GDPR & Privacy

This notice explains how AIVENTURE S.R.L. processes personal data in connection with 3webobs.com, in accordance with Regulation (EU) 2016/679 (GDPR).

1. Who the controller is

1.1 Data protection officer

We are not required to appoint a DPO under Article 37 GDPR. Data protection enquiries are handled directly at the address above.

2. What we collect

Category	Examples	Where it comes from
Contact data	Email address, name if you provide it	You, when requesting a report or contacting us
Audit data	URLs you submit, resulting scores and reports	You, and the public web
Technical data	IP address, browser type, timestamps, request logs	Automatically, when you use the site
Transaction data	Order reference, amount, payment status	You and our payment provider
Communications	Emails and messages you send us	You

2.1 Special categories

We do not knowingly collect special categories of personal data under Article 9 GDPR, and we do not ask for them. Please do not send us sensitive personal data through this Service.

2.2 Children

The Service is not directed at children and we do not knowingly process the data of anyone under 18.

3. Why we process it, and on what legal basis

Purpose	Legal basis (Art. 6 GDPR)
Running the audit you requested and delivering the report	Performance of a contract — Art. 6(1)(b)
Sending the report and related service messages	Performance of a contract — Art. 6(1)(b)
Processing payment and keeping accounting records	Legal obligation — Art. 6(1)(c)
Keeping the Service secure, preventing abuse, rate limiting	Legitimate interest — Art. 6(1)(f)
Marketing emails, where you opted in	Consent — Art. 6(1)(a)
Improving the methodology using aggregated, non-identifying statistics	Legitimate interest — Art. 6(1)(f)

3.1 Our legitimate interests, stated plainly

3.1.1 Security

Preventing abuse of a service that fetches third-party websites is necessary both for us and for those websites.

3.1.2 Improvement

Aggregated statistics let us see which signals are commonly missing across the market, without identifying any individual.

4. A note on the URLs you submit

4.1 When a URL is not personal data

A URL is normally not personal data. A corporate homepage identifies a company, not a person.

4.2 When it may be

A personal website, a personal blog or a professional page may relate to an identifiable individual. Where that is the case, we process only information already published by the website itself, for the purpose you requested, and we retain it only as described below.

5. Retention

5.1 Retention periods

• Audit results: kept in aggregated form for statistics; individual reports retained while your relationship with us is active, then deleted.
• Email and contact data: retained until you withdraw consent or request erasure.
• Accounting records: retained for the period required by Romanian fiscal law.
• Security and abuse logs: retained for a short period, then discarded.

5.2 Deletion

When a retention period expires, data is deleted or irreversibly anonymised.

6. Who we share it with

We do not sell personal data. We share it only with processors that support the Service.

6.1 Categories of processor

6.1.1 Hosting and network

Cloudflare, Inc. — delivery, security and edge compute.

6.1.2 AI processing

Where a written synthesis is generated, report data is sent to an AI provider for that purpose alone.

6.1.3 Payment

Our payment provider processes card data directly; we never see full card numbers.

6.1.4 Email delivery

The provider used to send you your report.

6.2 Authorities

We disclose data to public authorities only where required by law.

7. International transfers

7.1 Where data may go

Some processors are established outside the European Economic Area.

7.2 Safeguards applied

Where personal data is transferred outside the EEA, the transfer is covered by an adequacy decision or by Standard Contractual Clauses adopted by the European Commission, together with supplementary measures where appropriate.

8. Your rights

8.1 The rights you hold

• Access — obtain a copy of the personal data we hold about you.
• Rectification — have inaccurate data corrected.
• Erasure — have your data deleted, where the conditions are met.
• Restriction — limit how we process your data.
• Objection — object to processing based on legitimate interest.
• Portability — receive your data in a structured, machine-readable format.
• Withdraw consent — at any time, without affecting processing already carried out.

8.2 How to exercise them

Write to contact@5thelement.ai.

8.2.1 Response time

We respond within one month, extendable by two further months for complex requests, in which case we will tell you why.

8.2.2 Identity verification

We may ask you to confirm your identity before acting, to avoid disclosing data to the wrong person.

8.3 Complaints

If you believe your data has been mishandled, you may lodge a complaint with the Romanian supervisory authority, ANSPDCP (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal), or with the supervisory authority in your country of residence.

9. Automated decision-making

9.1 What is automated

The audit score is produced automatically by applying fixed rules to observed evidence.

9.2 Why Article 22 does not apply

It evaluates a website, not a person, and it does not produce legal effects concerning any individual. It is a technical observation.

9.3 Explanation on request

You may always ask us to explain how a given score was reached.

10. Security

10.1 Measures applied

We apply technical and organisational measures appropriate to the risk:

• Encryption in transit (TLS).
• Restricted access to production systems.
• Secrets held server-side and never exposed in client-side code.
• Logging of administrative access.

10.2 Breach notification

In the event of a personal data breach likely to result in a risk to your rights, we notify the supervisory authority within 72 hours and inform affected individuals where the risk is high.

Frequently Asked Questions

Ten questions that come up most often, answered plainly.

What exactly does an AI visibility audit measure? ▾

It measures how a website presents itself to AI systems, answer engines and search crawlers. The engine fetches the page, robots.txt, sitemap.xml and declared machine-readable signal files, then evaluates 167 signals across five dimensions: AI Signals, AEO, GEO, AIO and SEO.

Is the score generated by an AI model? ▾

No. Every score is produced by deterministic rules applied to evidence actually observed on the website. A language model is used only to write the short narrative summary at the end. This separation means the same website in the same state always produces the same score.

Why are some signals marked as not applicable instead of failed? ▾

Because a signal that cannot be verified from public sources has not failed — it simply could not be tested. Marking it as failed would invent a verdict. Signals requiring paid external data sources or owner-level access are reported as not applicable, and the report states how many were tested.

What is the difference between AEO, GEO, AIO and SEO? ▾

SEO is the technical and content foundation used by search engines. AEO structures content so assistants extract direct answers. GEO makes the brand entity discoverable and citable by generative systems. AIO covers how AI systems understand, rank and reproduce content across the full stack.

Do I need to install anything on my website to be audited? ▾

No. The audit inspects only publicly served resources. Nothing is installed, no tracking code is added, no authentication is attempted, and no private or password-protected area is accessed.

How much does an audit cost? ▾

The first audit is free. Subsequent audits are charged at the price displayed on the site at the time of ordering. A monthly plan adds score tracking, regression alerts and history. Machine-to-machine access for AI agents is priced separately under a written arrangement.

Can AI agents call the audit engine directly? ▾

Yes. The engine exposes a POST endpoint at /audit that accepts a URL and returns a structured JSON report, plus a GET endpoint at /stats for service metadata. Negotiated machine-to-machine access, including rate limits, is agreed in writing.

Does a good score guarantee that ChatGPT or Gemini will cite my site? ▾

No. Third-party AI systems change their behaviour without notice and no provider guarantees citation. The audit identifies observable technical signals that are within your control; it does not promise a ranking, a citation or a commercial outcome.

Is this report a legal compliance certificate for the EU AI Act? ▾

No. The report is a technical observation, not a certification and not a legal opinion. It identifies signals that justify further evaluation. For a formal classification under Regulation (EU) 2024/1689, obtain independent legal analysis.

Who operates this service? ▾

AIVENTURE S.R.L., a company registered in Bucharest, Romania, European Union, operating under the 5thElement.ai brand. Registration details, contact routes and the full legal documentation are published on the site.