--- title: Privacy Policy description: How Streamlight AI handles what you share with us: what we collect, why, where it’s kept, for how long, and your rights. url: https://www.streamlight.ai/privacy/ updated: 2026-10-22 --- # Privacy Policy What we collect when you use this site, chat with our agent or book a call: why, where it’s kept, for how long, and what you can ask of us. Version of 22 October 2026 ## 1\. Who we are Streamlight AI is a trading name of MCS Intellect SRL. We decide why and how the personal data described here is used, so we are its controller under the General Data Protection Regulation (EU) 2016/679 (“GDPR”). Company MCS Intellect S.R.L. Trading as Streamlight AI Registered office Sat Nicolești nr. 4, Comuna Ulieș, Harghita County, 537344, Romania Trade register number J2022000602198 (EUID ROONRC.J2022000602198) Fiscal code (CUI) 44092456 · VAT number RO44092456 Phone +40 737 669 510 Contact for anything in this policy hello@streamlight.ai We haven’t appointed a data protection officer, because the law doesn’t require one for a company of our size and activity. Write to hello@streamlight.ai and the founder answers. This policy covers www.streamlight.ai, the agent on it, booking a call with us, emailing us, and the project page we give clients. Work we do for a client is also covered by that client’s contract. ## 2\. What we collect, and where We collect only what you give us, plus what your browser sends when you visit. Where What we collect Where it comes from **Visiting the site** The pages you view and what you click (a console tour, the calculator, a question opened), the page that sent you and any campaign tags in the link, your browser and device type, your approximate country Your browser. We don’t keep your full IP address in analytics \[confirm the setting\] **The company you visit from, only if you agree** The name, size and industry of the organisation that owns the network you browse from. Never who you are Your IP address, matched against business network records by Snitcher (§4) **The calculator** What you enter (business type and size, hourly rate, tasks and hours) and the result You **Our agent** Your email (required), and if you give them your name, company website and role. Everything you write in the chat: your business, the process you want to fix, the tools you use You **Booking a call** Your name, email, the time you choose, your answers to the booking questions, and how you found us (the campaign tags from your visit) You, through Cal.com **Emailing us** Your email address and what you write You **Your project page (from booking, and as a client)** The email each person signs in with, including colleagues you add; when each of you opens the page and the prototype, and which screens; the examples and files you upload, your corrections, the tools you invite us to, and your company’s billing details You **Ads, only if you agree** Identifiers that Meta, Google and LinkedIn set or read, and the pages you visit here Their pixels (§7) We don’t ask for sensitive data: health, beliefs, or anything in GDPR Article 9. Please don’t put it, or any password, into the chat or an upload. If you do, we delete it when we see it. ## 3\. Why we use it, and the legal basis Each use has one legal basis under GDPR Article 6(1). Why What it uses Legal basis Answer your questions and prepare the call you asked for The agent’s conversation, the booking, the calculator’s result Steps you asked for before a possible contract, Art. 6(1)(b) Hold the call and send you the invitation Your name, email, the time Art. 6(1)(b) Follow up once on an enquiry you started and didn’t finish Your email, the conversation Our legitimate interest in answering people who contacted us, Art. 6(1)(f) Do the work for a client Everything on the project page The contract, Art. 6(1)(b) Invoice and keep accounting records Billing details, contracts, invoices Legal obligation under Romanian accounting and tax law, Art. 6(1)(c) Understand how the site is used and improve it Cookieless analytics Our legitimate interest, Art. 6(1)(f) Know which companies visit Company identification from the IP address Your consent, Art. 6(1)(a), because Snitcher’s script stores an identifier in your browser Build ad audiences, count conversions from ads, replay sessions Pixel identifiers, visit data Your consent, Art. 6(1)(a), which you can withdraw at any time Keep the site and the agent secure, and stop abuse Server logs, rate limits Our legitimate interest, Art. 6(1)(f) Establish or defend legal claims What’s relevant to the claim Our legitimate interest, Art. 6(1)(f) Know when you’re looking at your prototype and proposal, so we follow up at the right time Who opened the project page and the prototype, when, and which screens Our legitimate interest in following up a proposal you asked for, Art. 6(1)(f). The page tells each person this when they sign in Where we rely on legitimate interest, you can object at any time (§10), and we stop unless we have a compelling reason. **What we don’t do:** we don’t sell your data, we don’t use it to train AI models, and we don’t send you marketing emails unless you’ve asked for them. ## 4\. Who processes it for us These companies handle data on our behalf, under a data processing agreement with each, and only for what we ask. Provider What it does for us What it handles Where, and the transfer safeguard Vercel Inc. Hosts the site Requests and server logs, including IP addresses United States, served from the location nearest you. Certified under the EU–US Data Privacy Framework PostHog Cookieless analytics Pages, clicks, sources, device type European Union (Frankfurt) Neon (Postgres database) Stores conversations, lead records and project pages Everything in §2 except analytics European Union (Frankfurt) Anthropic, PBC (through its API) Writes the agent’s replies What you write in the chat United States. Standard Contractual Clauses in Anthropic’s data processing addendum Cal.com, Inc. Booking calls Name, email, time, booking answers United States. Certified under the EU–US Data Privacy Framework Google (Workspace) Email, calendar invitations, video calls Name, email, messages, meeting details \[European Union and United States\] Snitcher B.V., only if you agree Names the company behind a visit IP addresses, a browser identifier European Union **Ad platforms, only with your consent:** Meta