Privacy Policy
Version 0.9.3 · last updated 6 November 2026
This policy describes how our systems work today. A lawyer is reviewing it; we will update it after the review and show the new version and date here.
1. Who we are
AITSEPP is run by Roman Merg, a private individual in Tallinn, Estonia, who is the controller of the personal data described in this policy. The company AITSEPP OÜ is being registered; once it is, it takes over as controller and we will update this policy.
For anything about your data, write to privacy@aitsepp.com.
2. What this policy covers
This policy covers our website www.aitsepp.com, the AI advisor Ilmar on it, booking a call with us, emailing us and the client portal.
It does not cover data from our clients' systems (for example their customer records, invoices or emails) that we process while building or running automations for them. For that data we act on the client's behalf, and the data processing agreement we sign with the client applies.
3. What we process and why
For each activity: the data, why we use it, the legal basis under the General Data Protection Regulation (GDPR), and how long we keep it.
Visiting the website
- Data
- IP address, browser and device type, pages requested, time.
- Why
- To show the website and keep it secure.
- Legal basis
- Our legitimate interest in running a secure website (art. 6(1)(f)).
- Kept
- Our hosting provider (Vercel) keeps request logs for a short period under its own terms.
Chatting with Ilmar, our AI advisor
- Data
- What you type, Ilmar's answers and a chat session ID.
- Why
- To answer your questions about automating your business, and to check and improve the quality of the answers.
- How
- Your messages are sent through OpenRouter to AI language models from OpenAI, which write the answer. When Ilmar can't answer from our own knowledge base, part of your question may be sent as a web search limited to trusted documentation sites. A copy of each conversation is recorded in Langfuse (EU) so we can review answer quality.
- Legal basis
- Our legitimate interest in answering enquiries from businesses, and steps you ask us to take before a contract when you ask about our services (art. 6(1)(f) and (b)).
- Kept
- 12 months after the conversation's last message, then deleted automatically. The copy in Langfuse is deleted automatically after 25 days, and our backups are kept for 14 days.
Please don't type passwords, health data or other sensitive information into the chat.
Leaving your details in the chat
- Data
- Name, email, company, what you want to automate, your IP address at the moment you confirm, and a record that you ticked the box saying you are 18 or older and contacting us on behalf of a business, with the version of that wording.
- Why
- To contact you about your request and prepare a call, and to show that you ticked the box.
- Legal basis
- Steps you ask us to take before a contract (art. 6(1)(b)).
- Kept
- In our database, the IP address is removed after 12 months, and the record is deleted 12 months after it reached our CRM. In our CRM, until you ask us to delete it; automatic deletion is being set up.
When you open the booking link from the chat, the details you confirmed are passed to our booking service (Cal.com) so the form is filled in for you.
Booking a call
- Data
- Name, email, company, your answers to the booking questions and the chosen time. Calls take place in Google Meet. We don't record calls.
- Why
- To arrange and prepare the call.
- Legal basis
- Steps you ask us to take before a contract (art. 6(1)(b)).
- Kept
- Until you ask us to delete it; automatic deletion is being set up.
Emailing us
- Data
- Your email address, name and anything in your message and attachments.
- Why
- To answer you.
- Legal basis
- Our legitimate interest in answering enquiries (art. 6(1)(f)); steps before a contract, or the contract, when the email is about our services (art. 6(1)(b)).
- Kept
- Until you ask us to delete it, unless it belongs to a client project (see below).
Client portal
- Data
- Your email address, account ID and organisation, sign-in records, and the number and cost of questions you ask the advisor while signed in.
- Why
- To let you sign in with a one-time email link and use the portal.
- Legal basis
- Contract (art. 6(1)(b)).
- Kept
- While you have access; deleted on request after it ends.
Security and abuse prevention
- Data
- IP address and browser signals. A bot check (Cloudflare Turnstile) runs when you start a chat and when you send your details, and a per-IP limit caps how many requests reach the advisor.
- Why
- To protect the website and the advisor from bots and abuse.
- Legal basis
- Our legitimate interest in keeping our services secure (art. 6(1)(f)).
