The short version
- This website uses no cookies, no analytics and no advertising trackers.
- We receive personal data only when you choose to send it: through the contact form, by email, by asking our AI assistant to send you your project brief, or by sending feedback about the chat.
- Zanarix AI is an AI assistant, not a person. Questions its prepared answers can't cover are sent to our AI provider, Anthropic, to write a reply. We don't store your conversations, and Anthropic may not use them to train its models.
- We use your data to reply to you and, if we work together, to run your project. We never sell it.
- Enquiries are stored in the EU and deleted automatically 12 months after they arrive, unless we go on to work together.
- Some of our providers may process data outside the EU, always with a safeguard the GDPR approves.
- You can ask to see, correct, delete or move your data, restrict or object to how we use it, and withdraw your consent at any time. Email us, and we reply within one month. You can also complain to the Finnish Data Protection Ombudsman.
Who is responsible for your data
The data controller is Mohammed Samiul Islam, trading as Zanarix (a private entrepreneur). Zanarix is registered with the Finnish Trade Register (PRH) as a private entrepreneur. Business ID 3661000-3. Domicile: Turku.
Arib Ibrahim, our Co-founder and COO, works for Zanarix. He handles personal data only as his work requires, on Mohammed Samiul Islam's instructions and under confidentiality.
For anything about your personal data, email hello@zanarix.com. You don't need a special form: a short email is enough.
What we collect, why, and on what legal basis
We collect only what we need for each purpose. Here is all of it:
Delivering this website and keeping it secure
- What we process
- Technical data your browser sends automatically: IP address, browser and device type, the pages requested and when. Processed by our hosting provider, Cloudflare.
- Legal basis (GDPR)
- Our legitimate interest in running a working, secure website (Article 6(1)(f))
- How long we keep it
- Kept by Cloudflare for a limited time for delivery and security, under Cloudflare's privacy policy. Our own server logs never contain your name, email, message or what you type in the chat
Protecting our forms and AI assistant from spam and abuse
- What we process
- When you start filling in the contact form, use the chat's project brief or feedback form, or send the AI assistant a question its prepared answers can't cover, Cloudflare Turnstile checks in the background that a person is using the site. It uses technical signals from your browser: your IP address, browser type (user agent), connection details (TLS fingerprint) and the address of the page. Most people see nothing; if Cloudflare is unsure, you may be asked to tick a box. We only receive a yes or no. We also limit how many messages can be sent from one connection per minute, without storing anything.
- Legal basis (GDPR)
- Our legitimate interest in keeping our forms and assistant secure and free of spam (Article 6(1)(f))
- How long we keep it
- We store nothing from the check. Cloudflare runs it for us as our processor. It also uses the same signals as an independent controller to improve its bot detection, and keeps them for a limited time under its Turnstile privacy addendum
Replying to your enquiry
- What we process
- What you send us through the contact form or by email: your name, email address, company (optional), the service you're interested in, budget and timeline (optional), your message, how you found us (optional), and a record that you ticked the consent box. For a care plan request, also the plan and billing period you chose, your website address and who built the website.
- Legal basis (GDPR)
- Your consent, given with the checkbox on the form (Article 6(1)(a)); and taking steps at your request before a possible contract (Article 6(1)(b))
- How long we keep it
- 12 months from the day it arrives, then deleted automatically, or sooner if you ask. If we go on to work together, it becomes part of the project records below
Answering your questions in the chat (Zanarix AI)
- What we process
- Questions our prepared answers can't cover, together with the earlier messages of the same chat, so the reply fits the conversation. They are sent through our server to our AI provider, Anthropic, which writes the reply. You don't need to give your name or email to chat.
- Legal basis (GDPR)
- Our legitimate interest in answering the questions visitors ask us (Article 6(1)(f))
- How long we keep it
- We don't store the conversation. Anthropic deletes it within 30 days, unless it must keep it longer (see Our AI assistant)
Keeping the AI assistant within fair daily limits
- What we process
- How many questions have been sent to the AI from one connection today, recorded against a scrambled version of the IP address that changes every day and can't be turned back into it. It isn't linked to your name, your email or what you wrote.
- Legal basis (GDPR)
- Our legitimate interest in preventing abuse and keeping the assistant available to everyone (Article 6(1)(f))
- How long we keep it
- Deleted automatically the following day
Sending you your project brief from our AI assistant, and replying to you
- What we process
- Your email address, the project brief you built in the chat (business type, services, goals, timeline, budget range), and a record that you ticked the consent box. The rest of the chat is not stored.
