AiAiAi privacy notice
AiAiAi is a working tool for small companies to agree how they use AI at work. It is designed to collect as little personal data as possible, because the tool list is about AI tools, not people. This notice explains what data we process, why, and for how long.
Who is responsible
OÜ Kratikaitse (registry code 17470678), Estonia. For data-protection questions, write to tehisaru@ai3.ee. We answer these ourselves.
Two roles: our data and your company's data
- We are the controller for the data we need to run and protect the service: your account, login, technical logs and billing. This notice covers that data.
- Your company is the controller for the content it puts into its tool list and settings (for example, names of responsible people, review decisions, and who has read the staff rules). For that content we are a processor and follow the data processing agreement. If you have questions about that data, ask your company first. We will help them answer.
What we process
| Data | Why | Legal basis | How long |
|---|---|---|---|
| Email address, name (if added), language preference | account and login | performance of the contract with your company, and our legitimate interest in providing the service (GDPR Art. 6(1)(b) and (f)) | while you are a member of a workspace. An account that belongs to none is deleted when its last login session (your logged-in state) ends (at most 30 days after the last login), or earlier at your request |
| Login-link hash (a one-way fingerprint), time created, email | one-time link login, abuse limiting | legitimate interest (f) | deleted within 24 hours |
| Session hash and expiry | keeping you logged in | legitimate interest (f) | up to 30 days, or until you log out |
| Login log (who, when) | security and misuse investigation | legitimate interest (f) | 12 months |
| Technical request data (IP address, time, URL, browser type) | delivering and protecting the service, finding errors | legitimate interest (f) | 3 days in the request log, see below |
| Billing data (billed name, email, address, VAT no., plan) | invoicing and accounting | legal obligation (c) | 7 years (Estonian Accounting Act) |
| Emails you send us | replying and cooperation | pre-contractual steps or legitimate interest (b and f) | as long as needed to reply |
We do not sell data, add you to marketing lists, profile you, or make automated decisions about you. The AI Act notes shown on tools are rule-based orientation about AI tools, not a decision about people. No AI model currently processes any data in the service. If that ever changes, we will tell you beforehand.
Where the data is
The service is hosted by Cloudflare (Cloudflare, Inc., USA). The database sits in Cloudflare's EU jurisdiction, so the data is stored in the European Union. Requests are handled in the nearest Cloudflare data centre, which may be outside the European Economic Area. For those transfers, Cloudflare, Inc. is certified under the EU–U.S. Data Privacy Framework, and Cloudflare's data processing terms include the EU Standard Contractual Clauses.
Request logs (time, URL, request headers; cookies are redacted in the log) are kept in Cloudflare's logging service for 3 days. We only look at them to investigate errors or attacks.
Cookies
We use only strictly necessary cookies, so we do not ask for consent:
aiaiai_sidkeeps you logged in, for 30 days. The cookie holds a random identifier; our database stores only its hash.langremembers your language choice, for 1 year.
There is no analytics, no tracking pixels, and no third-party scripts. Fonts load from the service's own address. In our configuration, our host Cloudflare sets no cookies. If a Cloudflare security feature (such as bot protection) is ever switched on, it may set a strictly necessary security cookie.
Your rights
You have the right to access your data, have it corrected or erased, restrict its processing, port it, and object to processing. Write to tehisaru@ai3.ee. You also have the right to complain to the Estonian Data Protection Inspectorate.
Changes
When this notice changes, the version and date at the top change too. We tell workspace owners about significant changes by email.