Platforms Ireland, Google Ireland and LinkedIn Ireland. For the data their pixels collect on our pages, they and we decide jointly, and each is responsible for its own use of it under its own privacy policy. **Others, only when needed:** our accountant and lawyers, under a duty of confidentiality; authorities, when the law requires it; and a buyer, if the business is ever sold, under this same policy. ## 5\. Transfers outside the European Economic Area Some of the providers in §4 process data in the United States. Each transfer rests on one of two safeguards: - **The EU–US Data Privacy Framework** (Commission Implementing Decision (EU) 2023/1795), where the provider is certified under it. - **The Standard Contractual Clauses** (Commission Implementing Decision (EU) 2021/914), with the extra measures the provider offers, where it isn’t. Write to hello@streamlight.ai for a copy of the safeguard that covers a given provider. ## 6\. How long we keep it We delete data automatically at the end of each period, or anonymise it so it no longer identifies anyone. Data Kept for Agent conversations 12 months from the last message, unless you become a client Lead records and bookings 24 months from our last contact Emails with people who aren’t clients 24 months from our last contact Analytics events \[12\] months; totals with no personal data after that Company identification results With the lead record, or \[90 days\] if no one from that company contacts us Server logs \[30\] days Files and examples on a project page Until the engagement ends, then deleted unless you ask us to keep them. You can delete them yourself at any time Contracts, invoices and accounting records As Romanian accounting and tax law requires: currently 5 years from 1 July of the year after the financial year (Law 82/1991, art. 25) Records of your consent choices As long as the consent lasts, plus \[3\] years as proof Calendar events As long as any meeting record; deleted on request Who opened a project page and its prototype 6 months after the proposal, or for the engagement if you go ahead ## 7\. Cookies, browser storage and ads **Without asking you, we use only what the site needs or what you chose:** Item What it does How long `sl-theme` (browser storage) Remembers light or dark, if you switched it. It stays in your browser and is never sent to us Until you clear it Analytics Counts visits and clicks without cookies, browser storage or fingerprinting Nothing is stored on your device Cal.com’s booking window Sets what it needs to work when you open it \[per Cal.com\] \[Other items, listed from the built site\] **Only if you agree**, through the small prompt in the corner of the page: the Meta, Google and LinkedIn pixels, session replay, and Snitcher’s company identification. Until you say yes, none of them loads. Change your mind at any time with *Privacy choices* in the footer. We also treat your browser’s Global Privacy Control signal as a no. This follows Romania’s Law 506/2004 on electronic communications, art. 4(5), which requires consent before storing or reading anything on your device that isn’t strictly necessary. ## 8\. Our agent - **It’s an AI system, and it says so** before you start (EU AI Act, Regulation (EU) 2024/1689, Article 50(1)). - **What it does:** it asks about your business and the process you’d like to fix, so the call starts from your answers. Its replies are written by Anthropic’s Claude models, through Anthropic’s API (§4), from what you write. - **It decides nothing about you.** It can’t agree a price, a scope or a contract; a person reads the conversation before the call. No decision with legal or similarly significant effect is made by automated means alone (GDPR Article 22). - **It can be wrong.** Its replies are a starting point for the call, not advice. - **Your conversation isn’t used to train AI models**, ours or Anthropic’s: Anthropic’s commercial terms exclude data sent through its API from training. We read conversations to prepare calls and to improve the agent’s questions. - **Please don’t share** passwords, payment details or sensitive personal data in the chat. ## 9\. Security - Everything travels encrypted (HTTPS), and our providers encrypt it where it’s stored. - Only the people who work on your enquiry or project can see it, each with their own account and two-step sign-in. - We never ask for your passwords. Access to your tools is by invitation, which you can withdraw. - If a breach puts your data at risk, we tell ANSPDCP within 72 hours, and tell you without delay when the risk to you is high (GDPR Articles 33 and 34). ## 10\. Your rights, and how to use them Under GDPR Articles 15 to 21 you can ask us to: - show you the data we hold about you, and give you a copy; - correct it; - delete it; - restrict how we use it; - give it to you, or to another company, in a common machine-readable format; - stop using it where we rely on legitimate interest (§3). Where we rely on your consent, you can withdraw it at any time; what we did before stays lawful. **How:** write to hello@streamlight.ai. It’s free. We answer within one month, or tell you within that month if we need two more because the request is complex. We may ask you to confirm who you are first. **Complaints:** you can complain to Romania’s data protection authority, or to the one where you live or work. Authority Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP) Address B-dul G-ral. Gheorghe Magheru 28–30, Sector 1, 010336 Bucharest, Romania Email anspdcp@dataprotection.ro Website [www.dataprotection.ro](https://www.dataprotection.ro) We’d like the chance to put it right first, so please write to us too. ## 11\. Visitors outside the EU, children, and changes **Visitors in the United States and elsewhere.** As an EU company, we apply GDPR to everyone’s data, wherever you are. We don’t sell personal data or share it for targeted advertising without your consent, and we honour Global Privacy Control. **Children.** The site is for businesses. We don’t knowingly collect data from anyone under 16; if we learn we have, we delete it. **Changes.** We date every version of this policy at the top. When a change affects how we use data you’ve already given us, we email you before it applies. **Contact.** MCS Intellect SRL, trading as Streamlight AI, Sat Nicolești nr. 4, Comuna Ulieș, Harghita County, 537344, Romania · hello@streamlight.ai