Privacy policy

1. Data we process

Serving and protecting the website involves your IP address, requested URL, request time and browser/device headers, including preferred languages. Cloudflare processes connection and security information and produces operational traffic statistics. The application has no advertising, visitor analytics or session recording.

Data you submit through the contact form: Your name; Your email address; The message you write. If you email us directly, we receive your email address, any name you provide, the message, its delivery metadata and any attachments you choose to send. Please send only information needed to explain your enquiry, and do not include passwords, identity documents or sensitive personal information.

Send only what is needed to explain your enquiry. Do not send passwords, identity documents, tenant files or sensitive personal information.

Using the contact form loads Cloudflare Turnstile. It processes IP address, TLS fingerprint, User-Agent, sitekey and origin signals to distinguish people from bots.

To limit abuse of the contact form, the server stores a SHA-256 hash of the client IP address and a request count for up to ten minutes. This is pseudonymous personal data, not anonymous data. The counter contains no name, email address or message text and is shared only between the site’s application instances.

2. Purposes and legal basis

• Website delivery and security: legitimate interests in making the site available, diagnosing faults and protecting it against abuse — Article 6(1)(f) GDPR.
• Incoming enquiries: legitimate interests in answering your question and managing correspondence, including communication with an organisation you represent — Article 6(1)(f). Sending a message does not subscribe you to marketing.
• Data-rights requests or a binding legal duty: compliance with the applicable legal obligation — Article 6(1)(c). Records necessary for a specific legal claim may be retained under Article 6(1)(f).

3. Who receives data

Access is limited to the operator, authorised people administering the site or answering messages, and these providers and their authorised subcontractors. Providers also process information for their own security and legal purposes under their notices. Data may be disclosed to a competent authority when legally required or to advisers for a specific legal claim. We do not sell personal data.

Cloudflare acts as a processor when protecting this site, and as a controller when improving Turnstile’s bot detection, as explained in its Turnstile Privacy Addendum.

• Hetzner Online GmbH, Germany: hosts the origin application on the Germany-based server.
• Cloudflare, Inc. — United States: Provides DNS, the website’s delivery and security proxy, and Email Service for sending form messages and forwarding mail addressed to hello@specus.ai. It processes website request data and the message content and metadata needed for email delivery. Its Data Processing Addendum is incorporated into its Self-Serve Subscription Agreement for processing customer content.
• Microsoft — consumer Outlook.com: receives and stores the correspondence mailbox. Microsoft Corporation and Microsoft Ireland Operations Limited describe their controller processing in the Microsoft Privacy Statement. This is a consumer mailbox, not an enterprise Microsoft 365 account with an enterprise processing agreement.

4. International transfers

The origin server is in Germany. That location does not mean that all website and email processing stays in the European Economic Area (EEA). Cloudflare operates globally and may process data outside the EEA, including in the United States. Its DPA provides for EU–US Data Privacy Framework transfers and Standard Contractual Clauses, with additional safeguards, for restricted transfers.

Microsoft may process mailbox information in the EEA, the United States and other countries where its facilities or providers operate. Its Privacy Statement describes the relevant locations, adequacy decisions, EU–US Data Privacy Framework and Standard Contractual Clauses. The provider links below explain these safeguards and subcontractor locations. You may also request information or a copy of applicable safeguards at hello@specus.ai, subject to necessary protection of confidential information.

5. Retention

• Ordinary enquiries: messages and contact details are deleted from the correspondence mailbox 12 months after the last interaction. The operator reviews and deletes expired correspondence manually; the website has no correspondence database or automatic email-deletion task.
• Routine page-access logging is disabled. Technical application and proxy logs rotate by size: up to three files of 10 MB per container, with the oldest file removed on rotation. This is a size-based limit, not a promise of deletion after a fixed number of days. Contact names, email addresses and message bodies are excluded from application log messages.
• Cloudflare retains email sending and routing event metadata for 31 days. These records can include the sender, recipient, subject, message identifier and delivery result. This period is separate from the correspondence retained in the receiving mailbox. Outlook.com may retain messages for up to 30 days after removal from Deleted Items, unless a legal retention duty applies. Cloudflare and Microsoft also determine retention for their own security and legal records using the service purpose, security risks and applicable legal duties described in their published privacy notices. We do not export an additional archive of website traffic logs.
• A specific legal obligation or dispute may require relevant records to be retained separately until that obligation ends or the matter and any enforcement are finally resolved. This does not extend the retention of every enquiry.
• Contact abuse counter: Automatically expires no later than ten minutes after the first counted request. Further attempts do not restart that period. Redis persistence is disabled for this counter.
• Turnstile verification: Tokens expire after 5 minutes and are single-use. The application keeps them only in memory for verification and does not store or log them.

6. Your rights

Under the applicable GDPR conditions, you may request access, correction, deletion, restriction and portability of your data. Portability applies where processing is automated and based on consent or a contract. You may object to processing based on legitimate interests for reasons relating to your situation; it must stop unless there are overriding grounds or a need to handle legal claims.

Write to hello@specus.ai. We respond without undue delay and within one month; if complexity or the number of requests requires up to two further months, we explain that within the first month. Proportionate identity checks may be requested where there are reasonable doubts. Requests are normally free; the exceptions for manifestly unfounded or excessive requests are those in Article 12(5).

7. Complaints

You may complain to a data protection supervisory authority, particularly where you habitually live or work or where an alleged infringement occurred. You do not have to contact us first. Portugal’s authority is the Comissão Nacional de Proteção de Dados (CNPD): www.cnpd.pt, geral@cnpd.pt.

8. Your choice and changes

Sending an enquiry is voluntary and is not a statutory requirement. The form requires a name, a valid email address and a message so that we can understand and answer it. Without the required information, the form cannot send your request. Ordinary browsing still involves the technical processing described above.

This landing does not make automated decisions with legal or similarly significant effects or create marketing profiles. Its browser storage is described on the cookies page. Any additional processing associated with a future product launch will be explained before it begins. The date above identifies this notice’s version.

9. Where UK data protection law applies

UK law applies according to the actual processing, not the selected language. You may exercise the applicable UK GDPR rights and raise a data-protection complaint at hello@specus.ai without an account. Applicable UK rules require acknowledgement of a complaint within 30 days, appropriate investigation and communication of the outcome; this is separate from an access request. You may complain to the ICO. Transfers must meet the relevant UK requirements; an EU mechanism does not by itself establish that they are met. No UK representative or UK establishment is asserted by this notice.

10. Where Swiss data protection law applies

Where the Swiss FADP applies, you may request information, correction and the remedies available under that law at hello@specus.ai without an account. You may report a concern to the FDPIC. The relevant destination countries and transfer safeguards must be identified for the actual feature, including onward processing; European hosting alone does not establish that all data remains in Europe. This notice does not assert a Swiss establishment, representative or unrestricted right to use every feature in Switzerland.