- Kept
- IP addresses for the request limit: 24 hours, then deleted automatically.
When you become a client
- Data
- Contact details of your representatives, the agreement and scope, invoices and payments, our correspondence.
- Why
- To carry out the agreement, invoice and keep accounting records.
- Legal basis
- Contract (art. 6(1)(b)); legal obligation for accounting records (art. 6(1)(c)).
- Kept
- For the term of the agreement; accounting records as long as Estonian accounting law requires.
We don't sell personal data, and we don't send marketing messages.
4. Who receives the data
These service providers process data on our behalf and only on our instructions:
| Provider | What it does for us | Location |
|---|---|---|
| Vercel | Hosts the website | USA |
| Cloudflare | Domain name service, secure connection to our server, bot check | USA, global network |
| Supabase | Database (chats, leads, portal accounts) and portal sign-in | EU (Ireland); US company |
| OpenRouter, OpenAI | Generate Ilmar's answers | USA |
| Langfuse | Records conversations so we can review answer quality | EU (Germany) |
| Cal.com | Booking calls | USA |
| Google Workspace | Email, calendar, video calls, document storage | USA and EU |
| Anthropic | AI tools we use to run and maintain our systems; may see operational logs and records | USA |
Our CRM (Twenty) and our automation platform (n8n) run on our own equipment in Estonia; no third party processes that data. We may also disclose data where the law requires it, or to protect our rights.
5. Transfers outside the EU
Several providers above are US companies. For transfers to them we rely on the safeguards in their data-processing terms: certification under the EU-U.S. Data Privacy Framework or the European Commission's Standard Contractual Clauses. We are confirming which one applies to each provider; ask us for the current list.
6. Cookies and browser storage
We use no analytics, advertising or tracking cookies. What the website stores in your browser:
| Name | What it does | Kept |
|---|---|---|
| aitsepp-lang (cookie) | Remembers your language | 1 year |
| aitsepp-theme (local storage) | Remembers light or dark mode | Until you clear site data |
| aitsepp-chat-side (local storage) | Remembers which side the chat window opens on | Until you clear site data |
| Chat session (session storage) | Keeps your chat open while you browse the site | Until you close the tab |
| Portal sign-in (local storage, Supabase) | Keeps you signed in to the client portal | Until you sign out |
The bot check loads a script from Cloudflare (challenges.cloudflare.com) when you start a chat or send your details; it reads browser and device signals to tell people from bots. These items are needed for the website to work as you'd expect, so we don't ask for consent. If we ever add analytics, we will ask first.
7. Your rights
You have the right to:
- see the data we hold about you and get a copy;
- have incorrect data corrected;
- have your data deleted;
- restrict how we use it;
- object to use based on our legitimate interest;
- receive data you gave us in a machine-readable format;
- withdraw consent at any time where we rely on it (this doesn't affect earlier use).
Write to privacy@aitsepp.com. To have your data deleted, you can also write to delete@aitsepp.com. We answer within one month.
If you think we've broken data protection rules, you can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee, info@aki.ee) or to the data protection authority of your own EU country.
8. Do you have to give us data?
No. The chat works without your name or email. To contact you or book a call we need your name and email; without them we can't respond to that request.
9. AI and automated decisions
Ilmar is an AI assistant, not a person. It gives general advice and estimates and makes no decisions about you. A person handles every request you send us. We make no decisions based solely on automated processing that have legal or similarly significant effects on you.
10. Security
We use encrypted connections, keep our database and admin ports closed to the internet, limit access to the person who runs AITSEPP, and delete data automatically when its retention period ends. If a breach puts your personal data at risk, we notify the Data Protection Inspectorate and, where needed, you, as the GDPR requires.
11. Children
Our services are for businesses and aren't aimed at children. If you think a child has given us data, write to us and we will delete it.
12. Changes to this policy
We update this policy when our processing changes. The version and date at the top show the latest change. We announce material changes on this page before they take effect.
13. Contact
privacy@aitsepp.com · Roman Merg, AITSEPP, Tallinn, Estonia.