Privacy Policy
Last updated: October 5, 2026
The protection of your personal data matters to us. This Privacy Policy explains what data we collect through pythia.works (the “Website”), why we collect it, how we use it, who we share it with, and what rights you have, in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and Cyprus Law 125(I)/2018 on the Protection of Natural Persons with Regard to the Processing of Personal Data.
1. Who we are — Data Controller
The data controller responsible for your personal data is:
K.A. Pythia Works AI Digital Services (hereinafter “Pythia Works”, “we”, “us”).
- Country of registration: Cyprus
- Registered address: Tripoleos 23E, 2235 Latsia, Cyprus
- Contact email for data protection matters: [email protected]
“K.A. Pythia Works AI Digital Services” is the trading name of Kostis A. Antoniades Trading Ltd, registered in Cyprus.
If you have any questions about how we process your personal data, please contact us at the email address above.
2. What data we collect
Depending on how you interact with the Website, we collect the following categories of data:
| Category | Data | Source |
|---|---|---|
| Contact details | Name, email, company (optional), phone number (if provided), message content | Contact form |
| Technical form submission data | The page you sent the form from, the page language, date/time, the package you selected, the source of your visit (referring page, campaign parameters (utm_*), gclid, fbclid), an irreversible hash of your IP address | Contact form |
| AI assistant conversation data | The content of the messages you send in the chat, any details you share in it, a technical session identifier, IP address, date/time | The Website’s chat widget (“Pythia Bot”) |
| Contact details from the chat | Name, phone number and email you give in the conversation so that a person can contact you | The Website’s chat widget (“Pythia Bot”) |
| Call booking data | Name, email, date/time of the appointment, any notes you add | Booking link (Google Calendar) |
| Subscription and payment data | Name/company name, email, billing details (address, VAT number), package, payment history. Card details are processed exclusively by Stripe; we neither see nor store them | Portal (portal.pythia.works) |
| Newsletter data | Email address | Newsletter sign-up |
| Browsing / analytics data | IP address (anonymized where possible), device/browser type, pages visited, time spent, referral source | Google Analytics and similar tools, via cookies |
| Third-party cookie data | Cookie identifiers, display preferences | Third-party scripts (e.g. video embeds) |
We do not collect special categories of data (e.g. health data, religious beliefs, etc.) through the Website.
AI assistant (chat widget). The Website includes an AI chat assistant that runs on our own infrastructure (chat.pythia.works). Its answers are currently generated using Anthropic’s AI models (Claude API); depending on the package, OpenAI models (OpenAI API) may also be used. Your messages are transmitted to the provider’s API to produce the answer and, under the providers’ commercial terms, are not used to train models. Conversations are stored on our systems for 60 days from the last message in the conversation (see section 7) so that a human can pick up the conversation where needed and so that we can improve the quality of the answers. The assistant is an information tool: please do not enter sensitive data or payment details into it.
Contact form. Requests you send through the Website’s forms are stored on our own system, on a server within the EU (Hetzner). To protect the forms from spam and automated programs (bots) we use Cloudflare Turnstile, which processes your IP address and technical details of your browser, without advertising cookies. We do not store your IP address as such, only as an irreversible hash, to protect against abuse (e.g. submission limits). After you submit a form we send you a confirmation email; emails are sent and received through Zoho Mail (Zoho Corporation B.V., the Netherlands, EU data center). Only when our own system is unavailable is the message delivered to our email through the backup channel Web3Forms.
3. Why we process your data (purpose & legal basis)
| Purpose | Legal basis |
|---|---|
| Responding to inquiries submitted via the contact form | Pre-contractual steps taken at your request / our legitimate interest in customer service (Art. 6(1)(b) and (f) GDPR) |
| Protecting the forms from spam, bots and abuse (Cloudflare Turnstile, IP address hash, submission limits) | Our legitimate interest in the security of the Website (Art. 6(1)(f) GDPR) |
| Booking and holding a call you request via the booking link | Pre-contractual steps taken at your request (Art. 6(1)(b) GDPR) |
| Managing subscriptions, charges and invoicing through the Portal | Performance of a contract (Art. 6(1)(b) GDPR) and legal obligation for tax/accounting records (Art. 6(1)(c) GDPR) |
| Sending newsletter communications | Your consent (Art. 6(1)(a) GDPR) — you can withdraw it at any time |
| Operating the AI assistant and answering the questions you ask it | Our legitimate interest in serving visitors / pre-contractual steps taken at your request (Art. 6(1)(b) and (f) GDPR) |
| Responding to a contact request you make in the conversation with the AI assistant | Pre-contractual steps taken at your request (Art. 6(1)(b) GDPR) |
| Analyzing traffic and improving the Website (Google Analytics) and storing the source of the visit for the forms (sessionStorage) | Your consent via the cookie banner (Art. 6(1)(a) GDPR) |
| Operating essential Website functionality (strictly necessary cookies) | Legitimate interest / technical necessity (Art. 6(1)(f) GDPR) |
| Complying with legal obligations (e.g. accounting/tax) | Legal obligation (Art. 6(1)(c) GDPR) |
4. Cookies
The Website uses cookies and similar technologies to function properly, analyze traffic, and improve the user experience.
