Last updated 2026-08-23
This notice explains what personal data I, Gabriel Homoky (Cited, a research practice of Automating, Hungary), process and why. It is written for the people I write to and for the companies I work with, and it follows the GDPR, the US CAN-SPAM Act and the UK PECR.
I contact people in marketing roles at companies whose category I can audit. I use only published business contact details: your name and role from your company's website or press page, and a business email address published there. I record where and when I found each detail. The message is commercial and says so, and every message carries a working opt-out. Reply "no" or "unsubscribe" and your address goes on a suppression list that every service I run respects; you will not hear from me again.
Legal basis: legitimate interest in offering a relevant business service to a business contact, balanced by the limited data used, the single follow-up and the immediate opt-out.
A sample audit uses public information about a company (its name, website, category and competitors) and the public answers of AI assistants. It contains no personal data beyond, at most, the name of the person I wrote to. Samples are labeled as such and removed within one business day on request.
I process your contact details, the inputs you give me (category, markets, competitors) and payment records to deliver the Service and to issue invoices, which Hungarian law requires me to keep for eight years. Recorded assistant answers are kept as the baseline for monitoring and deleted on request.
The site sets no cookies and runs no analytics scripts. Sample pages send a small, anonymous event (page opened, report loaded, scrolled to the end) to count whether a sample was seen; it contains no personal data. Fonts are loaded from Google Fonts, which receives your IP address to serve the font files. Hosting is on Cloudflare, which processes connection data to deliver the site.
You can ask what I hold about you, have it corrected or deleted, object to processing, or ask for a copy. Write to gabriel@automating.space; I answer within a business day. You can also complain to a supervisory authority: in the UK the Information Commissioner's Office (ICO, ico.org.uk), in Hungary the NAIH, or the data protection authority where you live.
If you are in the US, the CAN-SPAM Act gives you the right to stop commercial email from me: reply "no" or "unsubscribe" and the opt-out is applied within ten business days, in practice the same day. If you are in the UK, the same opt-out applies under PECR, and as a corporate subscriber you can object at any time.
Outreach contact data: deleted 12 months after the last contact, or immediately on opt-out (the suppression list keeps only the address). Client data: for the duration of the engagement plus the statutory invoice period.