- Legal basis (GDPR)
- Your consent, given with the checkbox in the chat (Article 6(1)(a)); and taking steps at your request before a possible contract (Article 6(1)(b))
- How long we keep it
- As for enquiries: 12 months from the day it arrives, then deleted automatically, or sooner if you ask
Chat feedback
- What we process
- Whether you found the chat helpful, and an optional comment. It is anonymous: it isn't linked to your name, email or device. Please don't write personal details in the comment.
- Legal basis (GDPR)
- Our legitimate interest in improving the assistant (Article 6(1)(f))
- How long we keep it
- 12 months, then deleted automatically
Running a project with you
- What we process
- Contact details of the people we work with, project communication, and the materials you share for the project.
- Legal basis (GDPR)
- Performing our contract with you (Article 6(1)(b)), or our legitimate interest in working with the contact people of a business client (Article 6(1)(f))
- How long we keep it
- For the project and our agreement. We review project messages 3 years after the project ends or the last invoice (the general limitation period for claims in Finland, Act on the Limitation of Debts 728/2003) and delete what is no longer needed. Contracts, invoices and payment correspondence are kept as described under invoicing
Invoicing and accounting
- What we process
- Billing details: name, company, address, business ID or other billing information, invoices and payments.
- Legal basis (GDPR)
- Our legal obligations under Finnish accounting and tax law (Article 6(1)(c))
- How long we keep it
- As the Finnish Accounting Act (kirjanpitolaki 1336/1997, chapter 2, section 10) requires: invoices, contracts and payment correspondence for at least 6 years after the end of the year in which the financial year ended; financial statements and ledgers for at least 10 years
Protecting our rights
- What we process
- The data above, only where needed to establish, exercise or defend a legal claim.
- Legal basis (GDPR)
- Our legitimate interest in protecting our legal rights (Article 6(1)(f))
- How long we keep it
- Only as long as the claim requires
Where it is kept. Emails you send us are kept in our mailboxes at Zoho, in the European Union. Enquiries sent through the contact form, and project briefs sent from our AI assistant, are also stored in our database, hosted by Cloudflare and restricted to the EU. The same periods apply to both: we delete old enquiry emails every month. A deleted database record can remain in its automatic backup for up to 7 days, and is then gone for good.
The contact form. When you press send, your enquiry is checked (the spam check above and the form's rules), saved in our database, and two emails go out: a confirmation to you, with a reference number, and an alert to our team. If an email can't be sent straight away, your enquiry is still saved and we still see it; the confirmation is tried again for up to an hour and our own alert for up to 24 hours, so a short outage never loses your message.
The project brief from our AI assistant. If you tick the box and ask for your brief, it is handled exactly like a contact form enquiry: checked, saved in our database with your email address and the consent you gave, and two emails go out (your brief with a reference number to you, and an alert to our team). Only the brief is sent, never the rest of the chat. Chat feedback is saved in the same database as an anonymous yes or no, your optional comment and the date (no time), with nothing that links it to you.
Do you have to give us your data? No. Sending us an enquiry is voluntary. We just can't reply without a way to contact you, and we can't work together without the details a contract and invoicing require.
We don't make decisions about you by automated means alone, and we don't use your data for profiling or advertising.
Our AI assistant, Zanarix AI
Zanarix AI is an AI assistant, not a person, and it says so at the start of every chat. It answers questions about Zanarix and can help you put together a project brief. You never need to give it your name or email to chat.
How it works. Many answers are prepared by us in advance and appear straight away, without anything being sent. When a question needs more, it is sent through our server, together with the earlier messages of the same chat, to our AI provider, Anthropic, whose Claude model writes the reply. Anthropic acts as our processor under its data processing addendum, which is part of its commercial terms.
What we keep. Nothing from the conversation. We don't store chats, our server logs never contain what you type, and the chat saves nothing on your device: closing the tab ends it. A project brief reaches us only if you ask us to send it to you.
What Anthropic does with it. Under its commercial terms, Anthropic may not train its models on what is sent through our account. It deletes what is sent, and the replies, within 30 days. It keeps them longer only where needed to enforce its usage policy (up to 2 years if a conversation is flagged) or where the law requires, as its data retention policy explains. Anthropic stores data in the United States (see Transfers outside the EU).
