Plain terms, kept current.

RealAI is a European enterprise-AI company. We act as a data controller for the personal data described in this policy — the data you give us through this website and in the course of working with us.

For the data inside client engagements (for example, patient records in a hospital deployment), our clients remain the controllers; we process that data only under contract and, wherever the architecture allows, we design so that it never leaves the client's systems at all.

We collect what you choose to give us, and little else:

• Contact details — name, work email and company, when you write to us or book a consult.
• Context you volunteer — the services, industry and program maturity you select, and the message you write.
• Newsletter subscription — your email address, if you subscribe.
• Basic site analytics — aggregate usage of this site. We do not build advertising profiles.

We use your data to answer you, to prepare for the conversation you asked for, and to send you the newsletter you subscribed to. That is the list.

We do not sell personal data, and we do not share it with third parties for their own marketing.

Under the GDPR, we rely on:

• Consent — for the newsletter and any optional analytics; you can withdraw it at any time.
• Legitimate interest — to respond when you contact us about working together.
• Contract — to perform engagements you or your employer have agreed with us.

We keep correspondence as long as the conversation (or the engagement it led to) is live, plus the period required by applicable law. Newsletter data is kept until you unsubscribe. We delete what we no longer need.

We use a small number of service providers — hosting, email delivery, scheduling — under data-processing agreements. They process your data on our instructions only. A current list of processors is available on request.

We are a European company and keep data in the EU/EEA wherever practicable. Where a processor operates outside the EEA, we rely on adequacy decisions or standard contractual clauses.

Under the GDPR you can ask us to access, correct, delete, restrict or export the personal data we hold about you, and you can object to processing based on legitimate interest. Write to us and we will respond within the statutory period.

You also have the right to lodge a complaint with your local supervisory authority.

The discipline we sell is the discipline we practice: privacy by architecture. Access to personal data is limited to the people who need it, protected in transit and at rest, and reviewed as part of the same governance program that covers our client work.

Questions about this policy or your data: use the contact form on this site and mark your message “Privacy”. It will reach the person responsible, not a queue.