Privacy Policy.

Each time this website is accessed, our hosting provider automatically collects technical information that your browser transmits to us. This includes:

• IP address of the requesting device
• Date and time of access
• Requested URL / content of the request
• Access status / HTTP status code
• Referrer URL (previously visited page)
• Browser type, browser version, language, operating system

Purpose: providing the website, ensuring IT security, detecting and defending against attacks.

Legal basis: Art. 6(1)(f) GDPR — legitimate interest in the technically sound and secure operation of the website.

Retention period: 7 days, unless longer retention is required in individual cases for security reasons (e.g., incident analysis).

This marketing website does not set any tracking, analytics, or marketing cookies. No cross-site tracking takes place, and no advertising profile is created. The audience measurement described in §16 (Matomo) deliberately works without cookies.

Only technically necessary storage values may be set — values without which the basic functioning of the website cannot be guaranteed (e.g., a session identifier, or storing the selected mobile menu state). This data does not leave your browser.

Legal basis: Art. 6(1)(f) GDPR and §165(3) of the Austrian Telecommunications Act (TKG 2021) (technically necessary storage).

Note: different rules apply to the corporate website radical-innovators.com (which uses, among other things, Cookiebot and Google Analytics 4 with anonymized IP addresses). These are described separately in that site's privacy policy (in German).

If you contact us by email or via a contact form, we process the data you provide (name, email address, company, message text, and telephone number where provided) for the purpose of handling your inquiry.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest in responding to inquiries).

Technical implementation of the form: Transmission is handled via the service Resend, Inc. (USA); processing takes place on US servers (AWS, Cloudflare). The third-country transfer is based on Standard Contractual Clauses under Art. 46 GDPR and the EU-US Data Privacy Framework.

Retention period: Data from inquiries that do not lead to a project is deleted within 6 months after the correspondence ends; if an inquiry results in a project, statutory retention periods apply (7 years under §132 of the Austrian Federal Fiscal Code (BAO) for business records).

When you use the SaaS product Radical Personas (after registration / login in the application), we process data that you actively enter — e.g., persona context information, test questions, uploaded documents, or review texts. The complete in-product privacy policy with all details is available within the application. In summary:

• LLM providers: For AI-based inference, we select the best available language model (LLM) from several providers for each task in order to achieve the highest review quality. We provide an up-to-date subprocessor list to Enterprise and Business customers on request.
• Inference region: Where contractually possible, we use the providers' EU endpoints.
• No-training clause: Customer content is not used to train the language models we deploy. We have contractual assurances from all providers we use that API content will not be used for model training.
• Third-country transfers: Where processing takes place outside the EEA (e.g., on providers' US endpoints), it is based on Standard Contractual Clauses under Art. 46 GDPR or — where available — the EU-US Data Privacy Framework.

Personal data is disclosed to third parties only to the extent necessary to provide the respective service or where a legal obligation exists. Processors we use (Art. 28 GDPR):

• EU web hosting provider (hosting of this website)
• Resend, Inc. (USA) — delivery of form inquiries
• Anthropic, PBC (USA) — LLM inference for product features
• Stripe Payments Europe Ltd. (Ireland) — payment processing for subscriptions
• Tax advisory / accounting (Austria, statutory obligations)

Business and Enterprise customers can obtain a complete, up-to-date subprocessor list on request (Art. 28(2) GDPR).

We store personal data only for as long as necessary for the respective purposes or as required by statutory retention obligations:

• Server log files: 7 days (see §3)
• Contact emails without a project connection: up to 6 months
• Project and contract correspondence, invoices: 7 years (§132 BAO)
• Active product accounts: for the duration of the contract
• After cancellation: a 30-day export window, followed by deletion of production content; invoice data remains subject to the statutory 7-year period
• Consent-based data: until consent is withdrawn

Under the GDPR, you have the following rights:

• Access (Art. 15 GDPR) — confirmation of whether and which personal data we process about you
• Rectification (Art. 16 GDPR) — correction of inaccurate data or completion of incomplete data
• Erasure (Art. 17 GDPR) — the “right to be forgotten,” subject to the statutory requirements
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR) — receiving your data in a structured, commonly used, machine-readable format
• Objection (Art. 21 GDPR) — to processing based on legitimate interests, on grounds relating to your particular situation
• Not to be subject to automated individual decision-making (Art. 22 GDPR)

To exercise your rights, an informal message to contact@radicalpersonas.com is sufficient. We respond to requests within the statutory period (Art. 12(3) GDPR — generally one month).

Under Art. 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority. The competent supervisory authority in Austria is:

Alternatively, you may contact the supervisory authority of your habitual residence, your place of work, or the place of the alleged infringement.

We implement technical and organizational measures in line with the state of the art, in accordance with Art. 32 GDPR, to protect personal data against unauthorized access, loss, or manipulation. These include, among others:

• Transport encryption (TLS 1.3) on all connections
• Encryption of sensitive data at rest
• Role-based and least-privilege access model, 2FA for administrative access
• Regular security updates and patch management
• Versioned backup strategy with separate recovery paths
• Pen test reports and subprocessor list on request (Business/Enterprise)

ISO 27001 certification is part of our medium-term roadmap.

For statistical analysis of how this website is used, we use the open-source software Matomo. Matomo runs on our own server within the EU — no analytics data is transmitted to third parties or to third countries.

Measurement takes place without cookies: no persistent identifier is stored on your device. Your IP address is truncated (the last 2 bytes are anonymized) and is not stored in plain text. No personal profiles are created and no cross-site tracking takes place.

Data processed (anonymized/aggregated): pages visited, date and time, approximate region of origin (derived from the truncated IP), referral source (referrer), browser and device type.

Purpose: needs-based design, improvement, and audience measurement of this website.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in data-minimizing, statistical audience measurement). Since only data-minimizing, cookieless storage and access operations take place, we base the processing on your device on §165(3) of the Austrian Telecommunications Act (TKG 2021).

Retention period: The statistical data is deleted after no more than 6 months (180 days).

Objection: You can object to the anonymous measurement at any time using the following toggle:

Opt out of anonymous measurement

Note: if you opt out, we store this choice in a technically necessary cookie so that we can continue to exclude you from measurement on this browser.