La versión en español está pendiente: se muestra el texto en inglés.
Privacy Policy
Effective 5 October 2026 — Version 2.1
1. Who is responsible for your information?
The izak.studio website is operated under the izak brand by Jérôme ARMNIUS, in his own name, in the United States. A company, IZAK LLC, is being formed in the United States to take over izak's operations. Until it is formed and actually takes over the website, Jérôme ARMNIUS remains responsible for the processing described in this policy. We will inform you of the change in the controller's identity when that transition occurs.
For the processing described in this policy, the operator identified above determines its purposes and means and acts as the data controller.
Contact, including about your personal information: hello@izak.studio.
No Data Protection Officer or EU representative has been appointed to date.
2. Scope
This policy covers browsing this website, starting a project in the New Project app, the analysis of a website you give us, the crash test (the free website analysis on the home page) and the sending of its report by email, the website’s audience measurement, the creation of your izak space, the conversations in Messages (with izak's assistant and with the izak team) and the exchanges that follow.
When izak processes information on a client's instructions in connection with that client's website, software or application, the applicable contract determines the relevant responsibilities. This policy does not replace the client's own notice or the agreement governing processing on the client's behalf.
Regional provisions appear in section 11. More than one law may apply. Selecting a language, travelling or being technically located in a particular country does not waive applicable rights.
3. Information, sources, purposes and legal grounds
We receive information directly from you when you fill in New Project, write in Messages, create your space or contact us. When you give us a website address, the analysis reads that website's public information. If you choose to sign in with Google, Google sends us your name and email address. Technical information comes from your browser and the systems needed to operate the website.
| Activity | Information | Purpose and grounds where the GDPR applies |
|---|---|---|
| New Project, conversation with izak's assistant and preparing the brief | What you enter in New Project (your need, your activity, your goal, the timing you want), the summary of your project written by the AI, your messages to the assistant and its replies, the brief, the website language, the approximate country of your connection (derived from your IP address, to choose the language) and the date | Understanding your request, preparing a brief and, where needed, a proposal. Steps at your request before a contract where you would personally be a party; otherwise, our legitimate interest in answering your enquiry and communicating with the relevant organisation's representative. |
| Analysis of a website you give us | The website address, the public information read on that website (home page, logo, robots.txt, sitemap, llms.txt, technical headers) and the resulting report | Giving you a first reading of your website, showing your logo in your izak space and preparing the proposal. Same grounds as above. |
| The crash test, the free website analysis on the home page and on the “Website analysis” page | The website address you type; the public information read on that website; two screenshots of its home page, taken in a Cloudflare browser; the IP address of your connection, used only to limit the number of analyses per minute | Giving you a free first analysis of that website and a screenshot to demolish in your browser. izak’s legitimate interest in showing its know-how and protecting this service against abuse. No artificial intelligence is involved and the result contains no information about you. |
| Crash test report by email | Your email address, the analysed website and its score, the page language, your choice to be contacted or not, and the date | Sending you the report you ask for (performing your request). If you tick the box provided, contacting you about your website (your consent, which you can withdraw at any time by writing to hello@izak.studio). The izak team is notified of each request, in the Telegram account linked by izak or by email. |
| Website audience measurement | For each page viewed, without cookies or identifiers: the page address, the website you come from (its domain name only), the country of connection derived by Cloudflare, the type of device (phone or computer) and the language; and the number of clicks on a few buttons (start a project, crash test). This information is immediately added up into daily totals: no IP address, no identifier and no individual path is kept. | Knowing which pages and content interest visitors, to improve the website. izak’s legitimate interest. If your browser sends the Global Privacy Control or Do Not Track signal, nothing is counted. |
| Creating and using your izak space | Name, email address, company if you provide it; with Google, the name and email address of your Google account (never your password); sign-in codes and session; the profile details you add (job title, phone, website, city and country, activity, logo) | Signing you in without a password and keeping your conversation, brief, analysis and profile. Steps at your request before a contract. |
| Conversation with the izak team in Messages | Your messages and the izak team's, their dates and whether they were read; without an account, your first name and email address; the emails that tell each side about a new message | Talking with you personally about your project and telling you about our replies. You can write to the team without an account: your first name and email address are enough. That address is not checked; we only use it to reply to you. A cookie keeps this conversation in your browser; if you later create your izak space in the same browser, the conversation moves to it. When izak has linked a Telegram account, your messages reach it at once and the team can reply to you from Telegram. Steps at your request before a contract, or performance of a contract; otherwise, our legitimate interest in communicating with the relevant organisation's representative. |
| Booking the first call | The date and time you choose, your time zone, your name, email address and company; the call's Google Meet link | Arranging the call you book: you get a confirmation by email and izak is told; when izak's Google Calendar is connected, the call is added to it and Google sends you the invitation with the Meet link. Steps at your request before a contract. |
| Following up a business relationship arising from an enquiry | Business contact information, proposals, approvals and relevant correspondence | Performance of a contract with the individual concerned, or our legitimate interest in managing a relationship with a client organisation's contacts. Processing specific to delivery and billing is explained in the relevant contractual documentation. |
| Website operation and security | IP address, time, browser, necessary requests and error events | Our legitimate interest in availability, limiting abuse (number of messages and codes per minute), troubleshooting and system security. |
| Handling rights requests | Correspondence necessary to handle a request | Meeting applicable obligations and handling requests. |
For processing governed by Egyptian law, the ground is determined under that law for the relevant purpose, such as consent, contractual necessity, a legal obligation, the exercise or defence of a right, or legitimate interests where its conditions are met. GDPR grounds are not automatically carried over.
