# Privacy policy > What data OwnerSpec collects, why, on what legal basis, who receives it, and how to exercise your rights under the GDPR. | | | |---|---| | Source | https://ownerspec.com/legal/privacy/ | | Publisher | OwnerSpec (https://ownerspec.com/) | | Published | 2026-09-11 | | Updated | 2026-10-25 | --- This policy explains what happens to personal data when you visit ownerspec.com. It is written to meet Articles 13 and 14 of the EU General Data Protection Regulation (GDPR) and the UK GDPR. ## 1. Who is responsible The controller for the processing described here is: ## 2. What we collect, and why ### 2.1 Data processed automatically when you visit Our host, Cloudflare, processes technical data needed to deliver the page and to protect the site: your IP address, the requested URL, the referring URL, your user agent, and the country your request came from. Cloudflare acts as our processor for hosting and as an independent controller for its own network security purposes. **Legal basis:** Art. 6(1)(f) GDPR, our legitimate interest in delivering a working, secure website. **Retention:** Cloudflare's standard log retention applies; we do not maintain our own server logs. We also derive your country from Cloudflare's edge in order to show the right consent interface. That happens in your browser and the result is held in your browser's session storage only. ### 2.2 Analytics, only with your consent If you consent, we load: | Service | Provider | Purpose | Transfer | |---|---|---|---| | Google Analytics 4 | Google Ireland Ltd / Google LLC | Aggregate traffic and page performance measurement | United States | | Microsoft Clarity | Microsoft Ireland Operations Ltd / Microsoft Corp | Aggregate behaviour analysis, heatmaps and session replay | United States | Session replay in Clarity records mouse movement, scrolling and clicks. It does not record keystrokes in form fields, and we do not operate any login or payment flow on this site. Both services receive the same pseudonymous visitor id (the `os_uid` cookie): a random value created in your browser when you consent, so that a returning visit is recognised. It is not derived from you and is not linked to a name, email or account. Rejecting or withdrawing consent deletes it. **Legal basis:** Art. 6(1)(a) GDPR, your consent, together with the national laws implementing Art. 5(3) of the ePrivacy Directive for the storage of and access to information on your device. **Retention:** GA4 retains event data for 14 months; Clarity retains data for up to 30 days by default and up to 13 months for aggregated metrics. Nothing in this table is loaded, and no cookie from it is set, before you have consented. Advertising and remarketing signals are switched off permanently in our Google configuration. ### 2.3 Consent record When you accept or reject, we store your choice, the date, and the version of this policy in your browser's local storage. We also send an anonymous counter (accepted / rejected / auto, with no identifier of any kind) to our own edge so that we can report an aggregate acceptance rate. **Legal basis:** Art. 6(1)(c) GDPR, our obligation to be able to demonstrate consent, and Art. 6(1)(f) for the aggregate counter. ### 2.4 If you contact us If you email us or use the contact form, we process the details you supply in order to answer. **Legal basis:** Art. 6(1)(f) GDPR, our legitimate interest in responding to enquiries, or Art. 6(1)(b) where your message concerns a contract. **Retention:** up to 24 months after the correspondence ends, unless a longer period is legally required. ### 2.5 The MCP server, the MCP App and the A2A agent AI assistants such as Claude or ChatGPT can connect to OwnerSpec at `https://ownerspec.com/mcp` (MCP) and `https://ownerspec.com/a2a` (A2A). When you use one of those connections, the assistant sends us the arguments of each request: a search term, a symptom description, test results you typed, a model number, calculator values or the equipment list for a maintenance plan. We use them only to compute the answer to that one request and send it back. We do not store them, log them, link them to each other or to you, or use them to build a profile, and there is no account or sign-in. Cloudflare processes the same technical data as for any page request (section 2.1). The interactive view the MCP server can show inside the assistant loads nothing from any other site and sets no cookies. When you change a calculator field in it, the view passes the new values and result to the assistant you are using, so it can continue the conversation; that goes to the assistant's provider, not to us. Each assistant's own privacy policy governs what it keeps from your conversation. **Legal basis:** Art. 6(1)(f) GDPR, our legitimate interest in answering the request you made. **Retention:** none beyond the request; Cloudflare's standard log retention applies to the technical data. ## 3. Affiliate links Some outbound links carry a tracking parameter identifying OwnerSpec as the referrer. If you follow one, the merchant (for example Amazon) sets its own cookies under its own privacy policy and becomes the controller for what happens next. We receive only aggregated, non-identifying commission reports: we never learn who you are or what you bought as an individual. See our [affiliate disclosure](/legal/affiliate-disclosure/). ## 4. Transfers outside the EEA Google and Microsoft process data in the United States. Both are certified under the EU-US Data Privacy Framework, and we additionally rely on the European Commission's Standard Contractual Clauses. You can find each provider's transfer terms in its own privacy documentation. If you do not want your data transferred on this basis, reject analytics: the site works identically without them. ## 5. Your rights Under the GDPR you have the right to: - **access** the personal data we hold about you (Art. 15); - **rectification** of inaccurate data (Art. 16); - **erasure** (Art. 17); - **restriction** of processing (Art. 18); - **data portability** (Art. 20); - **object** to processing based on legitimate interests (Art. 21); - **withdraw consent** at any time, without affecting the lawfulness of processing before withdrawal (Art. 7(3)). Use the "Cookie settings" link in the footer of any page. To exercise any of these, contact us using the details in section 1. We answer within one month. You also have the right to **lodge a complaint with a supervisory authority**, in the EU member state of your residence, place of work, or where you believe an infringement occurred. A list of authorities is published at [edpb.europa.eu](https://www.edpb.europa.eu/about-edpb/about-edpb/members_en). In the UK, the supervisory authority is the [ICO](https://ico.org.uk/). ## 6. Automated decision-making We do not carry out automated decision-making or profiling that produces legal effects concerning you. ## 7. Children This site is not directed at children under 16 and we do not knowingly collect their data. ## 8. Changes We update this policy when our processing changes. Material changes bump the consent version, which resets every stored choice and asks again. **Last updated:** 25 October 2026. --- Citation: OwnerSpec, "Privacy policy", https://ownerspec.com/legal/privacy/, updated 25 October 2026. Canonical citation target: the URL above (the public HTML page), not this Markdown representation. Reuse: quoting with attribution and a link is permitted. See https://ownerspec.com/legal/terms/.