kingdom

Companies House

12201879

E-Mail

hello@ai-labs.at

We collect personal data only to the extent necessary for the operation of our website and services:

• —Server logs: Each request automatically logs your IP address, user agent, referrer, timestamp, and requested URL. Stored briefly for security and abuse prevention. Legal basis: Art. 6(1)(f) GDPR (legitimate interest).
• —Website analytics (Vercel Web Analytics & Speed Insights): To understand how our site is used, we measure page views, the referring website, campaign parameters in the link (e.g. utm_source), clicks on certain buttons and links (e.g. "Book a call", language switch, links to other websites), the browser, operating system and device type, the country derived from your IP address, and anonymous loading-time metrics. This works without cookies and without storing anything on your device. Visitors are counted using a hash of the request that is discarded after 24 hours, so you cannot be recognised across days or across websites, and your IP address is not stored. We do not use this data to identify individuals or build profiles. Processor: Vercel Inc. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in an audience measurement that is privacy-friendly and helps us improve the website).
• —Google Ads conversion tracking (only with your consent): We advertise on Google. If you click one of our ads and accept cookies in our banner, the Google tag stores the ad click ID in a cookie and reports to Google Ads when you click "Book a call" or complete a booking. This tells us which ads lead to booked calls. Google processes the click ID, your IP address, browser and device data, the page address and the conversion event. We do not use remarketing or personalised advertising, and we receive only aggregated reports, not data about you as a person. Without your consent the Google tag is not loaded at all. Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Legal basis: Art. 6(1)(a) GDPR, § 165(3) TKG 2021 and § 25(1) TDDDG (consent). You can withdraw your consent at any time under "Cookie settings" in the footer.
• —Contact / application forms: When you submit the "Join our team" form or otherwise contact us, we process your name, email, LinkedIn URL, portfolio URL, and message. Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) and Art. 6(1)(a) GDPR (consent).
• —Calendly bookings: When you book a discovery call via Calendly, your name, email, and meeting time are processed by Calendly LLC (USA). See Calendly's privacy policy: calendly.com/privacy. Legal basis: Art. 6(1)(a) GDPR (consent) and Art. 6(1)(b) GDPR.
• —Authentication cookies (admin only): If you log in to our admin area, we set a session cookie.

Without your consent, the public website sets no tracking, advertising or analytics cookies. Our website analytics (Vercel Web Analytics) is cookieless. When you first visit, a banner asks whether you allow Google Ads measurement cookies; "Accept" and "Reject" are equal choices, and the site works the same either way.

• —Your choice is stored in your browser's local storage (ailabs.consent.ads.v1) so we don't ask again. It stays until you clear your browser data. This is strictly necessary to respect your decision.
• —Google Ads cookies (only after "Accept"): _gcl_au (links visits to ad clicks, 90 days) and _gcl_aw (stores the ad click ID, 90 days). If you withdraw consent, we delete them.
• —Calendly may set its own cookies once you open the embedded scheduling calendar. These are governed by Calendly's privacy policy.
• —Strictly necessary technical cookies are used for the admin login session.

We use the following service providers. All have signed Standard Contractual Clauses (SCCs) where required:

• —Vercel Inc. (USA) — website hosting, content delivery, and cookieless website analytics (Web Analytics, Speed Insights). Privacy policy.
• —Supabase Inc. (USA / EU) — database and file storage. Privacy policy.
• —Calendly LLC (USA) — meeting scheduling. Privacy policy.
• —Google Ireland Limited (Ireland; parent company Google LLC, USA) — Google Ads conversion tracking, only with your consent. Privacy policy, Google business data.
• —GoDaddy Operating Company, LLC (USA) — domain registration & DNS.

Where data is transferred outside the EEA, we rely on EU Standard Contractual Clauses and the EU-US Data Privacy Framework, under which Google LLC, Vercel Inc. and Calendly LLC are certified.

• —Server logs: up to 30 days, then deleted or anonymised.
• —Website analytics: only aggregated, anonymous statistics are kept; the daily visitor hash is discarded after 24 hours.
• —Google Ads cookies: up to 90 days in your browser, or until you withdraw consent. Google keeps conversion data according to its own retention periods.
• —Contact / application form data: up to 12 months after our last contact, then deleted unless a contract is concluded.
• —Calendly booking data: see Calendly's policy.
• —Statutory retention obligations (e.g. tax, accounting): up to 7 years where applicable.

You have the following rights regarding your personal data:

• —Right of access (Art. 15 GDPR) — you may request a copy of the data we hold about you.
• —Right to rectification (Art. 16 GDPR) — you may request correction of inaccurate data.
• —Right to erasure (Art. 17 GDPR) — you may request deletion of your data.
• —Right to restriction of processing (Art. 18 GDPR).
• —Right to data portability (Art. 20 GDPR).
• —Right to object (Art. 21 GDPR).
• —Right to withdraw consent at any time without affecting prior lawful processing. For Google Ads cookies, use "Cookie settings" in the footer.

To exercise any of these rights, email hello@ai-labs.at. We will respond within one month.

If you believe we have processed your data unlawfully, you have the right to lodge a complaint with a supervisory authority. The Austrian authority is the Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, Austria — dsb.gv.at. You may also complain to the supervisory authority of your habitual residence or place of work.

The website is served over HTTPS. Passwords (admin accounts) are stored as bcrypt hashes. We use access controls, role-based permissions, and standard security practices to protect your data — though no system can be guaranteed fully secure.

We may update this privacy policy from time to time to reflect changes in our practices or legal requirements. The "last updated" date at the top of this page indicates the most recent version.