Privacy Notice
Last updated: 29 June 2026
This notice explains how Ethical Certified AI ("we", "us", "our") collects and uses personal data when you use our website, our Mercutio AI exposure checker, and our certification services. We are the data controller.
Controller: Ethical Certified AI (Nik Bernaz)
217-235 Bridgeland Dr S, Winnipeg, Manitoba, R3Y 0T7, Canada
Contact: [email protected]
1. What we collect
When you use Mercutio or contact us, we may collect:
- The text you enter into Mercutio describing your activity. Do not enter more personal data than you need to.
- Your IP address and basic technical log data, recorded with each query for security and abuse prevention.
- Enquiry details you submit through our contact form or by email, such as your name, email address, and message.
We do not knowingly collect special category or sensitive data, and Mercutio is not intended for that. Please keep such data out of your query text.
2. How your query is processed
Your Mercutio query is analysed on our own infrastructure. The AI models run locally on hardware we control. Your query is not sent to any third-party AI provider such as OpenAI, Anthropic, or Google. Stored query logs and IP data sit in a database hosted in Finland (European Union). We retain these query logs and may review them to monitor for abuse and to understand how the tool is used so we can improve it, as set out in sections 3 and 7.
3. Why we use it, and our lawful basis
| Purpose | Lawful basis (GDPR) |
|---|---|
| Running Mercutio, returning your result, securing the service, preventing abuse | Legitimate interests |
| Analysing queries to understand how Mercutio is used, and to improve and develop our services | Legitimate interests |
| Responding to an enquiry you send us | Your consent, and steps taken at your request |
| Delivering certification services you engage us for | Performance of a contract |
| Meeting legal, tax, and accounting obligations | Legal obligation |
4. We do not sell your data
We do not sell, rent, or trade your personal data. We do not share it with advertisers. We do not use it to build advertising profiles.
5. Who we share it with
We use a small number of service providers who process data on our behalf under contract:
- Hetzner Online GmbH, with data stored in its Finland data centre (EU), for hosting and storage.
- Cloudflare, Inc. for content delivery, DNS, and security.
- Proton Mail (Proton AG, Switzerland), for handling email correspondence.
6. International transfers
Your data is primarily stored within the European Union (Finland) and Switzerland. Some providers, such as Cloudflare, may process data outside your country, including in the United States. Where that happens we rely on appropriate safeguards such as adequacy decisions or standard contractual clauses.
7. How long we keep it
- Mercutio query logs and IP data: up to 12 months, then deleted or anonymised.
- Enquiry correspondence: for as long as your enquiry is active and a reasonable follow-up period after.
- Records of certification clients: for the duration of the relationship and as long as needed to meet legal and accounting obligations.
8. Your rights
Your rights depend on where you are. Wherever you are, you can reach us at [email protected] to exercise them.
European Union and United Kingdom (GDPR / UK GDPR)
You have the right to access, correct, erase, restrict, and port your data, to object to processing, and to withdraw consent at any time. You may lodge a complaint with your local supervisory authority (in the UK, the Information Commissioner's Office).
Canada (PIPEDA, and Quebec Law 25 where applicable)
You may access and correct your personal information and withdraw consent, subject to legal limits. You may complain to the Office of the Privacy Commissioner of Canada, or to the Commission d'acces a l'information du Quebec if you are in Quebec.
United States (California, CCPA / CPRA)
California residents may request to know, delete, and correct their personal information, and to opt out of any "sale" or "sharing". We do not sell or share your data as those terms are defined. You will not be treated differently for exercising these rights.
United Arab Emirates (Federal Decree-Law No. 45 of 2021, PDPL)
You may access, rectify, erase, restrict, and port your data, object to processing, and withdraw consent. You may complain to the UAE Data Office.
9. Cookies and analytics
We use Plausible Analytics, a privacy-friendly, cookie-free analytics tool that we self-host on our own infrastructure. It measures aggregate traffic only. It sets no cookies, stores no IP addresses, uses no cross-site or persistent identifiers, and does not track you across other websites. No personal data is collected through analytics, and no analytics data is shared with third parties.
Our security provider, Cloudflare, may set strictly necessary cookies to protect the service.
10. Children
Our services are intended for businesses and professionals. They are not directed at children, and we do not knowingly collect data from them.
11. Changes
We may update this notice. The date at the top shows the latest version. Material changes will be made clear on this page.
12. Contact and complaints
For any privacy question, or to exercise your rights, contact [email protected].