Legal1. Who is responsible for your data
The data controller is Arcane Digital Limited, a company incorporated in Hong Kong, registered office: Room A03, Unit 5-11, 31/F New Trend Centre, 704 Prince Edward Road East, San Po Kong, Kowloon, Hong Kong, which operates Thirdslot (thirdslot.com). For any question about your data, write to [email protected].
This policy is written to meet the requirements of the EU and UK General Data Protection Regulation (GDPR), of the Hong Kong Personal Data (Privacy) Ordinance (PDPO) and of other privacy laws that may apply to you.
2. Data we collect
2.1 When you run a free audit
- the address of the website audited, and the business name and competitors detected or entered;
- the email address you give us to receive the report, if you choose to.
2.2 When you create an account
- your name, business email address, business name and website;
- your password, which is stored only in hashed form;
- your phone number, if you choose to give it (used only to arrange calls with your expert);
- your billing country and, if you provide them, your billing details.
2.3 When you pay
Payments are handled by our payment provider (Stripe and, where offered, PayPal). We receive only the information needed to manage your subscription: payment status, card brand and last four digits, provider references and your invoices. For bank transfers, we keep the transfer reference and the date of receipt.
2.4 When you use the Service
- the questions tracked, the answers of the measured AI models and search engines, scores, recommendations and actions;
- the public pages of your website that we analyse;
- your messages and questions to our experts, and notes of calls with them;
- if you arrived through a link shared by another customer, which link it was, so that the offer attached to it can be applied.
2.5 When you contact us
When you write to us through the contact form or by email, we keep your name, email address, the topic and website you give us, your message, and the IP address it was sent from (to limit abuse), so that we can answer you.
2.6 Technical data
Like any website, our servers record technical data (IP address, browser type, pages requested, date and time) in their logs, to keep the Service secure and working. We don't use audience-measurement or advertising tools. See our Cookie Policy.
3. Why we use it, and on what legal basis
- To run the audit and provide the Service (measurements, reports, dashboard, expert work, emails about your account): performance of our contract with you, or steps taken at your request before entering into it.
- To bill and keep accounting records: compliance with our legal obligations.
- To keep the Service secure and prevent abuse (limits on free audits, fraud on offers, misuse of accounts): our legitimate interest.
- To improve the Service using aggregated and anonymised statistics: our legitimate interest.
- To send you news about Thirdslot, if you have accepted it or are already a customer: your consent or our legitimate interest. You can unsubscribe at any time using the link in each email.
We don't make decisions about you based solely on automated processing that produce legal or similarly significant effects. Visibility scores are automated measurements of how a business appears in AI answers, not assessments of individuals.
4. Who we share it with
We never sell your data and never share it for others' marketing. We share it only with the service providers we need to run Thirdslot, acting on our instructions:
- Payments: Stripe (and PayPal, where offered), which process payments as independent controllers for their own legal obligations;
- Email delivery: Brevo (Sendinblue SAS, France), to send reports, notifications and account emails;
- Hosting: Contabo GmbH (Munich, Germany), which hosts our servers and database;
- AI model providers and gateways (such as OpenRouter and TeamoRouter, and through them OpenAI, Google, Anthropic or Perplexity): they receive the questions we test and public information about your business. We don't send them your account details;
- Web crawling: proxy services used to fetch the public pages of the website audited;
- Our experts, employees or contractors of Thirdslot bound by confidentiality, who access your account to deliver the Pilot and Autopilot plans.
We may also disclose data when required by law, by a court or by a competent authority, or in connection with a merger or acquisition of our business, in which case this policy will continue to apply.
5. International transfers
Arcane Digital Limited is established in Hong Kong, and our providers may process data in the European Union, the United States or other countries. When data from the European Economic Area, the United Kingdom or Switzerland is transferred to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses or on another safeguard recognised by law. You can ask us for a copy of these safeguards.
6. How long we keep it
- Account and Service data: for as long as your account is open, then 3 years after your last activity, unless you ask us to delete it sooner;
- Invoices and accounting records: 7 years, as required by Hong Kong law;
- Free audit reports and the email given for them: 24 months, unless you create an account;
- Messages sent through the contact form: 24 months after our last exchange;
- Server logs: 12 months;
- The record of the link you arrived through: 180 days in your browser, and up to 12 months on our side.
7. Security
We use encrypted connections (HTTPS), hashed passwords, access restricted to the people who need it, and providers chosen for their security practices. No system is completely secure; if a breach affecting your data occurs, we will notify you and the competent authorities where the law requires it.
8. Your rights
Depending on the law that applies to you, you have the right to access your data, to correct it, to have it deleted, to restrict or object to its processing, to receive it in a portable format and to withdraw your consent at any time. Under the PDPO, you have the right to request access to and correction of your data.
To exercise these rights, write to [email protected] from the email address linked to your account. We answer within 30 days. We may ask you to confirm your identity.
If you believe your rights have not been respected, you may lodge a complaint with your data protection authority (in the EU, the authority of your country of residence; in the United Kingdom, the ICO; in Hong Kong, the Privacy Commissioner for Personal Data).
If you are a resident of California or another US state with a privacy law: we don't sell or share your personal information for cross-context behavioural advertising, and you may exercise the rights above in the same way.
9. Children
The Service is intended for businesses and is not directed to people under 18. We don't knowingly collect data from children.
10. Data you entrust to us as a customer
If you are an agency using Thirdslot for your clients, or if your website contains personal data that we analyse, we process that data on your behalf as a processor, only to provide the Service. A data processing agreement is available on request at [email protected].
11. Changes
We may update this policy. The date at the top of the page shows the latest version; for material changes, we will inform account holders by email.
12. Contact
Arcane Digital Limited · Room A03, Unit 5-11, 31/F New Trend Centre, 704 Prince Edward Road East, San Po Kong, Kowloon, Hong Kong
Email: [email protected]