Privacy policy

Effective date: 2026-10-30.

1. Controller

VIRTUOSITY LLC, Limited liability company organized under the laws of Florida, USA, 1242 SW Pine Island Road, STE 42-348, Cape Coral, FL 33991, USA. Email: info@28in28.ai. The controller is established in the United States. Being registered in the United States does not limit the rights you have under the EU General Data Protection Regulation (GDPR) or other applicable law.

2. What this website does not do

It sets no cookies. It shows no ads and contains no social-media plugins or third-party tracking pixels. Its font is served from this website’s own server, not from a font service. AI agents of the experiment do not process data about visitors of this website.

3. Hosting and server logs

The website is hosted by Hetzner Online GmbH, Germany. To deliver a page, the server necessarily processes your IP address, the requested address and your browser’s technical request headers in memory. The web server is configured to write no access log and no error log for this website, so this information is not stored in server logs for this website. The website application itself does not log IP addresses.

The web server software is shared with other websites of the operator. In rare cases, a technical error that occurs before a request can be assigned to a website (for example, a malformed connection) can be written to the shared server’s error log together with the IP address and the time. That shared log does not yet have an automatic deletion period; we will introduce one and update this section. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure, working website).

4. Visitor statistics (Plausible Analytics)

We count visits with Plausible Analytics, provided by Plausible Insights OÜ, Estonia (EU). Plausible uses no cookies and stores nothing on your device; the tracking code only reads whether you have set Plausible’s own opt-out flag in your browser. According to Plausible, your IP address and browser identification are used only to compute a visitor identifier that changes every day and is not stored in readable form, so visitors cannot be recognised across days or websites.

We record: the page address (reduced to the path plus any campaign tags such as utm_source), the referring website, country, device type, browser and operating system, how far a page was scrolled and how long it was in view, and anonymous events — clicks on our main buttons (including the newsletter signup button), confirmation-page visits, which venture details were opened, clicks to venture websites, and for the email authentication check (section 8) that a check was started, its overall result (pass, fail, unknown or error) and clicks on the fix-plan button — never the domain you enter; and that the Fix & Verify request form (section 6a) was sent, without any of its content. We never send names, email addresses, free-text input, account or payment identifiers to Plausible. Results are only available to us as aggregated statistics.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in understanding, in aggregate, how the experiment is found and used).

5. Newsletter

The newsletter is run by Brevo Inc., Camden, Delaware, USA on our behalf (processor under Art. 28 GDPR). The signup form is hosted by Brevo at 6cca3ebb.sibforms.com; this website itself never receives your email address. On that form you enter your email address and give your consent. Brevo records the time of your signup and of your confirmation (together with your IP address and the form you used) so we can prove your consent.

The form page itself is operated by Brevo; for that page, Brevo’s own privacy notice also applies: brevo.com/legal/privacypolicy. Transfer outside the EU: your data is processed by a company in the USA; Brevo's data processing agreement (Appendix 3 of its Terms of Service) protects such transfers with the EU Standard Contractual Clauses and supplementary measures and, where applicable, the EU-US Data Privacy Framework, and Brevo's sub-processors may also process data outside the EU.

What you receive: 33 daily updates by email from 24 October to 25 November 2026 — four editions before the ventures start, 28 editions on the AI-operated ventures and their real results, and the final report. If you subscribe later, you receive the remaining editions.

Double opt-in: you first receive a confirmation email; you are only subscribed after clicking its link. After confirming you may be redirected to a confirmation page on this website, which counts the confirmation anonymously (no email address or token is recorded). Every newsletter contains an unsubscribe link; you can also withdraw by writing to info@28in28.ai. Legal basis: your consent, Art. 6(1)(a) GDPR. After you unsubscribe, your address is removed from the mailing list; a record of the consent and its withdrawal may be kept to prove it.

6. Contact by email

If you email us, we use your address and message to answer you and delete them when the conversation is finished, unless legal retention duties apply. Legal basis: Art. 6(1)(b) or (f) GDPR. Our mailbox provider is Namecheap, Inc., 4600 East Washington Street, Suite 300, Phoenix, AZ 85034, USA (Private Email), acting on our behalf. Transfers outside the EU: Our mailbox provider Namecheap, Inc. stores and processes emails on servers in the USA. The transfer is based on the EU Standard Contractual Clauses (Commission Decision (EU) 2021/914, Module 2, controller to processor) in Namecheap's Data Processing Addendum, which its Universal Terms of Service incorporate for hosted services (Art. 46(2)(c) GDPR). You can obtain a copy by writing to the contact address in section 1.

