Privacy Policy

01Who we are

This website is operated by DIVEX S.R.L., the data controller: Splaiul Independenței nr. 202B, camera 42, Sector 6, Bucharest, Romania; tax identification number (CUI) 49953093; Trade Register number J2024008045403; EUID ROONRC.J2024008045403; phone +40 750 457 957.

For anything related to your data, write to hello@divex.ai. We do not have a designated data protection officer; the same address reaches the people responsible.

02In short

The main points, before the detail.

• We collect only what you send us through a form, plus the minimum the site needs to work and stay secure.
• This website sets no cookies and loads no advertising or third-party tracking scripts.
• Bookings and newsletter sign-ups take effect only after you confirm them from your inbox.
• The DIVEX application does not archive AI conversations; gateway and model-provider retention follows their terms.
• We do not sell personal data and do not use it to train AI models.

03When you send an enquiry

Through the contact form we receive your name, work email, message and, if you fill them in, your company, website and budget range. We use them to reply and to discuss a possible project. Your enquiry is delivered to our team inbox, and we send you a single confirmation that it arrived.

Legal basis: steps taken at your request before entering into a contract, and our legitimate interest in answering business enquiries (Article 6(1)(b) and (f) GDPR).

04When you request a business audit

We receive the website address you submit and, if you choose to add it, your email address. We use them to prepare the analysis and send it to you.

Legal basis: steps taken at your request before entering into a contract (Article 6(1)(b) GDPR).

05When you book a call

We receive the time you choose, your name, email, time zone and, if you add them, your company and topic. The slot is booked only after you confirm; the confirmation email may be stored encrypted in the delivery queue until sent; the link in that email is encrypted and expires after 60 minutes.

After you confirm, the meeting is created in our Google Calendar with a Google Meet link, you receive the calendar invitation, and our team receives an email with the booking details.

Legal basis: steps taken at your request before entering into a contract (Article 6(1)(b) GDPR).

06When you subscribe to the newsletter

We use your email address to confirm the subscription and then to send you the newsletter. You are added to the list only after you confirm from the email we send; the confirmation link expires after seven days. Every newsletter includes an unsubscribe link, and you can also write to us.

Legal basis: your consent (Article 6(1)(a) GDPR), which you can withdraw at any time without affecting what happened before.

07When you use the AI assistant

The questions you type are sent, together with the recent messages of the same conversation, to an AI language model that generates the answer. The assistant answers only from the content of this website and is designed not to ask for personal data, so please do not share any.

The DIVEX application does not archive conversations in a database. The gateway and model providers process messages under their own retention terms. For each answer we log only technical usage figures, such as the amount of text processed, to control cost. The conversation is kept in your browser only while the window is open.

Legal basis: our legitimate interest in answering visitors' questions about our services (Article 6(1)(f) GDPR). Answers are generated automatically, may be inaccurate, and no decision about you is made by automated means.

08Where your visit came from

When you send a form, it also carries how your visit started: the first page you opened, with its campaign tags if the link had any; the website that referred you, reduced to its domain; the advertising platform, if you arrived from an ad; and how many pages you viewed. If you arrived from a Google ad, we also keep the click identifier (gclid, gbraid or wbraid) that came with the link. We report to Google Ads, automatically, that an enquiry was sent, and if it becomes a qualified conversation or a project, we report that outcome too. We send only the identifier, the type of outcome and when it happened, with no name, email or message content, to learn which ads bring relevant enquiries. The identifier is kept in our database for 90 days, then deleted. The site uses no advertising pixels or cookies for this.

This information is kept only in the page's memory while you browse; nothing is written to your device, and it is sent in the form payload only when you submit it. Separately, audience statistics may be sent while you browse; we remove URL query strings, fragments and company names in audit paths from page and performance telemetry. Legal basis: our legitimate interest in measuring the effectiveness of our marketing (Article 6(1)(f) GDPR).

