Privacy Policy

1. Introduction

ANET Studios ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website or use our services.

ANET Studios is the data controller responsible for your personal data:

2. Information We Collect

We collect personal data in a few different ways. To make this clear, we have grouped it by where the information comes from:

Information you give us directly

When you contact us, request a service, or use the tools on our website, you may provide:

• Identity and contact details: your name, email address, phone number, and the company you represent
• Enquiry content: the subject and message you send through our contact forms, and any details you share in calls, consultations, or correspondence
• Website Audit requests: the website address (URL) you submit, together with your name and email address so we can send you the results
• Booking details: the information needed to schedule a call, such as your name, email address, and chosen time
• Client portal account data: if you become a client, your account login details, the files and information you upload, and the messages you exchange with us through the portal
• Messages and information you share with our AI chat assistant, when you choose to use it.

Information we collect automatically

When you visit our website or use our client portal, some technical information is collected automatically:

• Device and connection data: your IP address, browser type, and general device information
• Security data: information processed by our bot-protection and abuse-prevention measures (such as Cloudflare Turnstile), request rate-limiting, and records of sign-in attempts to the client portal
• Usage and analytics data: how you interact with our pages, collected only with your consent
• Cookies and similar technologies: as described in the Cookies section below

Information we generate about you

As part of providing our services and managing our business relationships, we may create additional information, including:

• Records of our interactions: notes from calls, meetings, emails, and support requests
• Status in our process: where an enquiry or account sits in our sales or onboarding workflow
• Assessments and scores: the results our Website Audit tool calculates about a website you submit, and an internal indication of how relevant our services may be to an organisation. This helps us prioritise our outreach and is not used to make any automated decision that produces legal or similarly significant effects about you.

Information from other sources

We may also receive information about you from sources other than yourself:

• Public and third-party business sources: for business-to-business outreach, we may collect professional contact details (such as a company name, business email address, phone number, website, and a publicly listed business address) from publicly available sources and business directories, where we have a legitimate interest in offering relevant services (Art. 6(1)(f) GDPR). Where this applies, we will inform you, in line with Art. 14 GDPR, that we hold your data and tell you the source if you ask.
• Providers we work with: for example, confirmation of an appointment from our scheduling provider, or confirmation of a payment from our payment processor.

Where we indicate that certain information is required (for example, to respond to an enquiry, deliver a service, or process a booking), not providing it may mean we cannot fulfil your request. Providing any other information is voluntary.

3. Legal Basis for Processing (GDPR Article 6)

We process your personal data on the following legal bases:

• Consent: Analytics and marketing cookies, marketing emails
• Contractual necessity: Processing required to deliver our services
• Legitimate interest: Improving our website, responding to enquiries, fraud prevention
• Legal obligation: Compliance with applicable laws

4. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our services
• Respond to your inquiries and provide customer support
• Send you updates, newsletters, and marketing communications
• Analyze usage patterns and optimize our website
• Detect, prevent, and address technical issues
• Comply with legal obligations

We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR).

5. Information Sharing and Disclosure

We do not sell, trade, or rent your personal information to third parties. We may share your information with:

• Service providers who assist in our operations
• Professional advisors (lawyers, accountants)
• Law enforcement when required by law
• Business partners with your explicit consent

6. International Data Transfers

Some of our sub-processors are based outside the European Economic Area (EEA), including in the United States. Where we transfer personal data outside the EEA, we rely on appropriate safeguards: the EU-US Data Privacy Framework (DPF) where the recipient is certified, and/or Standard Contractual Clauses (SCCs) approved by the European Commission. Key sub-processors include:

• Google (Workspace, Analytics): Workspace (email) and Analytics; and PageSpeed Insights: when you use our Website Audit tool, the URL you submit is sent to Google’s PageSpeed Insights API for performance analysis. Certified under the EU-US Data Privacy Framework; data also processed under SCCs.
• Cloudflare: CDN, security and bot protection; processes data under the DPF/SCCs
• Stripe: Payment processing; operates under the DPF/SCCs and is certified under applicable frameworks
• Technology and AI providers: We use trusted third-party technology and AI providers to help run our business and operate features of our website, including managing communications, internal productivity, and our AI chat assistant. The specific AI models or providers we use may change over time. Where this involves your personal data, it is used only to assist us, providers are contractually restricted from using it to train their own models, and it is not used to make automated decisions that produce legal or similarly significant effects about you (Art. 22 GDPR). Some providers are located outside the EEA, including in the United States, where we rely on appropriate safeguards such as the EU-US Data Privacy Framework and/or Standard Contractual Clauses.

You may request a copy of the relevant DPF certification or SCCs by contacting us at privacy@anetstudios.com.

7. Data Security

We take the security of your personal data seriously and apply technical and organisational measures appropriate to the risk, in line with Art. 32 GDPR. These include encryption of data in transit (TLS/HTTPS); firewall, DDoS, and automated bot protection; access granted strictly on a least-privilege basis; hashed (never plain-text) storage of credentials; regular encrypted backups; and ongoing security monitoring and updates. While no method of transmitting or storing data can be guaranteed 100% secure, we work continuously to protect your information and, in the event of a personal-data breach, will notify the competent supervisory authority and affected individuals where required by law (Art. 33-34 GDPR).

8. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes outlined in this policy:

• Contact form submissions and call bookings: retained for 2 years from the date of submission, or longer if you become a client
• Website Audit data: URLs and associated contact information are retained for 1 year
• Analytics data: anonymised and retained for 14 months (Google Analytics default)
• Cookie consent preferences: stored for 1 year

You may request earlier deletion of your data at any time by contacting us.

9. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to enhance your experience. Our cookies fall into the following categories:

• Essential cookies: Required for the website to function (session management, security). Always active.
• Analytics cookies: Help us understand how visitors use our site (Google Analytics 4). Only activated with your consent.
• Marketing cookies: Used for ad targeting and campaign tracking. Only activated with your consent.

When you first visit our site, a cookie consent banner allows you to accept all cookies, choose essential only, or customise your preferences. You can change your preferences at any time.

10. Your Rights

You have the right to:

• Access your personal information (Article 15)
• Correct inaccurate data (Article 16)
• Request deletion of your data (Article 17)
• Restrict processing of your data (Article 18)
• Object to processing of your data (Article 21)
• Request data portability (Article 20)
• Withdraw consent at any time (Article 7(3))
• Object to direct marketing at any time, an absolute right (Article 21(2) GDPR). Every marketing email also contains an unsubscribe link.
• Lodge a complaint with the Data Protection Commission (DPC) of Ireland, our supervisory authority, at dataprotection.ie. If you are based in Germany, you may alternatively lodge a complaint with the competent German supervisory authority, the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia (LDI NRW), https://www.ldi.nrw.de.

11. Children's Privacy

Our services are not intended for individuals under the age of 18. We do not knowingly collect personal information from children under 18.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date.

13. Contact Us

If you have any questions about this Privacy Policy, please contact us at:

For any data protection request (access, correction, deletion, objection, portability, or to withdraw consent), contact our data protection point of contact at privacy@anetstudios.com. We have not appointed a Data Protection Officer, as one is not required under Article 37 GDPR.