Agreements - Privacy Policy

Icarus Now is a one-person AI consulting practice. We make money by helping businesses choose, plan and ship AI projects. So there's no need or reason to sell, rent or give away any of your personal data.

We are not owned by any conglomerate parent companies or report to any board of directors. We run an ethical business that hopes to help teams get real value out of AI without the hype.

We hope to provide you with clear and transparent information on how we process your personal data (as a controller) and your data protection rights. If you feel that any information is unclear or missing, please do not hesitate to contact us.

We start this policy by describing our processing as the controller of your personal data. We also process some personal data on your behalf, as a data processor, described in section 7.

• Access and rectification: you may request a copy of the information we process about you and ask us to rectify any incorrect data.
• Erasure or restriction: in some circumstances, you may ask us to delete or restrict our processing of your data, but we cannot delete any data we are legally required to process.
• Object to processing: in some circumstances, you may ask us to stop processing your data.
• Data portability: in some circumstances, you may ask us to transfer your data to you or another organization.

If you're unhappy about how we process your data, you have a right to complain to a national data authority. We hope, however, that you will contact us first so that we can try to resolve the matter for you in a satisfactory way.

Please get in touch with us if you have any questions about how we handle your data or want to exercise one of your rights. You are entitled to a reply within 30 days.

We typically process personal data on existing clients, website visitors, newsletter subscribers, vendors and collaboration partners.

We may process personal data when you:

• Contact/communicate with us online (contact form, email, video calls, social media, etc.) or on the phone
• Engage us as a client or work with us in a shared project space
• Subscribe to our newsletter
• Deliver products/services to or enter into a collaboration with us

It is voluntary to provide us with personal data, but we cannot provide you with our services if you choose not to.

We do not rent, buy or sell personal data from or to others, use automated decisions or profiling in the processing of your personal data, or process any special category data as per the GDPR Article 9.

We only process your personal data when we have a purpose and a lawful basis for doing so. Under the GDPR Article 6-1, the lawful bases we rely on are:

• Your consent
• We have a contractual obligation (contract)
• We have a legal obligation
• We have a legitimate interest

As a rule, we do not process personal data for longer than necessary to fulfill the purpose for processing.

We will only retain data for as long as we are required to as per applicable legal obligations such as accounting, tax, labour laws or any other relevant rules and regulations.

This section describes when and how we process your data, for what purposes and our legal grounds to do so (lawful bases). We also specify the retention periods for the processing.

We process personal data when:

5.1. You communicate with us

Regardless of your relationship with us, as a potential or existing client, vendor or other, we process your personal data whenever you communicate with us. This could be when you contact us through our contact form, email or social media. Depending on where and how you contact us, this may include your name, email address, phone number, company name and other information you choose to send to us.

If you use our contact form, we also collect your answers about your project (your business goal, project stage, any deadline, the services you are interested in and any other ideas), and whether you opted in to our newsletter. We store form submissions in our own database on our hosted server (Hetzner), and add you as a contact in Brevo so we can follow up. Adding you to our newsletter only happens if you opt in (see section 5.3). If we invite you to book a free feasibility call, we may send you a personal booking link.

Our forms are protected by Cloudflare Turnstile, which checks that a submission comes from a real person rather than a bot. To do this it runs in your browser and looks at limited technical signals such as your IP address and browser details, and it may use limited browser storage that is strictly necessary for security. We also use your IP address briefly to limit how many submissions can be made in a short period. We do not store your IP address with your submission.

The purpose is to be able to respond to your inquiries and, on some occasions, to keep records in case of complaints or legal claims. The lawful basis is f), where our legitimate interest is to respond to your inquiries and, on some occasions, keep records in case of complaints or legal claims.

If you contact us but do not become a client, we keep your contact form submission (and your matching contact record in Brevo) for up to 24 months after our last contact with you, and then delete it. If you become a client, section 5.2 applies instead. You can ask us to delete it earlier at any time (see section 2).

5.2. You engage us as a client

When you hire us for one of our services, we process the personal data needed to run the engagement: your name, work email, company name and role, billing details, correspondence and the notes and materials you share with us during sessions.

We use Basecamp to run client projects. Icarus Now owns and administers the Basecamp account. Most deliverables, session notes and project communication live in a Basecamp project we set up for you. Basecamp processes the name and email address of anyone you invite to the project, and the content that is posted there.

