Legal

Privacy Policy

Effective 2026-10-24

This document is provided for informational purposes only and does not constitute legal advice. You should consult a qualified attorney to confirm it meets your specific legal and regulatory requirements.

Effective date: 24 October 2026

Introduction & Who We Are

This Privacy Policy describes how Carlos Arias ("we," "us," or "our"), the publisher of carlosarias.com, collects, uses, and protects personal information when you visit or interact with this website.

Carlos Arias is a Marketing Engineer specializing in digital marketing for law firms.

Personal Data We Collect

When you use the contact form, we receive:

  • Name — to address you by name in our reply.
  • Email address — to respond to your inquiry.
  • Phone number — if you choose to include it in your message.
  • Message content — the text of your inquiry or request.

When you use the AI intake agent. The "Talk to the intake agent" panel on this site is an AI assistant, not a person. If you use it, we receive:

  • Your messages — everything you type into the chat, together with the agent's replies.
  • Details you choose to share — for example your name, email address, phone number, firm, role, location, and what you are looking for. The agent records these so we can follow up.
  • Conversation context — the page you opened the chat on, your browser's user-agent string, your IP address, and any rating you give the conversation.

Please do not share sensitive information in the chat, such as financial account details, government ID numbers, health information, or confidential client information.

When you browse or search the site, we collect limited usage data automatically, as described under Cookies & Analytics below.

How We Use Data

We use the information you provide through the contact form or the intake agent to respond to your inquiry, to decide how best to follow up, and to keep an accurate record of that correspondence. We use usage data to understand how the site is used, which pages lead to inquiries, and to protect the site from abuse. We do not use your data for advertising profiles.

AI intake agent. The agent's replies are generated automatically by an AI model, which draws on the content of this website. At the end of a conversation the agent may write a short summary and note how well your inquiry matches the services we offer, to help us prioritize replies. A person reviews every inquiry, and no decision with legal or similarly significant effects is made automatically.

EU / UK legal bases. Where the General Data Protection Regulation (GDPR) or UK GDPR applies, we process your data under the legal basis of legitimate interests — specifically, responding to an inquiry you initiated, and operating, measuring, and securing this website — and, where your message relates to a specific service request, on the basis of steps taken prior to entering a contract. You may object to processing based on legitimate interests at any time by contacting us.

Sharing & Processors

We do not sell, rent, or trade your personal information. Your data is not shared with data brokers or used for cross-context behavioral advertising.

We share data only with service providers that process it on our behalf to operate this website:

  • Hosting and infrastructure providers — host the site, its database, and its server logs.
  • Google LLC — Gmail delivers contact-form and intake-agent inquiries to our inbox; Google Analytics measures site usage (see Cookies & Analytics).
  • Anthropic, PBC — provides the AI model (Claude) that generates the intake agent's replies. Your chat messages and the conversation so far are sent to Anthropic to produce each reply.
  • OpenAI — converts short search queries, which the intake agent writes from your messages, into numerical representations used to find relevant pages on this site.
  • Twilio Inc. — when text alerts are enabled, sends us a short notice of a new inquiry. Messages go only to our own phone, never to yours.

Anthropic and OpenAI process this data under their business API terms, which by default do not allow them to use it to train their models. Each provider processes data under its own terms and applicable data-protection law.

Beyond these providers, your data is not shared with any third party unless the law requires it.

International Transfers

If you are located in the European Economic Area, the United Kingdom, or another jurisdiction that restricts international transfers of personal data, your data may be processed on servers located outside your home jurisdiction, including in the United States, where our service providers such as Google, Anthropic, and OpenAI operate. Where this occurs, we rely on appropriate safeguards — such as standard contractual clauses approved by the relevant supervisory authority — to ensure your data receives a level of protection consistent with applicable law.

Data Retention

We retain contact-form submissions for as long as is reasonably necessary to respond to your inquiry and maintain an accurate record of our correspondence. Once that purpose is fulfilled, we delete or anonymize the data.

Intake-agent conversations are deleted automatically 12 months after the last message; conversations in which no message was sent are deleted after one day. If a conversation leads to an inquiry, the inquiry record is kept in our contact inbox like any other contact submission. Our AI providers may retain the data they process for a limited period under their own terms, typically up to 30 days, for abuse and misuse monitoring.

We keep our own visit and search records to compare traffic over time and delete them when they are no longer needed for that purpose. Google Analytics data is retained according to our Google Analytics settings.

Your Rights

EU / UK residents

If the GDPR or UK GDPR applies to you, you have the right to:

  • Access the personal data we hold about you.
  • Rectify inaccurate or incomplete data.
  • Erase your data where it is no longer necessary for the purpose for which it was collected.
  • Restrict processing while a dispute is being resolved.
  • Object to processing based on legitimate interests.
  • Data portability — receive your data in a structured, machine-readable format.
  • Lodge a complaint with your national supervisory authority if you believe your rights have been infringed.

California residents (CCPA / CPRA)

California residents have the right to:

  • Know what personal information we collect, use, and disclose.
  • Delete personal information we hold about you, subject to limited legal exceptions.
  • Correct inaccurate personal information.
  • Opt out of sale or sharing — we do not sell personal information and do not share it for cross-context behavioral advertising.
  • Non-discrimination — we will not treat you differently because you exercised a privacy right.

Canadian residents (PIPEDA)

You have the right to access personal information we hold about you, to know how it is used, and to challenge its accuracy. To make a request, contact us directly.

To exercise any of these rights, reach us using the details in the Contact Information section below. We will respond within the timeframe required by applicable law.

Cookies & Analytics

Google Analytics. We use Google Analytics 4 to understand how visitors use the site — for example, which pages are viewed, how visitors arrived, and their approximate location and device type. Google Analytics sets cookies in your browser to do this. You can block these cookies in your browser settings or install Google's opt-out browser add-on at https://tools.google.com/dlpage/gaoptout.

Our own visit log. When a page loads, the site records the page viewed, the referring site and any campaign tags in the link, your browser's user-agent string, your IP address, and an approximate location (city, region, and country) derived from that IP address. A random session identifier is kept in your browser's local storage, and expires after 30 minutes of inactivity, so that consecutive page views can be grouped into one visit. Searches typed into the site's search box are recorded in the same way, with the search terms.

Intake agent. If you open the intake agent, a random conversation token is stored in your browser's local storage so that you can continue the conversation on other pages. It contains no personal information, and clearing this site's data in your browser removes it.

We do not use advertising cookies.

Security Measures

We take reasonable technical and organizational precautions to protect your personal data against unauthorized access, loss, or disclosure. Data transmitted between your browser and this site is protected in transit using industry-standard TLS encryption. Access to stored contact submissions and intake-agent conversations is limited to authorized individuals on a need-to-know basis.

Children's Privacy

This website is not directed at children under the age of 13, or under 16 where required by applicable law. We do not knowingly collect personal information from children. If you believe a child has submitted personal information through this site, please contact us and we will delete it promptly.

Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the effective date at the top of this page. We encourage you to review this policy periodically. Continued use of the site following an update constitutes your acceptance of the revised policy.

Contact Information

For privacy inquiries, to exercise your rights, or to ask any question about this policy:

Email: hi@carlosarias.com Website: https://carlosarias.com

Let's talk

Let's build something.

Tell me what you're trying to solve. Your message comes straight to me, no sales team, no runaround, and I'll reply personally, usually within a day.