VITNAHow we got your address
You received an email from Collin Obey at COSTRINITY that you did not ask for. This page says where your address came from, why we wrote, what we hold, and how to make it stop. It is the notice required by Article 14 of the GDPR, which applies when an organisation holds personal data it did not get from the person it is about.
Last updated 16 September 2026.
Who is writing, and how to reach us
COSTRINITY INC., COSTRINITY INC., PO Box 1572, Fort Qu'Appelle, SK S0G 1S0, Canada, Canada. The controller for this processing is COSTRINITY INC. and the contact point is hello@costrinity.xyz. Every email carries the same address in its footer.
We have not appointed a representative in the European Union. We are recording that as an open question rather than an answer: whether Article 27 requires one here has not been assessed, and it will be.
Where your address came from
One of two places, and the email you received names which one for you specifically, rather than telling you it was “public sources”.
Your employer’s own website. A page on your company’s domain that publishes the address, most often a contact, team, legal or privacy page. We store the exact URL we read it on, and the email quotes it.
Hunter. A business contact database that supplies work email addresses. Where your address came from Hunter, the email says so by name.
We do not guess addresses, and we do not buy consumer data. If you want the exact record we hold for you, ask and we will send it.
What we hold
Your name, your business email address, your job title, and the employer you work for. Where the address came from and, for a published page, the URL. Whether we have emailed you, when, and what we sent. If you replied, the fact and date of the reply and which of eleven categories it fell into.
We do not hold your personal address, your phone number, anything about you outside your job, or any special category data.
Why we wrote, and on what legal basis
The purpose is to tell companies with users in the EU about transparency duties under the EU AI Act that already bind them, and to offer a paid readiness assessment. The legal basis is legitimate interests, Article 6(1)(f).
The legitimate interests pursued, which Article 14(2)(b) requires us to state: our interest in finding customers for a professional service, and the interest of your employer in learning about a legal obligation that applies to it. We wrote a balancing assessment before sending anything, and its conclusion was that a single, role-relevant, clearly identified message to a work address, with a one-line way to stop it, does not override your interests, because it concerns your job rather than your private life and costs you the time it takes to read one paragraph.
You can disagree with that conclusion, and the right to object below is how. We do not need a reason from you.
Who else sees it
One sub-processor, Anthropic PBC, for language-model processing. It is listed, with what it receives and the file in our code that performs the transfer, in the published sub-processor register. We do not restate it here, so this page cannot drift out of date against it.
We do not sell your data, share it for advertising, or use it to train anyone’s models.
Where it goes
COSTRINITY INC. is in Canada and the data is held there. Anything that reaches the sub-processor is processed in the United States. What that means for the laws it is then subject to is set out in the register, under “What that means”.
We make no claim on this page that either country provides an adequate level of protection. That is a legal determination and we have not made it.
How long we keep it
Two different answers for two different things, and both are published rather than promised. The record that you asked not to be contacted is kept permanently, because the only way to guarantee we never write again is to remember not to. The text of what you wrote to us is deleted after ninety days. Both are set out under what COSTRINITY retains.
Your rights
You have the right of access to the data we hold about you, and to have it corrected if it is wrong. You have the right to erasure, to restriction of processing, and to data portability. You have the right to object to this processing at any time, and because the basis is legitimate interests and the purpose is direct marketing, an objection is absolute: we stop, and we do not weigh it against anything.
The fastest way to exercise any of these is to reply to the email with the word no, or to write to hello@costrinity.xyz. An objection is actioned the same day it is read and the address is added to a permanent do-not-contact list.
Complaining about us
You have the right to lodge a complaint with a data protection supervisory authority, normally the one in the EU or EEA country where you live or work. You do not have to raise it with us first, though we would rather you did.