We use Helcim to process payments. When you pay us, Helcim collects your card or bank details directly. We do not store full payment card numbers on our systems; we receive a confirmation of payment and the details needed for invoicing.

We use Zoho for accounting and bookkeeping. Zoho processes the invoicing and payment records associated with your name, company and billing details.

The purpose of this processing is to deliver the services you have purchased and manage the client relationship. The lawful bases are b) contract and c) legal obligation related to accounting, tax and other business laws we must abide by.

We process the data for as long as you are a client and then for up to 6 years after, in accordance with our legal obligations for accounting, tax and other business purposes. See section 7 for how we handle the business information you share with us during a project.

5.3. You receive our newsletter or marketing emails

If you subscribe to our newsletter, or if you are an existing client, we will occasionally send you emails containing a promotional element or news about our services. The personal data we process is your name and email address. The purpose is to provide you with news and offers related to our services. The lawful basis is a), where you have given us your consent, or f), where our legitimate interest is to offer our relevant products and services to existing clients.

We use Brevo to send these emails. Brevo processes your email address, name and engagement data such as whether an email was opened or a link was clicked (open and click tracking is enabled). Open tracking works through a small image in the email, so blocking remote images in your email client will limit it. We use double opt-in: you confirm your subscription through an email before you are added to the newsletter list.

You can opt-out of marketing emails at any time by clicking the unsubscribe link in any such email. We process the data for as long as we have a client relationship with you or, if the processing is based on your consent, until you withdraw it. When you unsubscribe, your contact is flagged as “unsubscribed from marketing” and you won’t receive any further marketing emails from us. We are still required to process data for accountancy, tax and other business purposes if you are our client.

5.4. You complete one of our surveys

We sometimes send surveys to our clients to improve our services. Responding to our surveys is completely voluntary. We process personal data such as your name, contact details and other information you choose to share with us. We do not process any personal data if a survey is anonymous.

The purpose is to gather your feedback to continuously improve our products and services and provide you with better customer service in the future. The lawful basis is a) consent. We review this data at our regular GDPR audits and delete personal data as appropriate; however, no later than two years after responding to the survey.

5.5. You supply services to or collaborate with us

When you enter into an agreement with us either as a vendor, partner or data processor, we process personal data such as your name, contact details and correspondence. The purpose is to enter into this agreement and communicate with you before, during and after our formal business relationship.

The lawful bases are b) contract, c) legal obligation related to accounting, tax and other business laws we are required to abide by, and f) where our legitimate interests are to be able to communicate with you before, during and after our formal business relationship (described under the paragraph “You communicate with us” above). We store personal data for as long as we have a formal business relationship and then for up to 6 years after, in accordance with our legal obligations for accounting, tax and other business purposes.

5.6. You use our website

We use PostHog to measure website traffic. How it works depends on where you are visiting from. When you load our site, Cloudflare (our network and security provider) tells our server which country (and, for US visitors, which state) your connection appears to come from, based on your IP address. We use this only to choose the analytics mode below. We do not store that location in our own systems.

If you are visiting from the EU/EEA, the UK, Switzerland, Canada, Brazil, Australia, Japan, South Korea and a number of other countries with privacy or cookie-consent laws, from certain US states with privacy laws, or from a location we cannot determine, we use PostHog in cookieless mode. PostHog does not store cookies or use local storage in your browser for this traffic, and we do not identify you as an individual. PostHog counts visits using a hash calculated on PostHog's servers from technical details of your visit combined with a rotating secret, so visits can be counted without recognizing you over time. This approach is intended to support compliance with the ePrivacy Directive (Directive 2009/136/EC) and similar rules without requiring a cookie banner.

If you are visiting from anywhere else (for example, US states and countries outside the lists above), we use PostHog in full mode. PostHog sets a first-party cookie (named like “ph_…_posthog”, lasting up to one year) and may use your browser’s local storage to keep a randomly generated identifier, so repeat visits can be recognized. This identifier does not contain your name or email, and we do not link it to your identity. We do not run a cookie banner for this on our website. You can block or delete cookies and local storage in your browser settings at any time, and the website will still work.

