Conformis is an EU AI Act compliance audit service operated by Mercurial Software LTD, a company registered in the Republic of the Marshall Islands (“Conformis”, “we”, “us”). Mercurial Software LTD is the data controller for all personal data processed through this website. Day-to-day operations and EU enquiries are handled by our EU-based contact, Faraz Saadati, in Bucharest, Romania.
| Source | Data collected | Purpose |
|---|---|---|
| Exposure check widget (landing page) | Email address — optional, entered voluntarily after seeing your result | To send a written summary of your indicative EU AI Act exposure and follow up on a potential engagement |
| Intake form (/intake) | Business contact details; descriptions of AI systems deployed; organisational and operational information relevant to EU AI Act classification | To conduct the compliance gap audit you have engaged us for |
| Direct email | Name, email address, message content | To respond to your enquiry |
We do not collect data we do not need. We do not store payment card information — invoices are issued and settled outside this website.
We rely on the following legal bases under Article 6 GDPR:
| Processing activity | Legal basis |
|---|---|
| Widget email capture and sending an indicative assessment summary | Consent (Art. 6(1)(a)) — you tick a checkbox and submit your email voluntarily after seeing your result |
| Intake form — conducting the gap audit | Performance of a contract (Art. 6(1)(b)) — processing is necessary to deliver the audit service you have engaged us for |
| Responding to direct email enquiries | Legitimate interests (Art. 6(1)(f)) — responding to a business enquiry you initiated |
We use a minimal set of sub-processors. We do not sell, rent, or share your data with third parties for marketing purposes.
| Processor | Role | Location | Transfer basis |
|---|---|---|---|
| Formspree, Inc. | Form submission delivery — receives form data and forwards it to us by email | United States | Standard Contractual Clauses (SCCs). Formspree Privacy Policy |
| Cloudflare, Inc. | Website hosting and CDN — serves static files; sets no tracking cookies; no user analytics | United States (EU edge PoPs) | Standard Contractual Clauses (SCCs). Cloudflare Privacy Policy |
No analytics, advertising, or tracking services are in use on this site.
This website sets no cookies of its own. We do not use analytics tools, advertising pixels, or session-tracking scripts.
Cloudflare may set a single functional cookie (__cf_bm) for bot-detection as part of its infrastructure. This cookie does not identify you personally, is not used for advertising, and is governed solely by Cloudflare's privacy policy. No consent is required for strictly necessary infrastructure cookies under Recital 66 of the ePrivacy Directive.
Because we set no non-essential cookies, no cookie consent banner is required or displayed.
| Data category | Retention period | Rationale |
|---|---|---|
| Widget leads (email address) | 12 months from collection, or until consent is withdrawn | Sufficient to complete a sales conversation; no business need beyond this |
| Intake form submissions | 3 years from delivery of the audit report | Reasonable period to respond to any dispute about the deliverable |
| Email correspondence | 2 years from last contact | Standard business correspondence retention |
After the applicable retention period, data is deleted or permanently anonymised.
To exercise any of the rights below, email admin@conformis.app. We will respond within one calendar month.
| Right | What it means in practice |
|---|---|
| Access (Art. 15) | Confirm whether we hold your data and receive a copy |
| Rectification (Art. 16) | Have inaccurate or incomplete data corrected |
| Erasure (Art. 17) | Request deletion where data is no longer necessary or consent is withdrawn |
| Restriction (Art. 18) | Request that we restrict processing in defined circumstances |
| Portability (Art. 20) | Receive your data in a structured, machine-readable format (consent- or contract-based processing) |
| Objection (Art. 21) | Object to processing based on our legitimate interests |
| Withdraw consent (Art. 7(3)) | Withdraw at any time where consent is the legal basis, without affecting prior lawful processing |
Form submissions are routed through Formspree, Inc. (United States), constituting a transfer to a third country under Chapter V GDPR. Formspree relies on Standard Contractual Clauses adopted by the European Commission as the lawful transfer mechanism.
Cloudflare infrastructure may process metadata (server logs, IP addresses for bot-detection) at US-based systems, also under SCCs.
As the controller, Mercurial Software LTD is established in the Republic of the Marshall Islands, which is not covered by a European Commission adequacy decision. Personal data accessed by the controller in the course of operating the service is therefore subject to appropriate safeguards under Chapter V GDPR, and day-to-day processing of EU enquiries is carried out by our EU-based contact in Romania.
This website is directed exclusively at business professionals and organisations. We do not knowingly collect personal data from individuals under the age of 18. If you believe a minor has submitted data through this site, contact us and we will delete it promptly.
We may update this policy to reflect changes in processing activities or applicable law. The effective date at the top of the page will be updated accordingly. For material changes affecting individuals whose data we hold, we will take reasonable steps to notify them directly.
The version at conformis.app/privacy is always current.
For any privacy query or to exercise your rights:
You also have the right to lodge a complaint with the supervisory authority. In Romania, this is the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP):