Privacy Policy

Last updated: 31 July 2026

Short version: this policy covers the amlr.io website only. We ask before running Google Analytics — say no and no analytics cookies are ever set. No advertising, no marketing pixels, no selling of anything. If you email us, we keep your email until the conversation is over. Data controller: Pattern Consulting Ltd (Bulgaria, reg. 206825026). Contact: ops@amlr.io.

1. Who we are

This website is operated by Pattern Consulting Ltd, a company registered in Bulgaria under company registration number 206825026, trading as amlr.io ("we", "us"). We are the data controller for the personal data described here. Reach us at ops@amlr.io.

2. What this policy does and does not cover

It covers personal data we handle because you visited this website or contacted us.

It does not cover data inside the amlr.io platform. There we act as a processor for our clients: the client is the controller, the processing is governed by the data processing agreement we sign with them, and their own privacy notice applies. Clients and prospective clients receive that documentation directly.

If a business asked you for documents through amlr.io, we are not the controller of that information. Contact the firm that asked you, or write to us and we will pass your request to them.

3. Cookies and tracking

Nothing is set until you say yes. We use Google Analytics 4 to understand which pages people read and how they arrive, and we ask first. Analytics storage is set to denied before the tag runs (Google Consent Mode v2), so on a first visit no analytics cookies exist. Choose "Decline" and it stays that way; choose "Accept analytics" and GA4 sets two cookies, _ga and _ga_<id>, which identify your browser rather than you by name and expire after up to two years.

Your choice is remembered in localStorage, not in a cookie, so declining leaves your cookie jar genuinely empty. If you decline after previously accepting, we delete the _ga cookies as well.

Changing your mind. at any time. You can also block analytics with any content blocker, your browser's cookie controls, or Google's opt-out add-on. The site works exactly the same either way.

What we do not do: no advertising or marketing pixels, no remarketing, no session recording, no fingerprinting, no A/B testing tools, no social trackers. Advertising and personalisation signals are hard-denied in the tag and never granted.

4. What we actually collect

Anything you send us. If you email us or book a call, we receive your name, email address and whatever you write. Legal basis: our legitimate interest in answering you, or steps taken at your request before entering a contract.
Server logs. Our host records standard request data — IP address, timestamp, page requested, browser user-agent — to keep the site running and defend it against abuse. Legal basis: legitimate interest in security and availability.
Analytics, only if you accept. Pages viewed, referring site, approximate location derived from IP, device and browser type, collected via Google Analytics as described above. Legal basis: your consent, which you can withdraw at any time.

There are no forms on this site, and we do not build marketing profiles of visitors or try to identify them personally.

5. Third parties this site touches

Bunny Fonts (fonts.bunny.net) serves our typefaces. Your browser requests them, which discloses your IP address to that service. We use it precisely because it is a GDPR-conscious, EU-based alternative to Google Fonts and does not log requests for tracking or set cookies.
cal.eu hosts our demo booking page. That is a link — nothing loads from it until you click, and once you do, their privacy policy governs what you enter there.
Google Analytics (Google Ireland Limited, with processing that may reach Google LLC in the United States) provides the measurement described in section 3. Transfers outside the EU rely on the EU-US Data Privacy Framework, with standard contractual clauses as a fallback. IP addresses are truncated by Google before storage in GA4.
Our hosting provider serves these pages and keeps the server logs described above.

We use no data brokers and no advertising networks, and we never sell personal data.

6. Where this data is

This website and its logs are hosted in the European Union, and correspondence you send us sits in our business mailbox. Analytics is the exception: Google may process that data outside the EU, as described in section 5.

7. How long we keep it

Correspondence is kept while the conversation is live and for as long as we may need it for the relationship or to defend a legal claim, then deleted. Ask us to delete it sooner and we will, unless the law requires otherwise. Server logs are kept briefly for security and troubleshooting. Analytics data is retained on Google's default GA4 schedule (currently 14 months) and reported only in aggregate.

8. Your rights

Under the GDPR you can ask for access, rectification, erasure, restriction or portability, and you can object to processing based on legitimate interest. Write to ops@amlr.io and we will respond within one month.

You can also complain to a supervisory authority. Ours is the Bulgarian Commission for Personal Data Protection (Комисия за защита на личните данни, cpdp.bg); you may instead complain to the authority where you live or work.

9. Security

The site is served over HTTPS. Access to our mailbox and hosting is restricted to the people who need it.

10. Changes

We will update this policy as things change and note the date above.

Contact

Pattern Consulting Ltd (reg. 206825026), Bulgaria. Privacy questions and requests: ops@amlr.io