In both modes, we collect basic usage data: the pages you view and leave, the site you came from, your approximate location (country or city), your device, browser and operating system, and interactions such as clicks on links and buttons. We do not record your screen (no session replay), and we do not use this data for advertising or share it with advertisers.

We use this information to improve our website and services. The lawful basis is f), our legitimate interest in understanding how our website is used. Because we use cookieless mode wherever consent would be required to set cookies, we do not ask for cookie consent. We keep analytics data for [CONFIRM: PostHog project retention period].

To run our business efficiently and securely, we sometimes will have to share your personal data with other (trusted) parties such as:

• Data processors: providers of various services that process your personal data on our behalf
• Our accountant
• Professional advisors from other industries, such as law and finance
• IT support, when necessary
• Public authorities: when we are obliged to report to them

We require that all such recipients secure data in accordance with good information security and as per the requirements of this Privacy notice. We review and quality assure all vendors and data processors and enter into a data processing agreement/addendum whenever necessary.

6.1. We use data processors for:

• Client project management and deliverables: Basecamp
• Newsletter, contact-form follow-up and transactional emails: Brevo
• Payment processing: Helcim
• Accounting and bookkeeping: Zoho
• Website analytics: PostHog
• Website hosting, security and media storage: Hetzner (server hosting), Cloudflare (DNS, network protection, Turnstile spam protection, media storage)
• Email, calendar and digital meetings: Google Workspace, Microsoft 365, Zoom
• AI model providers used during engagements: see section 7

6.2. Transfer of personal data outside the EU/EEA

In some cases, your personal data will be transferred to a “third country”, i.e. outside the EU/EEA. We are based in the United States, so this applies to most of our processing. We only use data processors we trust that are well known, reputable, and have a data processing agreement/addendum.

Where a processor is located outside the EU/EEA, we rely on safeguards such as the EU-US Data Privacy Framework, an EU adequacy decision, or standard contractual clauses (SCC). We review each processor's security measures and reputation before using it.

During an engagement you may share business information with us: documents, process descriptions, sample data, system access or other materials needed to plan and build an AI project. Where that material contains personal data about your employees, customers or others, you are the controller of that data and we act as your data processor. In that role we:

• Only process the data on your behalf and as per your instructions
• Use appropriate technical and organizational security measures to protect it
• Treat it as confidential
• Govern this processing by our signed engagement agreement or a data processing addendum when required

We ask you to share only the data that is needed for the project. Where possible, we work with samples, synthetic data or redacted material rather than full production data.

We use third-party AI models and tools in our work, and different models for different kinds of tasks. Every AI model provider we use is required to operate under zero data retention (ZDR) terms: your prompts and files are not retained by the provider and are never used to train their models. We strictly enforce this requirement. We do not paste your confidential data into consumer AI tools that may retain or train on it.

When an engagement ends, we keep deliverables and project records for as long as needed to support you and to meet our legal obligations (see section 5.2). On request, we will delete or return business data you shared with us, except where we are legally required to keep it.

We take information security as seriously as privacy, and we will always do our utmost to safeguard your personal data in the best possible way. For example, we use strong passwords, two-factor authentication, data encryption and several other measures to secure our data and prevent unauthorized persons from accessing, altering, deleting, or in any way affecting the data we store, including your personal data.

We only allow others to access or process your personal data in accordance with our instructions and only when strictly necessary (e.g. in the unlikely event that we require IT support).

If we experience a personal data breach, i.e. a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data, and it poses a medium to high risk for the people affected, we will notify the relevant data authority within 72 hours. If the risk is deemed high for the people affected, we will inform them directly, if possible.

You have a right to access your personal data and request a correction if you believe it is inaccurate. If you have submitted Personal Information and would like to have access to it, or if you would like to have it corrected, please get in touch with us using the contact information provided below.

If you live in California or another US state with a comprehensive privacy law, you may have additional rights, including the right to know what personal data we collect, the right to delete it, the right to correct it and the right to opt out of the sale or sharing of personal data. We do not sell your personal data and we do not share it for cross-context behavioral advertising. To exercise any of these rights, contact us. We will not discriminate against you for exercising them.

We may update this Privacy Policy periodically to reflect changes in our services or policies. If significant changes are made, we will notify you. Continued use of the website after an update constitutes acceptance of the revised policy.

Questions? Contact us