Fair limits. To keep the assistant available to everyone, the number of AI replies per chat, per connection each day and on the whole site each day is limited. When a limit is reached, the chat says so and points you to the contact form.
Replies are written by AI and can contain mistakes. Our team replies to every enquiry and confirms anything important in writing.
Please don't type sensitive personal information into the chat, such as health details, identity numbers or passwords.
Transfers outside the EU
We choose providers that keep data in the European Economic Area (EEA) wherever we can. Our database is restricted to the EU, and our email is stored in Zoho's EU data centres. Some data can still leave the EEA, always with a safeguard the GDPR approves:
Cloudflare (hosting and security)
- What may leave the EEA
- Technical data about your visit, and the signals used by the spam check: each request is handled by the Cloudflare data centre closest to you, which can be outside the EEA if you are
- Safeguard
- Cloudflare is certified under the EU-US Data Privacy Framework, with the EU Standard Contractual Clauses as a fallback, as its privacy policy explains
Zoho (email)
- What may leave the EEA
- Stored in Zoho's EU data centres. In rare cases, staff of Zoho's Indian company may access it to provide technical support, after internal approval and on a need-to-know basis
- Safeguard
- EU Standard Contractual Clauses between Zoho's Dutch and Indian companies, with the extra measures from Zoho's transfer impact assessment, as its privacy FAQ explains
Anthropic (the AI behind our assistant)
- What may leave the EEA
- Questions sent to the AI, with the earlier messages of the same chat. Anthropic stores data in the United States, may process requests in the US, Europe, Asia and Australia, and may handle data for safety review, support or incident response in countries where it operates
- Safeguard
- EU Standard Contractual Clauses in Anthropic's data processing addendum, part of its commercial terms
Specialists outside the EEA, if one works on your project
- What may leave the EEA
- Only the information they need for their part of the work
- Safeguard
- EU Standard Contractual Clauses signed with them before they see any of your data
Data may also go to the United Kingdom, which the European Commission recognises as protecting data adequately (adequacy decision valid until 27 December 2031). You can ask us for a copy of the safeguards at any time: email hello@zanarix.com.
How we protect it
We protect personal data with appropriate technical and organisational measures, including encrypted connections (HTTPS), a database that only our own website code can reach, an automatic spam check (Cloudflare Turnstile) and limits on how often a form can be sent, access limited to Mohammed Samiul Islam and Arib Ibrahim, secured sign-in on every account that holds data, logs that never contain your name, email or message, and deleting data automatically when its time is up.
No system is completely secure. We record every data breach. If one is likely to put you at risk, we report it to the Data Protection Ombudsman without undue delay, within 72 hours of finding out where possible, and if the risk is high, we tell you directly.
Your rights
Under the GDPR, you have the right to:
- Access: ask whether we hold data about you, and get a copy of it.
- Correction: have incorrect or incomplete data corrected.
- Deletion: have your data deleted when we no longer need it, when you withdraw consent, or when it was processed unlawfully. Some records, such as invoices, must be kept by law.
- Restriction: ask us to keep your data but stop using it for a while, for example while we check whether it is correct, or if you need it kept for a legal claim.
- Portability: receive the data you gave us in a common machine-readable format, or have it sent to someone else, where we process it based on your consent or a contract.
- Objection: object to processing based on our legitimate interests. We will stop unless we have compelling legitimate grounds, or need the data for a legal claim.
- Withdrawing consent: withdraw your consent at any time, as easily as you gave it, by emailing us. This doesn't affect what we did before, and we then delete your enquiry unless we need it for a contract or by law.
- Complaint: complain to the supervisory authority. In Finland, that is the Office of the Data Protection Ombudsman (tietosuoja.fi). You can also complain to the data protection authority in the EU country where you live or work.
How to use them. Email hello@zanarix.com. It's free, and we answer in writing, by email. If we can't be sure who you are, we may ask for information to confirm your identity, so we never give your data to someone else. We reply within one month. If a request is complex, we may extend this by up to two more months, and we will tell you why within the first month.
If you think we have handled your data incorrectly, we'd be glad if you told us first, so we can put it right. This never affects your right to complain to the authority.
Changes to this policy
We update this policy before any change in how we handle personal data, for example before a new feature that uses it goes live. We don't send a newsletter; if we start one, this policy will describe it first. The date at the top shows when the policy was last updated. If a change affects you significantly, we will tell you directly where we can.
Last updated 8 October 2026