Privacy notice

Who we are

This site and its live demo are run by FourWinds Digital, a trading name of Oscar Cobbe, in Ireland, who decides what is kept and why and is the controller of that data under the GDPR.

Write to support@fourwinds.ie about anything on this page.

These pages

The public pages set no cookies, and load nothing from any other address: no analytics, no advertising, and no fonts or scripts from elsewhere.

The live demo

When you press "Open my demo", a sample business is made for you, and a cookie keeps you signed in to it for two hours. The cookie does nothing else, and the demo cannot work without it.

To limit how many demos one address can open in an hour, your network address is turned into a keyed hash, made with a key that never leaves our server, and only the hash is kept, with your demo. A hash like this still counts as personal data, and it is deleted with the demo.

When the two hours end, the demo is deleted within ten minutes: the business, everything typed into it, your session and the hash.

Nothing you do in the demo reaches a real system or a real person. Its messages wait in its outbox and none is sent. Ask, which uses Claude from Anthropic, is switched off in it.

The session and the hash are kept to give you the demo you asked for, and in our legitimate interest in keeping the demos open to everyone. Use made-up names and details in the demo.

The sample businesses' websites

Each sample business in the demo has a website of its own, at an address that starts with /site/. Those websites set no cookie of their own. When you are signed in to a demo, an A/B test counts you by your demo's session and shows you the same version each time; signed out, there is no test.

Google user data, when a business connects Google

A business using Eurus can connect its Google Workspace or one of its Google calendars, and its people can sign in with Google. Each asks Google for read-only access, and only to this. Google Workspace (the admin.directory.user.readonly scope): each account's email address and name, whether it is switched on or suspended, its last sign-in, whether 2-Step Verification is on, and whether it is a super or delegated administrator. Google Calendar (the calendar.events.readonly scope), on the one calendar the business chooses: each appointment's start and end, the invited customer's name and email, and whether it was cancelled; titles, descriptions and locations are left unread. Sign in with Google: the person's email address, that Google has verified it, and their Workspace domain.

This data is used only to run Eurus for that business: its compliance checks (such as accounts without 2-Step Verification, people who have left and can still sign in, and how many administrators there are), its workflows and its reports, for the business's own people. It is used for nothing else: no advertising, no profiling, no sale, and no training of AI models. Eurus's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

It is shared only with the companies that host Eurus for us, under contract and only to run it: Vercel, whose servers run Eurus in its Dublin region, and Supabase, whose database keeps it in the EU (Ireland). If a business switches on Ask, the question a person types and the records needed to answer it go to Anthropic to draft the answer, and Anthropic does not train its models on them. People at FourWinds look at a business's data only to provide and support Eurus for it, as its contract with FourWinds sets out, or where the law requires it. Each time, FourWinds' owner opens the business read-only, and the visit, its reason and every page opened go on the business's own audit trail.

The access Google grants is stored sealed: encrypted with a key kept outside the database. Data travels encrypted. The database itself holds each business's records apart from every other business's. FourWinds' own staff sign in with a second step. The nightly backups are sealed too.

A business can disconnect Google in Eurus at any time: the access is revoked at Google, the stored credentials are deleted, and if it chooses "Also erase what was copied", what was read from Google is erased as well, apart from what the business's own records in Eurus still point to. Anyone can also remove Eurus from their Google account's settings at any time. Otherwise what was read is kept while the business uses Eurus. When it leaves, it can export its data during the 30 days after the end; after those 30 days it is deleted from the live database, and copies in the nightly backups expire on their own schedule: the last 35 nights, and the first night of each month for a year.

When you book the audit

If you book the audit with the form on the audit's page, we keep what you type into it: your name, your email, your organisation, a week that suits and what the business does. We use it only to arrange the audit and to reply to you.

If you choose to say how you heard about Eurus, we keep that answer with the booking.

We also keep the campaign tags in the link you followed to the page (such as utm_source), the page's path, and the name of the website that linked to it, if it was another site. The form reads these as it is sent; it sets no cookies and stores nothing in your browser.

Our legal basis is our legitimate interest in answering a request for the audit (GDPR Article 6(1)(f)). You can object to that at any time, and we stop and delete it.

It is filed with FourWinds' other enquiries in our database in Ireland, hosted by Supabase. A copy is emailed to you, and a note to FourWinds, through Resend; the note arrives in FourWinds' mailbox, hosted by Google Workspace.

We keep it for six months from our last meaningful contact with you, unless it becomes part of a client record. Ask, and it is deleted sooner.

To stop the form being flooded, a one-way hash of your network address and one of your email address are kept for about a day, to count the bookings from each.

When you use Tell FourWinds

If you use Eurus and send a message with Tell FourWinds, we keep it with your name, your email, your business, your role and the page it is about. We use it only to answer you and to improve Eurus.

Our legal basis is our legitimate interest in answering you and improving Eurus (GDPR Article 6(1)(f)). You can object to that at any time, and we stop and delete it.

It is filed, emailed and kept as a booking is, as described above.

To stop the form being flooded, a one-way hash of your account is kept for about a day, to count the messages from each.

When you write to us

If you write to us, we keep your message and our reply to answer you, and, if you become a client, as part of our work together. Ask at any time and they are deleted, unless the law requires us to keep them.

Who handles it for us

Vercel hosts the site and the demo, and the code that serves them runs in its Dublin region. Vercel keeps a technical log of requests, such as the address a request came from, the page and the time, for a limited period, to deliver the pages and keep the service secure.

Supabase hosts the database that holds the demos and FourWinds' enquiries, in Ireland (eu-west-1).

Resend sends the booking emails, from its eu-west-1 region in Ireland.

Google Workspace hosts FourWinds' own email, where the note of a booking and anything you write to us arrive.

Vercel, Resend and Google are US companies, and data reaching them can be transferred to the US. Each takes part in the EU-US Data Privacy Framework, the basis for those transfers; Vercel and Google also offer the European Commission's standard contractual clauses.

Your rights

You can ask for a copy of what we hold about you, and have it corrected or deleted. You can object to how it is used, at any time where we rely on our legitimate interest, or ask for its use to be restricted, and, where it applies, have it given to you in a form you can take elsewhere. Write to support@fourwinds.ie, and you will have an answer within one month.

You can also complain to the Data Protection Commission, Ireland's regulator for data protection.

The Data Protection Commission

Changes

When this notice changes, the date at the top changes with it.