- Strictly necessary cookies and local storage: ensure the basic functioning of the Website — e.g. remembering your cookie-banner choice and the AI assistant’s session identifier, so your conversation is not lost when you change page. These do not require consent.
- Analytics/statistics cookies (Google Analytics, the banner’s “Statistics” category): help us understand how the Website is used — which pages are read, and events such as a form being sent, the call-booking or email link being clicked, or the chat being opened. These events never include your name, email or the content of your message. They are only activated with your consent; until then no Google script is loaded.
- Visit source (sessionStorage, key
pw_attribution): with the same consent as the analytics cookies, we keep in your browser where you came from on the first page of your visit (referring page, campaign parameters (utm_*), gclid, fbclid), so that we can send it along with your request if you fill in a form. It is deleted when you close the tab or withdraw your consent. Without consent nothing is stored; the form only sends the corresponding details of the page you submit it from. - Third-party cookies (e.g. video or social media embeds): may set their own cookies in accordance with their own privacy policies.
On your first visit, a cookie banner is displayed where you can accept all non-essential cookies, reject them, or choose per category (“Settings”), and you can change your preferences at any time via the “Cookie settings” link in the Website footer or through your browser settings. The Website’s fonts are served from our own servers and are not loaded from third parties.
5. Who we share your data with
We do not sell or rent your personal data. We only share it with:
- Hetzner Online GmbH (Germany), the hosting provider for the Website, the AI assistant and the system where form requests are stored, located within the European Union/EEA.
- Cloudflare, Inc., for DNS, content delivery network (CDN) and protection against malicious traffic — it processes technical connection data (e.g. IP address) in transit — and for Cloudflare Turnstile, which protects the forms from spam and bots (it processes the IP address and technical details of the browser, without advertising cookies).
- Zoho Corporation B.V. (the Netherlands), the email provider (Zoho Mail, EU data center) through which we send the confirmation email and receive and reply to your requests.
- Web3Forms, a backup channel through which form messages are delivered to our email, only when our own system is unavailable.
- Anthropic, PBC (Claude API), for generating the AI assistant’s answers.
- OpenAI, L.L.C. (OpenAI API), for generating the AI assistant’s answers where, depending on the package, OpenAI models are used.
- Google LLC: (a) Google Analytics, for website traffic analysis; (b) Google Calendar, when you book a call via the booking link.
- Stripe (Stripe Payments Europe, Ltd., Ireland), for processing subscription payments through the Portal.
- Our newsletter service provider, if you sign up to our mailing list.
- Public authorities, where required by law.
All third-party providers are contractually bound to process data in accordance with the GDPR.
6. International data transfers
Some of the providers we use (such as Google, Anthropic, OpenAI, Stripe, Cloudflare and Web3Forms) may process data outside the European Economic Area (e.g. the United States). In such cases, we ensure an appropriate legal transfer mechanism is in place, such as the European Commission’s Standard Contractual Clauses.
7. Data retention
We retain your data only for as long as necessary for the purposes described above:
- Contact form requests: up to 24 months, unless you become our customer, in which case the retention periods for customer data apply (contract, subscription, tax/accounting records).
- Form messages classified as spam: up to 30 days.
- Call booking data: until your request has been resolved and for a reasonable period afterwards (typically up to 24 months), unless a legal relationship (e.g. a contract) requires longer retention.
- Newsletter data: until you request deletion/unsubscribe.
- AI assistant conversation data: 60 days from the last message in the conversation, unless a legal relationship requires longer retention; you can request earlier deletion.
- Contact details you give in the conversation: as for contact form data, i.e. until your request has been resolved and for a reasonable period afterwards (typically up to 24 months), regardless of the deletion of the conversation itself.
- Analytics data: in accordance with Google Analytics’ default retention settings.
- Data required for tax/accounting purposes: for the periods mandated by law.
- Backups of our systems: kept for up to 30 days and then deleted automatically. Data deleted from our systems may remain in backups until then.
8. Data security
We take reasonable technical and organizational measures (HTTPS encryption, restricted access, secure hosting) to protect your data against unauthorized access, loss, or misuse.
9. Your rights
Under the GDPR, you have the right to:
- Access your data.
- Rectify inaccurate data.
- Erasure (“right to be forgotten”).
- Restrict processing.
- Data portability.
- Object to processing.
- Withdraw your consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
To exercise any of the above rights, please contact us at [email protected].
You also have the right to lodge a complaint with the competent supervisory authority:
Office of the Commissioner for Personal Data Protection (Cyprus) 1 Iasonos Street, 1082 Nicosia, Cyprus www.dataprotection.gov.cy
If you reside in another EU member state (e.g. Greece), you may also contact the supervisory authority of your country of residence.
10. Children
The Website is not directed at individuals under the age of 16, and we do not knowingly collect data from minors.
11. Changes to this Policy
We may update this Privacy Policy from time to time. Any changes will be posted on this page, with an updated “last updated” date.
12. Contact
For any questions regarding this Privacy Policy or the processing of your personal data:
K.A. Pythia Works AI Digital Services Tripoleos 23E, 2235 Latsia, Cyprus Email: [email protected]