Privacy Notice

1. Data controller

Wentzel Investments LLC, a Florida limited liability company, operates this site.

The data controller for personal data collected through https://wentzel.ai is:

2. What data we collect

We collect the following categories of personal data:

• Contact form data — name, email address, and the message you send us. Used solely to respond to your inquiry.
• Waitlist sign-up — email address. Used to notify you when a product launches.
• Cloudflare Web Analytics — when a site id is configured for this deploy, this site loads a cookieless analytics script (from static.cloudflareinsights.com) only after analytics consent is effective. In the EEA, the UK, Switzerland, and when your region is unknown, that is after you choose Accept. Elsewhere it loads unless you reject analytics or your browser sends Global Privacy Control. It records the page you viewed, the referring page, your browser and device type, your approximate country, and page-load timings, and we see only aggregate counts. It sets no cookies and does not use your browser's local storage.
• Web Vitals — anonymous page-load and responsiveness timings sent to our own /api/vitals endpoint. Whether this is collected by default or only after you opt in depends on your region — see “Cookies” below.
• We use no advertising or marketing cookies, no cross-site tracking, and no fingerprinting.
• Cookie consent record — your consent choice and timestamp, stored locally in your browser (under wentzel.consent.v1). We do not keep a server-side copy.
• Staff accounts and AI assistant use — applies only to people with a @wentzel.ai account. Signing in uses Google Workspace single sign-on, and the session is stored in our database. The site's AI chat is available only to signed-in staff; visitors who are not signed in cannot send messages to it. A staff member's chat messages and account email are sent through the Cloudflare AI Gateway to a third-party AI model provider to generate replies.

3. Legal basis for processing

• Legitimate interest (Art. 6(1)(f)) — responding to contact form inquiries and maintaining security logs.
• Legitimate interest (Art. 6(1)(f)) — cookieless Cloudflare Web Analytics outside the EEA, the UK, and Switzerland, used to understand how the site is used and how fast it loads, unless you reject analytics or send Global Privacy Control.
• Consent (Art. 6(1)(a)) — Web Vitals reporting and, when a site id is configured, Cloudflare Web Analytics for visitors in the EEA, the UK, and Switzerland. Neither runs until you click “Accept”. You may withdraw consent at any time via the “Cookie settings” link in the footer. The same opt-in default applies when we cannot determine your region.
• Contractual necessity (Art. 6(1)(b)) — waitlist management (you asked to be notified).

4. Data retention

We do not run automated deletion jobs on this site today, so retention is handled on request. Contact-form messages are delivered by email to our team and are not stored in a database by this site; they stay in our mailboxes until we delete them, and we will delete yours on request. Waitlist sign-ups are stored in our database until you ask us to remove them or we manually clear the list after the product launches and we notify you. Your consent choice lives only in your browser, so you control it by clearing site data. Data subject request records are kept for as long as needed to show we answered your request. Cloudflare Web Analytics gives us aggregate counts only; we do not keep per-visitor analytics records.

5. Third-party processors

• Cloudflare Email — email delivery (form confirmations and replies).
• Cloudflare — CDN, DDoS protection, edge compute, and our database. Cloudflare logs are retained per Cloudflare's own privacy policy.
• Cloudflare Turnstile — bot check on the contact form. It may read technical signals from your browser to tell people from bots.
• Cloudflare AI Gateway and a third-party AI model provider — used only for the staff-only AI assistant described above, never for visitors who are not signed in.
• Functional Software, Inc. (Sentry), US — error and performance monitoring.
• Google Workspace — single sign-on for staff accounts only.
• Cloudflare Web Analytics — the cookieless page-view script described above. It loads only when a site id is configured and analytics consent is effective. No other analytics provider runs on this site. Web Vitals performance data is sent to our own first-party endpoint, not to a third party.

6. Cookies & region-aware consent

We use strictly necessary first-party storage to remember your consent choice. The only optional category is analytics, which covers anonymous Web Vitals reporting and, when a site id is configured, Cloudflare Web Analytics. We set no marketing, advertising, or cross-site tracking cookies.

How we ask for analytics depends on where you are, detected from your network region (we do not store your IP for this):

• EEA, UK & Switzerland (opt-in) — a banner blocks and analytics (Web Vitals, and Cloudflare Web Analytics when a site id is configured) stays off until you choose “Accept”. The same applies when your region cannot be determined.
• Everywhere else (opt-out) — that analytics may run by default under a notice-at-collection model; you can switch it off at any time via the “Cookie settings” link in the footer.
• Global Privacy Control — if your browser sends a GPC signal we treat it as an opt-out automatically, in every region, unless you previously chose “Accept”, in which case your saved choice applies.

You can review or change your choice at any time from the “Cookie settings” link in the footer, which re-opens the preference banner. If you live somewhere that requires consent before analytics, such as a jurisdiction not listed above, you can switch analytics off there at any time, and we will honour your choice.

7. Your rights

If you are in the EEA, UK, or other jurisdiction with equivalent rights, you may exercise any of the following:

• Right of access (Art. 15) — request a copy of the data we hold about you.
• Right to rectification (Art. 16) — ask us to correct inaccurate data.
• Right to erasure (Art. 17) — ask us to delete your data.
• Right to data portability (Art. 20) — receive your data in a machine-readable format.
• Right to object (Art. 21) — object to processing based on legitimate interest.

Submit a request using our Data Subject Request form. We will respond within 30 days (GDPR Art. 12).

8. Contact & complaints

To exercise your rights or raise a privacy concern, contact us at privacy@wentzel.ai. If you are unsatisfied with our response you have the right to lodge a complaint with your local supervisory authority (e.g. the Information Commissioner's Office in the UK, or your national DPA in the EEA).