Privacy Policy

Last updated: 28 July 2026

1. General

1.1The protection of your personal data is a top priority for RhombikAI (hereinafter "we" or "us"). We collect, process and use your personal data only with your consent, on your instruction, or on another legal basis, and always in accordance with the General Data Protection Regulation and all other applicable national and European regulations.

1.2 Controller

For the purposes of the General Data Protection Regulation (GDPR), the controller is:

1.3 Personal data

Personal data means any information relating to an identified or identifiable natural person. Examples include names, addresses, dates of birth, contact details, IP addresses, identification numbers and bank details. We usually collect personal data directly from you.

When processing personal data, the EU General Data Protection Regulation ("GDPR"), the EU ePrivacy Directive and the Austrian Data Protection Act ("DSG") apply in particular.

2. Processing purposes and legal basis

We process your personal data for one or more of the following purposes:

• Initiation or fulfilment of contractual relationships, to fulfil our contractual and pre-contractual obligations (Art 6(1)(b) GDPR), particularly those arising from client relationships and contracts with suppliers, business partners or applicants.
• Responding to your enquiries sent to us by email or telephone. The legal basis is Art 6(1)(b) GDPR where the enquiry concerns a potential engagement, and otherwise Art 6(1)(f) GDPR, namely our legitimate interest in responding to the people who contact us.
• Scheduling appointments through our online booking calendar (Art 6(1)(b) GDPR).
• Operating, securing and improving our website, based on our legitimate interest in a functioning and secure website (Art 6(1)(f) GDPR).

3. Data processing in connection with our website

3.1 We process personal data in connection with our website to safeguard our legitimate interests (Art 6(1)(f) GDPR), namely to ensure the operation, security and optimisation of the website, and to process enquiries you send us by email or telephone.

3.2 Log files

Our website is hosted by Hetzner Online GmbH, on servers located in Germany. When you visit the website, the following access data ("log files") is recorded:

• IP address
• Date and time of the request
• The page or file requested
• Referrer URL (the previously visited page)
• Browser type and version, and operating system

We process these log files to ensure the functionality, stability and security of the website, and to investigate incidents such as attacks on our infrastructure. The legal basis is our legitimate interest in this respect (Art 6(1)(f) GDPR). Log files are deleted after 14 days.

3.3 Web analytics (Plausible)

We use Plausible Analytics to understand how our website is used. Plausible is operated by Plausible Insights OÜ, Tallinn, Estonia. All visitor data is processed within the European Union, on servers in Falkenstein, Germany, with database hosting provided by UpCloud in Finland.

Plausible does not use cookies, does not store your IP address, and does not track you across websites or build any profile of you. The data collected is aggregated and cannot be traced back to you. It includes:

• The page visited and the referring source
• Browser, operating system and device type
• Country, derived from the IP address without storing it
• Screen size

Because no cookies are used and no personal profile is created, this processing is based on our legitimate interest in understanding how our website performs (Art 6(1)(f) GDPR).

3.4 Appointment booking with Microsoft Bookings

We use Microsoft Bookings to allow you to schedule appointments with us. The booking calendar is embedded in our website but is provided by Microsoft.

The booking calendar only loads after you have given your consent via our cookie banner. If you do not consent, no connection to Microsoft is established from our website, and you can instead open the booking page in a separate tab or contact us by email.

When you use the booking function, Microsoft processes the personal data you provide, such as your name, email address and appointment details, and may set cookies or similar technologies necessary for the operation, security and performance of the booking service. These cookies are set by Microsoft and are subject to Microsoft's own privacy and cookie policies. We do not control them. Further information is available in the Microsoft Privacy Statement.

The processing of your personal data for the purpose of booking an appointment is based on Art 6(1)(b) GDPR (performance of a contract or steps taken prior to entering into a contract). Loading the embedded calendar, and any non-essential cookies it sets, is based on your consent (Art 6(1)(a) GDPR).

3.5 Cookies and consent

Our website itself does not set any advertising or tracking cookies. Cookies are only set by the embedded Microsoft booking calendar, and only after you have consented.

To remember your cookie choice, we store that choice locally in your browser. This record stays on your device, is not transmitted to us, and can be cleared at any time through your browser settings. You can withdraw your consent at any time by clearing your browser storage for this website, after which the banner will appear again on your next visit.

4. Recipients and processors

We do not sell your personal data, and we do not share it for advertising purposes. Your data is processed by the following service providers acting on our behalf or as independent controllers:

Beyond these, we may disclose personal data where we are legally required to do so, or where necessary to establish, exercise or defend legal claims.

5. Transfers outside the EU/EEA

Our website hosting and analytics are provided within the European Union.

Microsoft is a company with a US parent. Although Microsoft processes and stores customer data for European tenants within the EU Data Boundary, certain processing, such as technical support and diagnostic data, may take place outside the EEA. Microsoft relies on the EU Standard Contractual Clauses and on its certification under the EU-US Data Privacy Framework for such transfers.

Please note: this section concerns data processed through this website. It is separate from the infrastructure used to deliver our AI services to clients, which runs on EU-only infrastructure. The terms of that processing are set out in the data processing agreement concluded with each client.

6. Data retention

We retain your data only for as long as is necessary for the purposes set out above and to fulfil our contractual and legal obligations. When we no longer need your data, we anonymise or delete it so that you can no longer be identified.

• Server log files: 14 days
• Booking and enquiry data: for the duration of the relationship and thereafter within the applicable statutory retention periods
• Data relevant to legal claims: until the relevant limitation periods have expired

7. Your rights

You have the right at any time to:

• request information about which of your data we process (Art 15 GDPR)
• have inaccurate data corrected (Art 16 GDPR)
• have your data deleted (Art 17 GDPR)
• request restriction of processing (Art 18 GDPR)
• receive your data in a portable format (Art 20 GDPR)
• object to processing based on legitimate interests (Art 21 GDPR)

To exercise any of these rights, contact us at ravi.agarwal@rhombikai.com.

Withdrawing consent. Where processing is based on your consent, you may withdraw that consent at any time by emailing ravi.agarwal@rhombikai.com. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal (Art 7(3) GDPR).

Right to lodge a complaint. If you believe that our processing of your personal data infringes data protection law, you have the right to lodge a complaint with the supervisory authority (Art 77 GDPR). The competent authority in Austria is:

8. Automated decision-making

We do not use the personal data collected through this website for automated decision-making, including profiling, within the meaning of Art 22 GDPR.

9. Changes to this policy

We will continue to adapt this privacy policy in line with applicable legal requirements. The version in force is the one published on this page, dated at the top.