Privacy policy
Last updated 28 September 2026
What we collect, why we have it, and how to get rid of it.
The short version
The free build form keeps your email, name, the first job you would give AI, and a LinkedIn or website link if you add one. Inside Circle, the optional AI Team check and session registrations keep what you submit there. We use it to provide what you asked for and to contact you about it. We do not sell it. If you want all of it deleted, use the Profile section in Circle or email egils@areteaios.com.
Who is responsible for your data
The controller is Full Digital, a registered association in Latvia, registration number 40008303188, registered on 18 December 2020. AreteAIOS is run by that association. The postal address is Priedaines iela 16, Ikšķile, Ogres novads, LV-5052, Latvia. The person you can always reach is Egils Boitmanis, at egils@areteaios.com. One person reads that inbox.
What you type at /start
The free build form asks for your email, your name, one answer about the first real job you would give AI, and, optionally, one LinkedIn or website link. Egils reads the answer and any link himself. Nothing fetches, rates or analyses the link automatically. The form also offers a separate optional choice for occasional Circle updates.
The optional AI Team questions inside Circle
The AI Team check is available only after you open Circle with your email and a one time code. If you answer its nine questions, the answers and suggested roles are stored against your Circle record. They are visible to you inside Circle and to Egils in the private reading view, not at a public address.
What the form records without asking you to type it
The build form records the language you chose on the site. If you allow Analytics, we also keep up to five campaign labels from the address in this browser tab for at most 24 hours, so an internal link or an access code does not lose the advertising source. The labels are utm_source, utm_medium, utm_campaign, utm_content and utm_term. They accompany analytics events; they are not added to your Circle profile. Withdrawing Analytics permission removes them. Names, email addresses and your written answers are not part of these labels. For tagged ChatGPT and Meta paid pilot visits, our own database also records public page views, 30 seconds with the page visible, halfway scrolling, access-button clicks, form starts, confirmed guide access and guide actions. A random identifier links these events within this tab for 30 minutes; it is not linked to your account. We store the campaign and creative labels and the request country, not form content or private page addresses. Old event rows are removed during collection once they are older than 30 days. Withdrawing Analytics permission stops collection and clears the tab identifier. A submitted form is not a verified registration; a copied prompt is not completed work.
Circle, and registering for a session
Opening Circle through /start asks for your email, name and the first job you would give AI; the profile link is optional. Registering for a masterclass session asks for your name and email and records the session, language and time. Both require permission to hold the details and contact you about what you registered for. Occasional Circle updates are a separate optional choice.
Requests are held until you confirm the address
Sending either of those forms does not yet create anything in your name. It creates a short lived pending request, tied to the address you typed and to the browser you sent it from, which expires within the hour and is deleted. It becomes a real Circle record, a consent record and, for a session, a session registration only after you confirm that the address is yours by typing the six digit code we send to it. Until then it cannot touch anyone else's details, and if you never confirm, nothing of it remains. The reply on the page is the same whether or not an address is already known to Circle, and that sameness is on purpose, so the form cannot be used to find out whether an address is registered.
The access code
You ask for the code on the page and it lasts an hour. It stops working after five wrong tries, or the moment it is used. We do not store the code, only a fingerprint of it that cannot be turned back into the digits. The message carries the code and nothing else: no link, no joining address, nothing that works on its own. To stop someone hammering the form we also count requests for a short while, against fingerprints of your network address and of the email address you typed. The fingerprints are mixed with a secret before they are stored, so neither address can be read back from them.
The cookie behind an unfinished request
While a Circle or masterclass registration request is still unconfirmed, your browser holds a cookie called __Host-circle_claim. It is necessary: it carries an opaque random value that ties that one unfinished request to the same browser, so nobody else can confirm it from elsewhere and it cannot touch another person's details. It contains no name, no email and nothing else about you, scripts cannot read it, and it only travels over a secure connection. It lasts one hour at most, and the request it points to is deleted when the hour runs out or the address is confirmed. We keep only a fingerprint of the value on the server, never the value itself.
