Privacy policy

1. Data controller

Warp Design & Innovation FlexCo, Sterngasse 3, 1010 Vienna, Austria. CEO: Arkadi Jeghiazaryan.

Privacy enquiries may be sent by post to this address or through the project brief. A direct privacy contact email must be added before publication.

2. Project briefs and enquiries

When you submit the form, we store your chosen service areas, goal or bottleneck, name, company, work email, optional phone number, timeline, language and submission time in a database.

We use this information to respond to your enquiry and prepare a discussion. The legal basis is Article 6(1)(b) GDPR for pre-contractual enquiries, or Article 6(1)(f) GDPR for enquiries on behalf of a company (our legitimate interest in responding to business enquiries).

Required fields are necessary to process the brief; a phone number is optional. Please do not submit sensitive personal data or confidential third-party data. Success is shown only after the brief has been saved.

2a. AI Act & Enterprise Readiness Scanner

When you complete the scanner and request the report, we store your name, company, work email, job title or function, your answers including company context and the conditional follow-up, the calculated score, answer coverage and domain scores, report ID, language, report request (consent confirmation) and submission time in a database.

If you then request a consultation on your 90-day roadmap, we also store your confirmed contact details, priority area, goal, preferred start period, optional notes and contact confirmation, linked to your assessment. Please do not enter sensitive personal data or confidential company information in free-text fields.

The purpose is to produce the report you requested and handle your optional consultation request. The legal basis is Article 6(1)(b) GDPR (your request) or Article 6(1)(f) GDPR for requests on behalf of a company. This is not a marketing consent.

The PDF report is generated locally in your browser. No email notifications or automated deliveries are currently enabled. Contact details are not stored in your browser's local storage. No automatic deletion routine currently applies to scanner or roadmap requests (see section 6).

2b. DPP & ESPR Readiness Checker

When you complete the DPP checker and request the report, we store your name, company, work email, job title, your six answers (including the unscored product category), score, answer coverage, domain scores, report ID, methodology version, language, consent confirmation and submission time in a database.

If you then request a roadmap consultation, we also store your contact details, priority area, goal, timeline, optional notes and contact confirmation, linked to your assessment. No appointment is booked automatically.

Purpose, legal basis, local in-browser PDF generation and retention are the same as in section 2a.

3. Hosting and technical data

The website and database run on Replit infrastructure. Technical connection data, including IP address and browser information, is processed to deliver the service. The application logs request method, path, status code and response time.

This supports operation, security and troubleshooting under Article 6(1)(f) GDPR. Hosting and infrastructure providers may receive data as processors. The specific contracting entity, storage region, subprocessors and any safeguards for international transfers must be confirmed and documented before launch.

3a. Spam protection (security code)

Before the project brief, scanner reports (AI Act and DPP) and roadmap requests are submitted, we display a security code as an image. The code is generated by our own server; no external CAPTCHA provider is used and no cookies or trackers are set for this purpose.

The server stores only a code identifier, a hash of the solution and its expiry time. Each code can be used once and expires after 10 minutes. The purpose is protection against automated abuse, based on Article 6(1)(f) GDPR.

3b. Sign-in for the internal administration area

The internal administration area is intended only for authorised staff. Sign-in is handled by the authentication service Clerk, which processes email address, sign-in data and session information and sets a technically necessary session cookie. Access to enquiries is checked on the server against the verified email address.

No sign-in is required to use the public website, the scanner or the forms. The administration area does not store contact details in browser local storage.

4. Language preference, fonts and tracking

Your language choice is stored in your browser’s local storage under “warp-lang”. You can remove it by clearing this site’s browser data. It is used only to preserve your chosen display language.

The website loads fonts from Google Fonts. The provider receives technical connection data, including your IP address. This is based on the legitimate interest in consistent presentation; the implementation and any international transfers require legal review before publication.

The application code does not include advertising or analytics trackers. Hosting-provider technical functions must be assessed separately.

5. Appointment booking

The submission flow currently shows a calendar placeholder only. No Calendly or HubSpot calendar is loaded and no appointment is booked. Before an external booking provider is enabled, we will add information about the recipients, processing and any required consent.

6. Retention

The current application has no automatic deletion routine. Project briefs remain stored until manually deleted. A purpose-based retention period and regular deletion process must be established before live operation; statutory obligations may require longer retention in individual cases.

7. Your rights

Subject to applicable conditions, you may request access, rectification, erasure, restriction of processing and data portability. You may object to processing based on legitimate interests for reasons relating to your particular situation. Consent, where given, can be withdrawn with effect for the future.

You may complain to the Austrian Data Protection Authority or another competent supervisory authority. This application does not perform automated decision-making or profiling with legal or similarly significant effects.