Privacy notice
Version 2026-10-05
Draft for review by a qualified lawyer before publication. Points to confirm are highlighted, in particular:
- the hosting provider, where the server and database are located, and how long server logs are kept;
- that the data processing agreement of each provider has been accepted, and the transfer basis of each provider in the United States;
- the current registered address.
In short
- We use what you tell us (your idea, your chat with Aura, your name and email) to prepare your free preview and, if you pay, your specialist consultation, and to answer your emails.
- Aura is an AI. Your project text is processed by our external AI provider, which may not use it to train its models. Your name and email are not sent with the chat or the preview.
- A person reviews every paid written evaluation before it is sent. No decision with legal or similarly significant effects on you is taken by AI alone.
- No advertising, no analytics, no tracking cookies. We do not sell your data.
- Requests are deleted automatically 12 months after you send them; chats that did not lead to a request after 30 days.
- You can access, correct or delete your data, and object to our use of it, by writing to info@emporeu.com.
1. Who is responsible for your data
The controller of your personal data is Empor Solutions OÜ (registry code 16933107), Ülemiste Business Area, Tallinn 11415, Harju County, Estonia. Contact: info@emporeu.com.
We have not appointed a data protection officer. We are not required to, because our core activities do not involve large-scale, regular and systematic monitoring of people or large-scale processing of sensitive data (Art. 37 GDPR). Write to the address above for anything about your data.
2. What data we use and where it comes from
From you
- Your project: the idea you describe, the project type, stage and preferred start you choose, and your messages to Aura in the chat.
- Contact details: your name and email and, if you add it, your company.
- Your order: if you book a specialist consultation, the confirmation you tick before paying (that we start immediately, and the terms you accepted, with their version), the date and the payment session reference.
- Emails: the emails you send us and our replies, including replies written by Aura.
- Language: the language your browser uses or that you choose, so that we answer you in it.
Created by us
- Aura's replies, your free preview and, if you pay, your written evaluation and blueprint (PDF).
- Our internal notes and the follow-up status of your request.
From others
- Stripe, our payment provider: whether your payment succeeded and the session reference. In our Stripe account we can also see the name, email, billing details and, if you add them, the company and tax details you enter at checkout. We never see your full card details.
- Our bot-protection provider: the result of the bot check (pass or fail).
- Other people: if someone else replies to our emails (for example a colleague you forwarded them to), we receive their email address and message.
Technical data
- Your IP address, which our server receives with every request and records in its logs, and which we use to apply daily usage limits.
- The browser and device signals that our bot-protection provider checks to tell people from bots (section 7).
Please do not send us sensitive data (for example about health, religion or political opinions), passwords, or confidential information about other people. We do not need it. If you mention other people in your project description, only include what is needed.
3. Why we use it and on what legal basis
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Running the chat with Aura and preparing your free preview, which you ask us for | Project, chat, language, contact details | Providing the service you request and steps you ask for before a contract (Art. 6(1)(b)) |
| Providing the paid specialist consultation: drafting, specialist review, sending the written evaluation, the order confirmation and answering your questions about it | Project, chat, contact details, order, emails | Performance of the contract (Art. 6(1)(b)) |
| Taking payments | Order and payment data | Performance of the contract (Art. 6(1)(b)) |
| Accounting and tax records | Invoices, payment records | Legal obligation (Art. 6(1)(c)) under the Estonian Accounting Act (Raamatupidamise seadus) and tax law |
| Keeping your request for 12 months and contacting you about it, for example to prepare a project proposal you ask for or to follow up once on your request | Project, preview, contact details, notes | Our legitimate interest in following up on enquiries about our services, and steps you ask for before a contract (Art. 6(1)(f) and (b)) |
| Keeping a copy of the emails we send and receive in our company mailbox, and alerting our team when an email needs a person | Emails, contact details | Our legitimate interest in keeping a record of what we told you and in supervising our AI assistant (Art. 6(1)(f)) |
| Keeping proof of your order and of your confirmation about the right of withdrawal | Order data | Legal obligation under consumer protection law and our legitimate interest in proving it (Art. 6(1)(c) and (f)) |
| Bot protection, daily usage limits, server logs and the security of our systems | IP address, email address (for limits), browser signals | Our legitimate interest in keeping the service available, safe and affordable (Art. 6(1)(f)) |
| Handling complaints, establishing or defending legal claims | Any of the above, as needed | Our legitimate interest in protecting our rights (Art. 6(1)(f)) |
| Answering requests about your rights and requests from authorities | As needed | Legal obligation (Art. 6(1)(c)) |
We do not ask for your consent for any of these purposes, because they do not depend on it. We do not send newsletters or advertising, do not create marketing profiles and do not sell or rent your data. If we ever want to send you marketing, we will first ask for your consent, which you can withdraw at any time.
4. How we use AI
- Aura is an AI system, not a person. We tell you so in the chat, in her emails (signed "Project assistant (AI)") and in the documents she helps write. The PDF also carries a machine-readable note that it was generated with AI and reviewed by a person.
- What the AI receives. For the chat, the free preview and the first draft of your written evaluation, our AI provider receives your project description, type, stage, preferred start, language and chat messages, but not your name, email or company. To answer your emails after delivery, it also receives your name, the email thread with us and your evaluation.
- Emails. Aura answers routine questions about your evaluation by email automatically. Emails about prices, contracts, invoices, refunds, dates, complaints, legal or data protection matters, and emails from an address other than yours, are passed to a person, who answers them.
- Human review. In the paid consultation, a specialist reads the AI draft, corrects or completes it, and approves it before it is sent, or decides that we cannot take on the case and refunds you. The free preview is an automatic, general first impression, not an assessment of you.
- No automated decisions about you. We do not take decisions based solely on automated processing that have legal or similarly significant effects on you (Art. 22 GDPR). Our automatic daily limits and bot check can stop a request for the day; if this happens, you can simply write to us.
- No training. Under its commercial terms, our AI provider may not train its models on the content we send it.
5. Who receives your data
We share your data only with the external providers we need to run the service. They act on our instructions under a data processing agreement, unless stated otherwise, and only for the purposes below. Our team members who need it for their work can also see it.
| External provider | What for | Where |
|---|---|---|
| AI model provider | The AI that powers Aura, the previews, the first drafts and the email replies | EU and United States |
| Stripe (Stripe Payments Europe, Limited, Ireland), through Empor Solutions OÜ's own Stripe account | Payments, receipts and invoices. Stripe is also an independent controller for its own legal obligations (for example anti-money-laundering and fraud prevention), under its own privacy policy. | EU and United States |
| Email delivery provider | Sending our emails and receiving your replies to them | United States |
| Bot-protection provider | Checking that the request form is sent by a person, not a bot | Global network, including the United States |
| Business email provider | Our company mailbox, which receives your emails to us and a copy of the emails we send you | Switzerland |
| Hosting provider | The server and database of this website | a server in Germany (European Union), rented from Hostinger |
You can ask us for the current list of our external providers, with their names and locations, at info@emporeu.com.
We may also disclose data when the law requires it, for example to tax authorities, courts or supervisory authorities, or to professional advisers (such as our accountant or lawyer) who are bound by confidentiality.
Your blueprint can be opened with the private link in our emails. Anyone who has that link can open it, so please share it only with people you trust.
6. Transfers outside the EU and EEA
Some providers process data in the United States. For transfers to the United States we rely on the European Commission's adequacy decision for the EU–US Data Privacy Framework where the provider is certified under it, or otherwise on the European Commission's Standard Contractual Clauses (Art. 45 and 46 GDPR). Switzerland, where our business email provider stores our mailbox, is covered by an adequacy decision of the European Commission. You can ask us for information about these safeguards and a copy of the clauses at info@emporeu.com. Lawyer: checked on 2026-10-06 at dataprivacyframework.gov: Stripe, LLC, Cloudflare, Inc. and Resend are certified; the AI provider (Anthropic, PBC) is not, and its data processing addendum includes the Standard Contractual Clauses. Please confirm.
7. Bot protection, cookies and local storage
- No tracking. We use no advertising or tracking cookies, no analytics and no social media plugins.
- Bot protection. When you send the request form, our bot-protection provider checks that a person, not a bot, is sending it. To do so, it receives your IP address and technical information about your browser, such as its user agent. It sets no cookie on your device. We use it only because it is strictly necessary to protect the form you are using from automated abuse, so it does not require your consent under the ePrivacy rules (in Estonia, § 1041 of the Electronic Communications Act). Lawyer: checked on 2026-10-06 in Cloudflare's Turnstile privacy addendum: Cloudflare is our processor for this check, and an independent controller when it uses the data to improve its bot detection. Please confirm how to describe that second role.
- Your browser's storage. Your own browser keeps, only on your device: the language you choose, and an unsent draft of the form (your idea, type, stage and start date, never your name, email or company), which is removed once you send the form. In the self-playing demo, a temporary flag is kept until you close the tab. We do not receive these. They are strictly necessary for features you use, so they do not require consent. You can delete them in your browser settings at any time.
8. How long we keep it
| Data | Kept for |
|---|---|
| Chat conversations with Aura | 30 days from the start of the chat, then deleted automatically. If you send a request, the chat is copied into it and kept with it. |
| Your request: project, chat, contact details, preview, written evaluation, order confirmation, our notes and the email thread stored on our server | 12 months from the date you sent the request, then deleted automatically, together with the PDF file. If something must be kept longer (for example for a legal claim), we keep only what is needed, for as long as needed. |
| Proof of a paid order: date, email address, status, payment reference, and your confirmation about the start of the service and the right of withdrawal, with the version of the terms you accepted | 3 years from the order, the general limitation period for contractual claims in Estonia (General Part of the Civil Code Act, § 146), then deleted automatically. The project content itself is deleted after 12 months, as above. |
| Copies of emails in our company mailbox | 12 months, like your request, unless needed for a contract, accounting or a legal claim. |
| Daily usage counters (IP address or email address) | 7 days |
| Server logs (errors only; we keep no access logs of visits) | 14 days |
| Backup copies of our database | 14 days, then overwritten |
| Invoices, payment and accounting records (kept in Stripe and in our bookkeeping, not in the website database) | 7 years from the end of the financial year in which the transaction was recorded, as required by the Estonian Accounting Act (§ 12) |
| Data processed by our AI provider | Deleted by the provider within 30 days, unless it is flagged for a breach of the provider's usage policy (then kept for up to 2 years) or the law requires it to be kept longer. Lawyer: checked on 2026-10-06 in the provider's privacy center. |
| Correspondence about your privacy rights | 3 years, the general limitation period in Estonia, to show that we answered |
9. Your rights
You have the right to:
- know whether we use your data, and get access to it and a copy of it (Art. 15 GDPR);
- have wrong or incomplete data corrected (Art. 16);
- have your data deleted, unless we must keep it, for example invoices (Art. 17);
- have its use restricted while a question about it is being resolved (Art. 18);
- receive the data you gave us for the service in a machine-readable format, or have it sent to someone else (Art. 20);
- object to our use of your data, as explained below (Art. 21).
Your right to object. Where we use your data on the basis of our legitimate interests (section 3), you can object at any time, for reasons relating to your situation. We will then stop, unless we have compelling legitimate grounds that override your interests, or need the data to establish or defend legal claims. If we ever use your data for direct marketing, you can object at any time and we will stop, without needing a reason. Write to info@emporeu.com.
To use any of these rights, write to info@emporeu.com. It is free. We answer within one month (extendable by two months for complex requests, in which case we tell you why) and may ask you to confirm your identity, for example by writing from the email address you used with us.
You also have the right to complain to a data protection authority: in Estonia, the Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, info@aki.ee, www.aki.ee, or the authority of the EU country where you live or work, or where you think the problem occurred. We would be glad if you contacted us first, so we can try to resolve it.
10. Do you have to give us your data?
No, there is no legal obligation to give us your data. But we need your idea to prepare a preview, your name and email to deal with your request and send you anything, and your payment to provide the paid consultation. The company field is optional. If you do not want to use the online form, you can write to us by email.
11. Children
Our services are meant for adults and businesses. Please do not use them if you are under 18.
12. Security
We protect your data with encrypted connections (HTTPS), a private, password-protected panel for our team, unguessable private links, limits against automated abuse, signed reply addresses that stop forged emails from reaching your file, access for providers limited to what they need, and automatic deletion when data is no longer needed. If a security incident puts your data at high risk, we will tell you without undue delay.
13. Changes to this notice
We update this notice when our services, providers or the law change. The version date is shown at the top. If a change materially affects how we use data you have already given us, we will tell you by email before it applies.