Your readiness result in My Circle
Your readiness result lives inside My Circle, the private area of this site, and there is no public or shareable link to it. My Circle opens with your email address and a one time six digit code we send to it, so only someone who can read that inbox can see the result. Inside you see your readiness score and the five layer breakdown, the answers you gave in the check, and a machine written reading of those answers. The contact details we hold for you are your name, your email and your phone number if you gave one. If you want it all gone, the Profile section of My Circle has a danger zone where you can delete your Circle yourself.
Your phone number
We ask for a phone number in one place only, on your result page after you finish the readiness check, and only so we can add you to the cohort WhatsApp group. Nothing is stored unless you tick the box. Other people in the group see the number, the same way you see theirs. Saying no changes nothing about your place, your emails or your result, and you can remove the number from the same page at any time.
What we collect if you pay
Payment runs through Stripe. You type your card details into Stripe's own form, not ours. Your card number never reaches this site and never reaches our database. When a payment finishes, our server receives the facts it needs to record the sale and to create and email your Full Digital invoice: the email you paid with, your name or your company name, the billing address, the business registration number if you filled that field in, the amount, the currency, the date, the ids Stripe gives the payment, and the card brand and last four digits when Stripe passes them. The durable order record we keep holds only the payment and order facts we need for our books, not every line of the invoice. Paying is not connected to Circle. No Circle account is required to pay, and a payment does not create one, does not change one and is not matched to one.
Cookies
Three necessary or first-party cookies may appear before you allow anything optional. __cf_bm comes from Cloudflare and helps distinguish real visitors from bots. __dpl identifies the version of the site you were served. aa_consent stores your cookie choice for one year so we do not ask on every page. None of these three is used for advertising. If you allow Analytics, Google Analytics may set its own cookies. If you allow Marketing, the Meta Pixel may set _fbp and, after a Meta ad click, _fbc. Reject keeps both Google Analytics and the Meta Pixel off.
The Circle sign in cookie
If you sign in to Circle with a code, one more cookie appears, called __Host-circle_session. It is necessary: without it the page cannot tell that the person reading it is you. It holds a random value and nothing about you, scripts cannot read it, it only travels over a secure connection, and it stops working thirty days after you signed in, or the moment you press sign out. We keep only a fingerprint of it, so the value in your browser is the only copy.
What we measure
Lovable, the platform that hosts these pages, runs a same-domain visit counter on every page. It reads the page, browser and device type, browser language and referring page. Google Analytics is optional and loads through Google Tag Manager only if you allow Analytics. The Meta Pixel is also optional and loads only if you allow Marketing. It tells Meta that a page was viewed or that a registration, call-button click, checkout or purchase happened; it never receives the name, email, profile link or written answer from our forms. We use it to measure Facebook and Instagram ads and to build advertising audiences. Meta receives the usual technical details of a browser request, including the IP address, browser information, page address and Meta cookie identifiers when present. The Tag Manager container is GTM-MD3QFXGM, the Analytics property is G-0P3MCMD47W and the Meta dataset is 1727554968503548.
There is a WhatsApp link on this site, in the footer, as a floating button and on the about page. It points at wa.me, which belongs to Meta, so when you click it Meta sees the request, including the usual things a web request carries: your IP address, your browser and the page you came from. The conversation after that happens inside WhatsApp, under Meta's own terms, not on this site. Separately, the Meta Pixel described above loads only if you allow Marketing.
Fonts
The type on this site comes from this site. The font files sit on our own server. Opening a page does not tell Google, or anyone else, that you were here. Until August 2026 the fonts were pulled from Google on every page, which meant Google saw your IP address before you had clicked anything or agreed to anything. That is fixed, and this paragraph stays here so you can see what changed.
Video
The short video on the front page sits on YouTube, but nothing from Google loads until you press play. There is no hidden player and no thumbnail pulled from a Google server. When you do press play, the video comes from youtube-nocookie.com, and from that moment Google knows you are watching it.
