Privacy policy

1. Controller and contact

Warp Design & Innovation FlexCo Sterngasse 3, 1010 Vienna, Austria Represented by CEO Arkadi Jeghiazaryan.

For privacy enquiries and to exercise your rights, contact office@warp-innovation.com or write to the address above.

2. Project briefs and enquiries

When you submit the form, we store your chosen service areas, goal or bottleneck, name, company, work email, optional phone number, timeline, language and submission time in a database.

We use this information to respond to your enquiry and prepare a discussion. The legal basis is Article 6(1)(b) GDPR for pre-contractual enquiries, or Article 6(1)(f) GDPR for enquiries on behalf of a company (our legitimate interest in responding to business enquiries).

Required fields are necessary to process the brief; a phone number is optional. Please do not submit sensitive personal data or confidential third-party data. Success is shown only after the brief has been saved.

2a. AI Act & Enterprise Readiness Scanner

When you complete the scanner and request a report, we store your name, company, work email, job title or function, answers including company context and the conditional follow-up, calculated score, answer coverage and domain scores, report ID, language, report request (form confirmation) and submission time in a database.

If you request a discussion about your 90-day roadmap, we also store your confirmed contact details, priority area, goal, preferred start period, optional notes and contact confirmation, linked to your assessment. Please do not enter sensitive personal data or confidential company information in free-text fields.

The purpose is to produce your requested report and handle your optional meeting enquiry. The legal basis is Article 6(1)(b) GDPR for pre-contractual steps at your request, or Article 6(1)(f) GDPR for requests on behalf of a company (our legitimate interest in handling business enquiries). The form confirmation is not consent to advertising or newsletters.

The PDF is generated locally in your browser for download; the PDF file itself is not archived on our server. Submitted answers and results remain available with your enquiry for meeting preparation. Contact details are not stored in browser local storage. Retention is described in section 6.

2b. DPP & ESPR Readiness Checker

When you complete the DPP checker and request the report, we store your name, company, work email, job title, your six answers (including the unscored product category), score, answer coverage, domain scores, report ID, methodology version, language, consent confirmation and submission time in a database.

If you then request a roadmap consultation, we also store your contact details, priority area, goal, timeline, optional notes and contact confirmation, linked to your assessment. No appointment is booked automatically.

Purpose, legal basis, local in-browser PDF generation and retention are the same as in section 2a.

3. Hosting and technical data

The website and database are provided through Replit. Technical connection data, including IP address, browser information and access time, is processed to deliver the service. The application logs request method, path, status code and response time.

The purposes are website delivery, operational security, abuse prevention and troubleshooting. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is the secure and reliable operation of our online services. Replit and infrastructure providers involved receive the data needed for these purposes. Processing outside the European Economic Area, particularly in the USA, is possible. See section 5a for international transfers.

3a. Spam protection (security code)

Before the project brief, scanner reports (AI Act and DPP) and roadmap requests are submitted, we display a security code as an image. The code is generated by our own server; no external CAPTCHA provider is used and no cookies or trackers are set for this purpose.

The server stores only a code identifier, a hash of the solution and its expiry time. Each code can be used once and expires after 10 minutes. The purpose is protection against automated abuse, based on Article 6(1)(f) GDPR.

3b. Authentication and internal administration

We use the authentication service Clerk (Clerk, Inc.) for the protected administration area. When authorised users sign in, email address, authentication and session information are processed, and necessary cookies secure the session. Permission to access saved enquiries is also checked on the server.

Clerk loads when accessing administration or sign-in pages and also processes technical connection data. Direct entry to public pages does not require Clerk. No account or sign-in is required to use the public website, scanners or forms.

The legal basis is Article 6(1)(f) GDPR (our legitimate interest in secure access management and protecting stored enquiries). Necessary storage and access for a requested sign-in are based on section 165(3) of the Austrian TKG 2021. Further information: https://clerk.com/legal/privacy.