Do not send passwords, identification documents, banking details or sensitive information in the conversation. The assistant will never ask for them.
4. Marketing, automation and artificial intelligence
You are talking with an artificial intelligence assistant, as it tells you in its first message. It relies on the Claude model, provided by Anthropic, which processes your messages, what you enter in New Project and the information read on the analysed website to write its replies, the analysis of your website and the summary of your project. Anthropic acts as a processor and does not reuse this information to train its models. The assistant's replies may contain mistakes; the izak team reads every project and replies to you in person. In Messages, the "izak team" conversation is held by people from the izak team: the AI does not read it.
We do not make solely automated decisions producing legal or similarly significant effects concerning you.
Your email address is used to sign you in, to reply to you and to tell you about a message from the izak team. A conversation, a quotation request or creating your space does not subscribe you to marketing: we do not send any. We do not sell personal information or share it for cross-context behavioural advertising.
Any new function changing these practices will be explained before activation, with separate consent where required.
5. Recipients
Access is limited to izak's authorised personnel and the providers needed for the stated purposes. Providers acting on our instructions are subject to appropriate contractual restrictions concerning confidentiality, security and permitted use.
| Service | Entity and role | Information accessed | Storage and access countries | Transfer safeguards |
|---|---|---|---|---|
| Website hosting, database, security, the crash test’s browser, sign-in, booking and message emails | Cloudflare, Inc., processor | The information described in section 3 | Database in Western Europe; Cloudflare's global network for delivery and security | European Commission standard contractual clauses, under Cloudflare's data processing agreement |
| AI assistant, website analysis and project summary | Anthropic, PBC, processor | Messages of the conversation with the assistant, what you enter in New Project, brief, information read on the analysed website | United States | European Commission standard contractual clauses, under Anthropic's data processing agreement |
| Sign-in with Google, if you choose it | Google LLC, for your Google account | Your name and email address, sent to izak at your request | Under Google's terms | Under Google's terms |
| Appointment calendar and video call | Google LLC, processor (Google Calendar and Google Meet of the Google account linked by izak) | The call's date and time, your name, email address and company | Under Google's terms | Under Google's terms |
| The izak team's notifications and replies through Telegram, when izak has linked it | Telegram Messenger Inc., the messaging service izak uses, under its own terms (EEA representative: European Data Protection Office, Brussels) | Your messages to the izak team and its replies, your name, company and email address; for a crash test report request, your email address, the analysed website, its score and your choice to be contacted | Under Telegram's terms | Under Telegram's terms |
Professional advisers, public authorities or courts receive information only when necessary and supported by an applicable legal ground. A request from a foreign authority does not remove the requirements governing disclosure or international transfers.
External websites have their own notices. This does not remove our responsibilities for transfers we arrange or services we embed ourselves.
6. International processing
The operator processes and accesses information from the United States and Egypt. The table above identifies the providers' storage and access countries.
Where an operation is a transfer governed by GDPR Chapter V, the applicable mechanism is identified for the recipient: for Cloudflare and Anthropic, the European Commission standard contractual clauses under their data processing agreements. The formation of IZAK LLC in the United States does not give it any participation in the EU–U.S. Data Privacy Framework. Egypt does not have a European Commission adequacy decision as of the date of this policy.
Transfers governed by Egyptian law must also meet that law's own requirements, including required licences or permits, safeguards and consent where applicable. General acceptance of this policy does not replace those requirements.
To request information or an available copy of the relevant safeguards, contact hello@izak.studio.