What is not on this site
There is no LinkedIn or TikTok advertising pixel. With Analytics permission, PostHog in its EU region measures page interactions, heatmaps and public-page session replays. Forms, input values and private Circle content are hidden; console logs and network payloads are not collected. We use anonymous browser-tab identifiers, not your name or email, and drop the IP address in PostHog. Replays are retained for 30 days. PostHog stores its anonymous analytics state in this tab, and withdrawing Analytics permission stops collection and clears that state. The optional measurement tools described above stay off until you allow their category. We make no automated decision through these tools that has a legal or similarly significant effect on you.
About email
Email is sent through Resend, a service that delivers mail for websites. When you send the readiness check form, one message goes out automatically to Egils saying that you applied; your result itself waits for you inside My Circle rather than arriving by email. Later messages about the cohort go to you on the same permission you ticked. Resend sees your email address and the message, and it keeps a delivery record so we can tell whether the message arrived. Every email we send you has an unsubscribe link at the bottom, and it works on the first click. Anything beyond those is written and sent by hand.
Circle email is different
After you send a Circle or session form, the next step on the page asks for a six digit access code for the address you typed, and the only Circle message that exists is that one time code. It is not a newsletter confirmation and it does not subscribe you to anything. Occasional Circle updates are a separate choice, controlled by the optional tick box on the form and by the same preference in your profile, and they stop the moment you take that back. If the mail service cannot deliver a message, the page still answers the same way, so a silent inbox never confirms or denies anything about an address.
Why we are allowed to hold this
The emails about the cohort rest on the permission you ticked, and you can take that back whenever you like. The rest of your answers we hold because you asked to be considered for a cohort, and we cannot consider you without them. Payment records we hold because a business has to keep a record of what it sold. The security cookie is there because a site has to be able to defend itself.
Who else can see it
Lovable, which hosts the site and holds the database. Supabase, the database engine behind Lovable Cloud. Cloudflare, which serves the pages and blocks bots. Resend, which delivers the emails. Google, through Analytics and Tag Manager, only if you allow Analytics. Meta Platforms Ireland, through the Meta Pixel, only if you allow Marketing; Meta and Full Digital are joint controllers for collecting and sending that event data, after which Meta handles it under its own privacy policy at facebook.com/privacy/policy. Stripe, only if you pay. YouTube, only if you press play. Anthropic, which scores the three written answers in the readiness check and writes the reading stored on your result page: only the answers are sent, never your name, email or link, and API data is not used to train its models. Meta also runs WhatsApp, if you give us a number for the group or click the WhatsApp link. And Egils Boitmanis, who reads the inbox. Any optional measurement providers are described above and receive data only with the relevant permission. We do not sell your details and we do not rent them out.
How long we keep it
If you apply and we do not end up working together, we keep your answers until you ask us to delete them, and one email is enough. Circle details follow the same rule: we hold them while the relationship is alive and we delete them when you ask. A registration request that is never confirmed expires within the hour and is deleted by a cleanup that runs shortly after that. Access codes die after an hour or five wrong tries. Sessions end after thirty days at the latest. The hashed identifiers behind rate limiting may stay up to 49 hours, because they are kept for 48 hours and removed by a cleanup that runs every hour. If you become a customer, the payment records stay as long as Latvian accounting law makes a business keep its books. If you ask us to delete everything, we do it, and we do not keep a quiet copy.
What you can ask us to do
You can ask for a copy of everything we hold about you. You can ask us to correct it. You can ask us to delete it. You can ask us to stop emailing you, and you can take back the permission you ticked at any time, which does not undo the emails already sent. You can ask for your answers in a file you can take elsewhere. One email to egils@areteaios.com starts any of these and you do not owe us a reason. We answer within one month. If you think we handled your data badly, you can complain to the supervisory authority in Latvia, Datu valsts inspekcija.
Changes to this page
When something on this site changes what we collect, this page changes first and the date at the top moves with it. We do not backdate it.