4. Language and privacy preferences

Your language preference is stored under “warp-lang” in browser local storage until you clear the website data or change your choice. Your Analytics preference is honoured under “warp-analytics-consent-v1” for up to 180 days, after which you are asked again.

These entries serve to respect your requested settings, not to recognise you for advertising. The legal basis is Article 6(1)(f) GDPR (our legitimate interest in implementing your choice); necessary storage is based on section 165(3) of the Austrian TKG 2021.

4a. Locally served fonts

Fonts used on the public pages are served with this website through our hosting infrastructure. Loading these fonts does not establish a connection to Google Fonts. Section 3 describes the technical connection data processed by our hosting provider.

4b. Google Analytics – only with your consent

Only with your consent, we use Google Analytics 4 (measurement ID G-Y202LFT9HG), provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We statistically evaluate page views, CTA clicks, form usage, assessment progress, successful enquiries and PDF downloads to improve our services. The legal basis is Article 6(1)(a) GDPR; storing or accessing information on your device is based on consent under section 165(3) of the Austrian TKG 2021.

Google processes usage and device information and cookie identifiers (particularly “_ga” and “_ga_*”). Processing in the USA is possible. Our custom Analytics events do not include names, email addresses, companies, free text, scanner answers, scores or report IDs. Our integration disables advertising personalisation and Google Signals. Our Analytics events do not capture sign-in or administration pages.

Without consent, the Google Analytics script is not loaded. Rejecting Analytics does not affect use of the website, forms or reports. You can change your choice or withdraw consent with effect for the future using “Privacy settings”. We then stop measurement and remove Analytics cookies accessible to our website. Withdrawal does not affect the lawfulness of previous processing or automatically delete data already transmitted.

Retention of user and event data depends on the Analytics property configuration. Google Analytics 4 Standard offers 2 or 14 months; the retention period for a user identifier may restart with new activity. Aggregated standard reports are not subject to this setting. You can request information about processing of your data through our privacy contact. Retention information: https://support.google.com/analytics/answer/7667196. Google privacy information: https://policies.google.com/privacy.

5. Meeting enquiries and scheduling

By submitting a project brief or roadmap enquiry, you ask us to contact you about your request. This does not automatically create a confirmed appointment. We use your contact details and information to coordinate the next step and a meeting time. No external Calendly or HubSpot calendar is embedded. The purposes and legal bases in section 2 apply.

5a. Recipients and international processing

Saved enquiries and scanner results are accessible to authorised people at Warp handling your request. The hosting, authentication and analytics services named in this policy support the website and its functions. Data may also be disclosed to authorities or professional advisers where required by law or necessary to establish, exercise or defend legal claims.

Replit, Clerk and Google may process data outside the European Economic Area, particularly in the USA. Such transfers require a basis under Articles 44 et seq. GDPR, such as an applicable adequacy decision or appropriate safeguards including EU Standard Contractual Clauses. The basis for a specific recipient depends on the service and contractual relationship involved. You can request information about transfers affecting your data and a copy of relevant safeguards at office@warp-innovation.com.

6. Retention and erasure

The necessary retention period for project briefs, scanner answers, results and meeting enquiries depends on their purpose: handling your request, providing the requested assessment, preparing a meeting and, where applicable, working together. Statutory retention obligations and the need to establish or defend legal claims may also apply. Requesting a report does not authorise unlimited use of your data for advertising.

Enquiries are not automatically erased after a programmed period; erasure is performed manually. You may request erasure or restriction through our privacy contact. If retention obligations or other statutory exceptions apply, we will explain them in response to your request. Separate storage details for browser preferences and Analytics appear in section 4.

7. Your rights

Subject to applicable conditions, you may request access, rectification, erasure, restriction of processing and data portability. You may object to processing based on legitimate interests for reasons relating to your particular situation. Consent, where given, can be withdrawn with effect for the future.

You may complain to the Austrian Data Protection Authority or another competent supervisory authority. This application does not perform automated decision-making or profiling with legal or similarly significant effects.