09When you browse the site

To show the site, protect it and understand how it is used, a minimum of technical data is processed:

• Server requests, including your IP address and browser details, as processed by our hosting provider and kept in its logs for a short period.
• Audience statistics without cookies: visitors are counted through a hash of the request that is discarded after 24 hours, so you are not recognised across days. Page speed is measured in the same way.
• Protection against automated abuse: an invisible check on form submissions that analyses signals from the browser, and rate limits that use identifiers cryptographically derived from IP or email in our database, in windows of up to 24 hours. The limiter does not store the plain IP or email; expired entries are removed by periodic cleanup.
• Legal basis: our legitimate interest in running a secure, working website and understanding its use in aggregate (Article 6(1)(f) GDPR).

10Who processes data for us

We use the following providers, each bound by a data processing agreement and acting on our instructions:

• Vercel Inc. (United States): hosting and content delivery, server functions in the Frankfurt region, audience and speed statistics, bot protection, and access to the AI models.
• Resend Inc. (United States; sending from the EU): transactional emails, and the newsletter subscriber list.
• DIVEX infrastructure: a PostgreSQL database on a virtual server we administer, rented from netcup GmbH (Germany) and located in Vienna, Austria, for reservations, Google Ads click identifiers, abuse protection and the encrypted delivery queue. Our internal app.divex.ai application manages enquiries and consent records. Boldify receives the random lead ID and visit attribution, without a name or email.
• Google Ireland Limited: our company email, and the calendar and video meetings for booked calls; in Google Ads, conversion measurement based on the click identifier, when you arrived from a Google ad.
• Google and OpenAI, through Vercel: the language models that generate the assistant's answers. Under their terms for business API use, they do not use this content to train their models.

11Transfers outside the European Economic Area

Some providers are based in the United States or may access data from there. Such transfers rely on the EU–US Data Privacy Framework, where the provider is certified, or on the European Commission's Standard Contractual Clauses, together with the additional safeguards set out in each provider's data processing agreement.

12How long we keep data

We keep personal data only as long as the purpose requires:

• Enquiries, audit requests, bookings and the related correspondence: up to 24 months after our last exchange, unless a contract follows, in which case they are kept for as long as the contract and the law require.
• Newsletter: until you unsubscribe or withdraw consent. After you unsubscribe we keep only the address, marked as unsubscribed, and when consent was given, so that we do not write to you again and can prove the consent you gave.
• Confirmation emails are stored encrypted in the delivery queue until sent. Slots and subscriptions are not activated before your confirmation.
• Operational reservation copies are removed during periodic cleanup seven days after the meeting. Delivered job content is deleted; deduplication metadata is kept for seven days. Failed deliveries remain encrypted for manual reconciliation.
• AI assistant conversations are not archived by the DIVEX application; gateway and model-provider retention is governed by their terms.
• Rate limits use windows of up to 24 hours; derived identifiers are removed from the database by periodic cleanup after expiry. Hosting logs: the short period set by our hosting provider.

13Your rights

Under the GDPR you have the right to access your personal data, to have it corrected or erased, to restrict or object to its processing, to data portability, and to withdraw consent where processing is based on it. You can object at any time to processing based on our legitimate interest.

Providing your data is voluntary. Without the required fields of a form we cannot reply, prepare the audit or schedule the call. We make no decisions based solely on automated processing and do not profile visitors.

To exercise any of these rights, write to hello@divex.ai. We reply within one month, and may ask you to confirm your identity.

You also have the right to lodge a complaint with a supervisory authority. In Romania this is the National Supervisory Authority for Personal Data Processing (ANSPDCP), www.dataprotection.ro.

14Security

The site is served over HTTPS only, with strict security headers. Confirmation links are encrypted and expire, forms are protected against automated abuse, and access to the systems that hold your data is limited to the people who need it.

15Children

This website is intended for businesses. We do not knowingly collect data from children under 16.

16Changes to this policy

When we change this policy we update the date at the top of this page. If a change materially affects how we use data you have already given us, we will tell you directly before it applies.