6a. Fix & Verify request form

Controller and contact: VIRTUOSITY LLC (section 1), info@28in28.ai.

What we process: the company name, your name, your work email address, the domain, the country of the business, the services that send mail as the domain and your message, as you enter them, plus the time of the request and the version of the confirmation you ticked. We also note whether the email address belongs to the domain you named.

Purpose and legal basis: to answer your request, to check the domain you named from public DNS and to prepare a fix plan and a quote. Legal basis: if you ask for yourself as a sole trader, Art. 6(1)(b) GDPR (steps taken at your request before a contract); if you ask on behalf of a company, our legitimate interest in answering business requests and preparing a quote, Art. 6(1)(f) GDPR, which you can object to at any time (section 7). Providing the details is voluntary, but without them we cannot answer. No automated decision is taken about you.

No marketing: the tick boxes confirm a business request and how we use it; they are not a consent to marketing. Sending the form does not subscribe you to the newsletter or any other mailing, and we do not use these details for advertising. The details do not reach our visitor statistics.

Recipients: the request is stored on our server operated by Hetzner Online GmbH, Germany. Our replies and your answers are handled through our mailbox provider, Namecheap, Inc., 4600 East Washington Street, Suite 300, Phoenix, AZ 85034, USA (Private Email). Both act on our behalf. We do not sell or share the details with anyone else.

Transfers outside the EU: Our mailbox provider Namecheap, Inc. stores and processes emails on servers in the USA. The transfer is based on the EU Standard Contractual Clauses (Commission Decision (EU) 2021/914, Module 2, controller to processor) in Namecheap's Data Processing Addendum, which its Universal Terms of Service incorporate for hosted services (Art. 46(2)(c) GDPR). You can obtain a copy by writing to the contact address in section 1.

Storage period: if no order follows, the details are deleted 180 days after our last contact, or earlier when you ask. If you order, section 9 applies.

Your rights: access, rectification, erasure, restriction, portability, objection and complaint to a supervisory authority, as set out in section 7. The form is for businesses only.

7. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw consent at any time with effect for the future (Art. 7(3)). You may lodge a complaint with a data protection supervisory authority, in particular in the EU Member State of your habitual residence, place of work or place of the alleged infringement (Art. 77). Write to info@28in28.ai to exercise your rights.

8. Free email authentication check

If you use the check at 28in28.ai/check, we process the domain name you enter in order to read its public email-authentication DNS records (MX, SPF, DKIM, DMARC, MTA-STS, TLS-RPT) and show you the result. The check is a fixed program; no AI model receives your input.

Our check service runs on our server at Hetzner Online GmbH, Germany (section 3). It sends its DNS queries – for that domain, for names derived from it (for example _dmarc.<domain>) and for domains its SPF record refers to – only to the two recursive DNS resolvers that Hetzner operates for servers in its data centres and provides as part of its hosting service for our server. The check uses no other DNS service. As with every DNS lookup, these resolvers ask the name servers responsible for the queried domains for the answer. Those name servers are operated by whoever hosts that domain’s DNS and can be located anywhere in the world, including outside the EU; they receive the queried names and the address of Hetzner’s resolver, not yours. Hetzner’s public documentation for these resolvers does not state whether or for how long they log queries.

The check service keeps the domain and its result in memory for up to 10 minutes, so that a repeated check of the same domain is answered without new queries, and then deletes them. It does not write the domain or the result to disk, to a database or to any log. To prevent abuse, the website computes a one-way hash of your IP address with a secret key and the current date, so the hash changes every day, and passes only this hash – not your IP address – together with the domain to the check service. The service keeps the hash in memory to limit the number of checks and deletes it within 25 hours after your last check; the hash is not written to disk or to any log either. We keep only daily counts of checks (started, completed, rejected as invalid or too frequent, failed). Sending the check request to our server involves the same in-memory processing of your IP address as any page visit, including the rare entry in the shared server’s error log described in section 3.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in providing the check and in protecting it from abuse). You can object at any time (section 7). If you request a fix plan, you send us an email yourself and section 6 applies.