Privacy Policy

Last updated: October 1, 2026

This is a plain-language notice about what happens to your information when you use avihayzanetti.ai, contact me, or book a call. I have tried to name every tool involved, including the ones that track visits, so that nothing here is a surprise.

1. Who is responsible

This site and the services described on it are run by Avihay Zanetti, based in Israel. I decide what personal information is collected through the site and why. To reach me about anything in this notice, write to az@avihayzanetti.ai.

2. What I collect and why

Information you give me

• Booking form. On the coaching landing page: name, work email, role, company, company size, which ChatGPT plan you use, and any free-text answers you write (for example what you want to work on). I use this to reply, to decide whether I can help, to schedule a call and to prepare for it. The contact page has no form: it offers email, the snapshot and the booking page.
• Booking page. The booking page embeds Google Calendar appointment scheduling. Google receives what you type there (name, email, chosen time). If you came from the booking form, the page also shows the name and email you gave so you can copy them into the calendar; they are kept only in your browser tab (see the Cookie Policy).
• AI leadership snapshot. Your answers are turned into a result in your browser. The page reports to Google Tag Manager which of its three result profiles you got, and later that you asked for the email, but not your answers. If you choose to have the result emailed to you, your email, your name if you give it, and your answers, including the free-text ones, are sent to my automation, which emails you the result.
• Email and calls. If you write to me or book a call, I keep that correspondence and my notes about the conversation so I can follow up and deliver the work.
• Newsletter sign-up. Your email address, used to send the updates you asked for. The sign-up form is on the news, learn and insights pages and is processed by Formspree.
• Client portal. If you register for or sign in to the client portal, your registration details and sign-in are handled by my own content server (cms.jonny.cloud), and your browser keeps a sign-in token until you sign out.

Please do not put passwords, financial account numbers, health information or other sensitive personal data into any form or free-text box. I do not need it to decide whether we should talk.

Information collected automatically

• Analytics. Page views, pages visited, approximate location, device and browser type, and how you arrived, collected through Google Tag Manager and Google Analytics 4.
• Session recordings and heatmaps. Microsoft Clarity records how visitors scroll, click and move around pages so I can see where the site is confusing. Clarity applies its own masking to some content, such as text typed into form fields, but I cannot promise that it masks everything, so please do not type sensitive data into a form field.
• Advertising measurement. If you arrive from an OpenAI (ChatGPT) ad, the ad click carries an identifier called oppref. The OpenAI advertising measurement pixel can read it and may store it in a cookie named __oppref, so the ad platform can tell which ads led to visits. The pixel is used only on the coaching landing page, the snapshot, the booking page and the thank-you page, only when I have switched ad measurement on, only if you have not opted out, and only if you came from an ad click or are on the thank-you page. If you then submit the booking form, my automation may also send a conversion event to OpenAI from my server, again only if ad measurement is on and you have not opted out. That event contains the click identifier, the page address and time, and your email address, first name and last name in hashed (scrambled, one-way) form. It does not contain your free-text answers.
• Campaign tags and first-touch record. UTM parameters in the link you clicked (source, medium, campaign and similar), the referring page and the landing page are saved in your browser (az_attr) and attached to the form, so I know which link brought you. A random identifier is created for each form submission to avoid counting the same lead twice; it is sent with the form and kept with your name and email in az_lead for the life of the tab.
• Fonts and scripts. Some older pages load fonts from Google Fonts and scripts from Cloudflare (cdnjs) and jsDelivr. Their servers see your IP address when they deliver those files.

See the Cookie Policy for each cookie and storage item, what it does, how long it lasts and whether it depends on your choice.

3. On what basis I use it

Where the law asks for a legal basis (for example in the EU, UK or Israel): I answer your enquiry and prepare a call because you asked me to (steps before a contract); I keep basic business records because I have a legitimate interest in running a consulting practice and a legal duty to keep certain records; I use analytics and advertising measurement on the basis of your consent or your choice not to opt out, as described in section 9; and I send newsletters only if you signed up.

4. Who else handles the data

I do not sell your personal information for money. I use the following service providers, who process information on my behalf or provide the tools listed. Some of them (Google, Microsoft and OpenAI, for the tracking and measurement tools) also use the data under their own terms.

The booking, snapshot and contact pages do not use a third-party form service: the booking and snapshot forms go to my own automation, my CRM, Gmail and Telegram, and the contact page has no form, while the newsletter sign-up and the older contact and article forms still use Formspree.

I may also disclose information if the law requires it, or to protect my rights or those of others. If my business is ever transferred, your information would go with it under this notice.