7. Retention
Longer retention is limited to an identified legal duty or documented dispute; only necessary information is then retained, with restricted access.
| Information | Retention |
|---|---|
| Project, conversation with the assistant, brief and website analysis | 12 months after the last exchange. Documents of an engaged project (proposal, contract, invoices) follow the contractual documentation. |
| Crash test result and screenshots of the analysed website | 6 hours in Cloudflare’s cache, to answer a new request for the same website faster; it contains no information about you. A count of analyses per day, with no personal data, is used to limit their cost. |
| Crash test report request (email address, website, score, choice to be contacted) | 12 months after the request. |
| Audience statistics (daily totals, with no personal data) | 25 months. |
| izak space (name, email address, company) | Until you ask for deletion, and at most 12 months after your last sign-in. |
| Conversation with the izak team (without an account: with your first name and email address) | 12 months after the last message, and at the latest with your izak space. Messages received in Telegram stay in the Telegram account linked by izak, where they can be deleted. |
| Calls booked | Up to 12 months after the call, and at the latest with your izak space. The event stays in the Google Calendar linked by izak, where it can be deleted. |
| Sign-in codes | Valid for 10 minutes, deleted within 24 hours. |
| Sign-in session | 30 days, or until you sign out. |
| Technical logs | A maximum of 90 days, except limited records required for an incident or identified obligation. |
| Database backups | 30 days, on a rolling basis. Deleted information is not reused from backups; required deletions are reapplied after restoration. |
| Rights-request records | 12 months after the reply, only to demonstrate how the request was handled. |
8. Security
We apply measures proportionate to risk: encrypted communications (HTTPS), a secure session cookie, sign-in codes and sessions stored only as hashes, administrator access restricted to izak's authorised personnel with sign-in by code, abuse limits and restricted database access. When Telegram is linked, only the Telegram account linked by izak can reply to clients; that conversation is not end-to-end encrypted. No system is entirely secure. This does not reduce our legal obligations. Required incident notifications and protective measures follow each applicable law.
9. Children
The website presents professional services and is not directed to children. We do not knowingly solicit their information. A parent or legal representative may report a collection to hello@izak.studio so that it can be reviewed and the necessary action taken. This statement does not replace the special duties that may apply when we learn of information collected from a child.
10. Contact and rights requests
Email hello@izak.studio. Describe your request and provide the information needed to locate the relevant records, for example the email address of your space. You may identify your country or state of residence where useful to establish the applicable rules; we do not routinely require an identity document.
Where necessary, proportionate verification protects against disclosure to an unauthorised person and is not used to delay the response artificially.
An authorised agent may act as permitted by applicable law. We explain any full or partial refusal and relevant ways to challenge it. Exercising a right does not result in unlawful discrimination. Applicable exceptions, including other people's rights and certain retention duties, remain relevant.
11. Regional information
European Economic Area
Where the GDPR applies, rights include access, correction, erasure, restriction, portability, objection and withdrawal of consent, subject to their conditions. Objection based on your particular situation applies to legitimate-interest processing under the applicable conditions. Protections concerning solely automated significant decisions apply where such processing occurs.
We respond within one month. Where legally permitted, this can be extended by up to two further months, with notice and reasons during the initial month. You may complain to a competent supervisory authority, including one in your habitual residence, place of work or location of the alleged infringement. In France this includes the CNIL.
Egypt
Where Personal Data Protection Law No. 151 of 2020 and Executive Regulations No. 816 of 2025 apply, you may request access, correction or deletion, withdraw consent, and exercise the restriction or objection rights available under those rules. Requests governed by this regime receive a response within six working days of submission.
You may complain to the Personal Data Protection Center — PDPC (pdpc.gov.eg) — without waiving available judicial remedies. The Arabic notice is available through the language selector.
United States
Rights depend on your state of residence, the processing and whether izak is subject to the relevant law. Where available, they can include confirmation of processing, access and a copy, correction, deletion, portability, and opting out of sale, certain sharing, targeted advertising or particular profiling.
Since the website opened, the following categories have been collected: identifiers (name, email address, IP address), professional information (company, role, project description, brief and project summary, messages exchanged with the izak team) and information about a website you give us. They come from you, from the website you give us and, if you choose it, from Google. They serve the purposes in section 3 and are disclosed to the providers in section 5 for those purposes only.
izak does not sell personal information, share it for cross-context behavioural advertising, or offer a financial incentive in exchange for information. We do not knowingly sell or share information about individuals under 16.
Where the CCPA applies, access, correction and deletion requests generally receive a response within 45 days, extendable by up to a further 45 days where legally permitted and with notice during the initial period. A shorter applicable statutory deadline prevails.
Where an internal appeal is provided by law, you can send it to the same address with the subject "Privacy Appeal". We review the decision and provide reasons and the relevant authority's contact information within the applicable period, and at most within 30 days, subject to any shorter legal deadline. Other available complaint routes remain available.
12. Changes
The effective date and version appear above. Material changes are highlighted on the website and, where appropriate or required, through direct notice. A new purpose requiring consent is not activated merely by publishing a new policy or because you continue browsing.