Legal

Privacy Policy

Last updated: June 16, 2026

1. Introduction

Positronics OÜ (registry code 17494897), with registered office at Narva mnt 5, 10117 Tallinn, Estonia ("we," "us," or "our") operates the Positron Flux website at positronflux.com and the Positron Flux software-as-a-service platform (collectively, the "Service"). This Privacy Policy explains how we collect, use, share, and protect your personal information when you interact with our Service.

We are committed to protecting your privacy and processing your data in accordance with the General Data Protection Regulation (GDPR), the UK GDPR, and other applicable data protection laws.

2. Information We Collect

Information you provide directly

  • Early Access Program application: When you join the Early Access Program, we collect your work email via our form provider (Formspree). If you complete the optional "tell us more" form, we may also collect role, company size, tools you use, and a short description of your biggest delivery challenge.
  • AI Adoption Scorecard: When you take the scorecard, we collect your name, email address, and company, the optional role, team size, and industry you select, your answers to the questionnaire, and whether you opted in to receive marketing emails. We use this to generate and email your results and, where you opt in, to send you related emails.
  • Account information: When the Platform becomes available, you may provide your name, email address, organisation name, and other profile details during registration.
  • Contact form: When you use our contact form, we collect your name, surname, company, company email, and message via Formspree so we can respond to your enquiry.
  • Communications: If you contact us by other means, we retain the content of your messages along with your contact details.

Information collected automatically

  • Usage data: We may collect information about how you use the Service, including pages visited, features used, and interaction patterns.
  • Device and browser information: IP address, browser type and version, operating system, referring URL, and language preferences.
  • Cookies and local storage: We use local storage for theme preferences and cookie consent. See our Cookie Policy for details.

Information from third-party integrations (Platform)

When you connect third-party tools (e.g. GitHub, GitLab, Jira, Azure DevOps) to the Platform, we access and process data from those tools as necessary to provide delivery metrics and insights. This may include commit metadata, pull/merge request data, issue data, and deployment records. We do not access source code content unless explicitly required for a feature you enable.

3. How We Use Information

We use the information we collect to:

  • Provide, operate, and maintain the Service.
  • Process your Early Access Program application and communicate with you about the Service.
  • Generate and email your AI Adoption Scorecard results.
  • Send you marketing emails about Positron Flux where you have opted in.
  • Create and manage your account on the Platform.
  • Generate delivery performance metrics and insights.
  • Respond to your enquiries and provide customer support.
  • Send you important notices, such as changes to our Terms or this Privacy Policy.
  • Analyse usage patterns to improve and develop the Service.
  • Detect, prevent, and address technical issues and security threats.
  • Comply with legal obligations.

4. Legal Basis for Processing (GDPR Article 6)

We process your personal data on the following legal bases:

  • Consent (Art. 6(1)(a)): When you submit the Early Access form, take the AI Adoption Scorecard, tick the marketing opt-in, or accept cookies, you consent to the processing described at the point of collection. Marketing emails are sent only where you have given this consent, and you can withdraw it at any time.
  • Contract (Art. 6(1)(b)): Processing necessary to provide the Service under ourTerms of Service.
  • Legitimate interests (Art. 6(1)(f)): Improving the Service, ensuring security, and understanding usage patterns, where these interests are not overridden by your data protection rights.
  • Legal obligation (Art. 6(1)(c)): Where we need to process data to comply with applicable law.

5. Third Parties

We may share your information with the following categories of third parties:

  • Formspree: Our form provider processes data you submit when you join the Early Access Program, complete the "tell us more" form, or use the contact form (name, surname, company, company email, and message). Formspree acts as a data processor on our behalf. SeeFormspree's Privacy Policy.
  • Hosting and infrastructure: We use DigitalOcean to host the Service and to store submissions, including scorecard data, in a managed database. Further details are available upon request.
  • Postmark: Our transactional email provider processes your name and email address to deliver your scorecard results and any marketing emails you have opted in to. Postmark acts as a data processor on our behalf.
  • Google Analytics: We use Google Analytics (GA4) to understand how the Website is used. It runs in Google Consent Mode with analytics storage denied by default, and is enabled only after you accept analytics cookies. See our Cookie Policy andGoogle's Privacy Policy.
  • Third-party integrations (Platform): When you connect external tools, data flows between those tools and the Platform as necessary to provide the Service.
  • Legal requirements: We may disclose information if required by law, regulation, or legal process, or to protect our rights, users, or the public.

6. International Transfers

Your data may be transferred to and processed in countries outside the European Economic Area (EEA) or the United Kingdom. When we transfer data internationally, we ensure appropriate safeguards are in place, such as:

  • Standard Contractual Clauses (SCCs) approved by the European Commission.
  • Adequacy decisions by the European Commission or UK government.
  • Other lawful transfer mechanisms as required by applicable law.

7. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected:

  • Early Access application data: Until you create a Platform account, withdraw from the program, or request deletion, whichever comes first.
  • Account data: For the duration of your account plus 12 months after account closure.
  • Scorecard and marketing data: We keep scorecard submissions and marketing contact details until you withdraw consent or ask us to delete them, and in any case no longer than 24 months after your most recent interaction with us.
  • Platform usage data: Aggregated and anonymised data may be retained indefinitely for analytical purposes.

8. Your Rights (GDPR Articles 15–22)

Under the GDPR, you have the following rights regarding your personal data:

  • Access (Art. 15): Request a copy of the personal data we hold about you.
  • Rectification (Art. 16): Request correction of inaccurate or incomplete data.
  • Erasure (Art. 17): Request deletion of your data ("right to be forgotten").
  • Restriction (Art. 18): Request restriction of processing in certain circumstances.
  • Portability (Art. 20): Request your data in a structured, commonly used, machine-readable format.
  • Objection (Art. 21): Object to processing based on legitimate interests or direct marketing. You can withdraw marketing consent at any time using the unsubscribe link in our marketing emails or by contacting [email protected].
  • Automated decisions (Art. 22): Not be subject to decisions based solely on automated processing with legal or significant effects.

To exercise any of these rights, contact us at [email protected]. We will respond within one month, as required by law.

You also have the right to lodge a complaint with your local data protection authority. In Estonia, this is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee).

9. Children's Privacy

The Service is not intended for children under the age of 16. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child, we will take steps to delete it promptly.

10. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include encryption in transit and at rest, access controls, and regular security reviews. However, no method of transmission over the Internet or electronic storage is completely secure, and we cannot guarantee absolute security.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above. If we make material changes, we will notify you by email or by posting a prominent notice on the Website. We encourage you to review this policy periodically.

12. Contact / Data Protection Officer

If you have questions about this Privacy Policy or our data practices, please contact us: