Privacy policy (DRAFT)

The controller of your personal data is [Ettevõtte nimi, registrikood], address [address] (“we”).

For data protection questions, contact us at [contact email].

Account data

When you sign in with Apple or Google, we receive your user identifier, email address and (if you share it) your name from the sign-in provider. With Apple, your email address may be hidden.

Uploaded documents

Photos, PDF files and screenshots of insurance contracts, policies and warranties that you add to the app.

Extracted fields

For example policy number, insurer, validity period, premium, excess, coverages, insured objects (car, home, people, pets, devices) and a plain-language summary.

Push tokens

Your device's push notification token, so that we can send you reminders.

Technical and usage data

Error reports, device and app version, and anonymous usage statistics. These never contain the contents of your documents.

Special category data: health, accident and life insurance contracts may contain health data. We process such documents only with your explicit consent (see section 4).

• To provide the core features of the app: storing contracts, extracting fields, summaries and the “My things” view.
• To send reminders about renewals, cancellation deadlines and warranty expiry.
• For the “Something happened” feature: insurer contacts, excess and a checklist based on your contract.
• To keep the service secure and to find and fix errors.
• To improve the service using aggregated usage statistics, without document contents.

We do not sell your data, do not use it for advertising and do not use your documents to train AI models.

Performance of a contract (GDPR Art. 6(1)(b))

Processing your account, documents, extracted fields and reminders is necessary to provide the service under the terms of use.

Explicit consent (GDPR Art. 9(2)(a))

We process documents containing health data (e.g. health and life insurance) only with your explicit consent. You can withdraw consent at any time in the app settings. Withdrawal does not affect the lawfulness of earlier processing.

Legitimate interest (GDPR Art. 6(1)(f))

Collecting error logs and anonymous usage statistics to keep the service secure and reliable. [To confirm whether consent will be requested for usage analytics.]

To provide the service we use trusted providers who process data on our instructions under a data processing agreement:

Supabase

Database and file storage. Data is stored in the European Union (Frankfurt, Germany).

Vercel

Website hosting and billing.

Google (Gemini)

AI extraction of fields from documents. Documents are not used to train models.

Expo

Delivering push notifications to your device.

Sentry

Error reporting, without document contents.

PostHog

Usage analytics, without document contents.

Where a provider processes data outside the European Economic Area, we protect it with appropriate safeguards such as the European Commission's standard contractual clauses. [To specify the processing location and safeguard for each processor.]

• We keep account data, documents and extracted fields while your account is active or until you delete them.
• When you delete your account, we delete your data within 30 days.
• Data is removed from backups within [X] days. [To specify.]
• We keep error logs and usage statistics for up to [X] months. [To specify.]
• Data we must keep by law (e.g. accounting records) is kept for the period required by law.

You have the right to:

• access your data and receive a copy;
• have inaccurate data corrected;
• have your data deleted;
• restrict or object to processing;
• receive your data in a machine-readable format (data portability);
• withdraw your consent at any time.

You can export your data and delete your account in the app settings. When you delete your account, we delete your data within 30 days. To exercise other rights, write to [contact email].

If you believe your rights have been violated, you can contact the Estonian Data Protection Inspectorate (www.aki.ee).

Data travels over encrypted connections and is stored encrypted. Access to data is restricted and granted only to those who need it to provide the service.

This website does not use cookies or analytics. The hosting provider may briefly process technical data, such as IP addresses, for security purposes.

We may update this privacy policy. We will announce significant changes in the app or on the website before they take effect.

[Ettevõtte nimi, registrikood]

[address]

Email: [contact email]