5. How long I keep it

I keep contact and booking records only as long as I need them for the purpose they were collected for (answering you, preparing and running our conversations, and the legal and accounting records of an engagement), then I delete or anonymize them. You can ask me to delete your information earlier. This applies to each of these:

• Contact and booking records in my CRM.
• Email correspondence and call notes.
• Automation logs (n8n).
• Records of people who became clients.

For Google Analytics 4 event data and Microsoft Clarity recordings and heatmaps, how long the data is kept is controlled by each tool's own settings. I will state those periods here when they are known.

Cookie lifetimes are in the Cookie Policy. The advertising platform keeps the events it receives under its own policies. You can ask me to delete your information at any time (section 8).

6. Where the data goes

I am in Israel and my clients are mostly in the United States, so your information is processed in Israel and in the United States, and possibly in other countries where the providers above operate. Where the law requires a transfer mechanism, I rely on the mechanisms those providers offer, such as standard contractual clauses in their data processing terms.

7. Security

I use the security controls the tools above provide. No system is perfectly secure, and I do not claim any security certification. For how I handle client work specifically, see Confidentiality.

8. Your rights and how to use them

Depending on where you live, you can ask me to: tell you what I hold about you and give you a copy; correct it; delete it; restrict or object to how I use it; give it to you in a portable format; and withdraw consent you gave earlier. You also have the right not to be treated worse for using these rights.

Email az@avihayzanetti.ai with "Privacy request" in the subject and the email address you used with me. I may need to confirm it is you before I act. I reply within the time the law requires, normally 30 to 45 days, and sooner where I can. If I decline a request, I will say why, and you can appeal by replying to that email. If you are in the EU, UK or Israel you can also complain to your local data protection authority.

9. Your privacy choices (United States and everywhere else)

Notice for residents of US states with privacy laws (for example California, Colorado, Connecticut, Virginia, Texas and others). In the past 12 months I have collected these categories of personal information: identifiers (name, email, IP address, cookie identifiers); professional information (role, company, company size); internet and device activity (pages viewed, clicks, referral and campaign data, session recordings); and whatever you choose to write in free-text fields. I collect it directly from you and from your browser, for the purposes in section 2. I do not intentionally collect sensitive personal information, and I do not knowingly sell or share the personal information of anyone under 16.

Sale, sharing and targeted advertising. I do not sell personal information for money. Using an advertising measurement pixel and sending conversion events to an ad platform can count as "sharing" for cross-context behavioral advertising, or as "targeted advertising", under some state laws. You have the right to opt out of that, and of analytics tracking, using the control below.

What the default is before you choose. Analytics and ad measurement are allowed until you opt out, except in these cases, where they are off until you press Accept:

• Your browser sends the Global Privacy Control signal. I treat that as an opt-out.
• Your browser's time zone is in Europe (any Europe/ zone), or is one of Atlantic/Azores, Atlantic/Madeira, Atlantic/Canary, Atlantic/Faroe, Atlantic/Reykjavik, Africa/Ceuta, Asia/Nicosia, Asia/Famagusta or Arctic/Longyearbyen.
• Your time zone is UTC, GMT or unknown, and your browser language is an EU, EEA or UK language.

A choice you make with the buttons below, or with Accept or Decline on the notice, always wins, including over Global Privacy Control. This is a heuristic based on your browser settings, not on a check of where you actually are.

What happens when you opt out (or have not accepted in the cases above).

• Google consent signals (advertising storage, analytics storage, advertising user data and advertising personalization) are set to denied for Google Tag Manager and Google Analytics 4. Under Google's consent mode, Google's tools may still send limited measurement pings that do not use cookies.
• Microsoft Clarity is told to stop recording.
• The OpenAI advertising measurement pixel does not load.
• az_attr (campaign tags and first-touch record) is deleted from your browser's session storage, local storage and cookies and is not written again. Campaign tags in the address of the page you are on can still be attached to a form you submit on that page.
• Conversion events are not sent to the advertising platform: my automation sends the OpenAI conversion event only when you have not opted out.

These things are not changed by your choice, because the site needs them to work: cookieConsent (your choice itself), and, in your browser tab only, az_lead (your name and email, so the booking page can show them), az_booked and az_fired. Forms you submit, the Google Calendar scheduling page and Formspree forms are also outside this choice. I cannot control what a third party does beyond the signals above.

The choice is saved in your browser, so it applies only to the browser and device you use here, and it is cleared if you clear site data. Changing it later takes one click on this page.

10. Children

This site and my services are for business professionals. They are not directed at children, and I do not knowingly collect information from anyone under 16. If you think a child has sent me information, tell me and I will delete it.

11. Changes to this notice

If I change how I handle information, I will update this page and the date at the top. If a change matters to something you already gave me, I will tell you directly.

12. Contact

Avihay Zanetti, Israel. Email: az@avihayzanetti.ai.