Privacy Policy
Controller
AiActs is operated by Aimperia LLC, registered in Georgia (Identification Number 400470806), Tbilisi, Nadzaladevi district, Erosi Manjgaladze street, N 75a.
Contact for any privacy question or request: hello@aiacts.ai
Processing is governed by the Law of Georgia on Personal Data Protection. Where you are in the EU or EEA, the GDPR may also apply.
What we collect
Account data. Email address and password (stored as a hash). Your email is also kept in encrypted form.
Profile data, optional. Full name, company, job role, country, phone. You can use the service without filling these in, and you can change or clear them at any time in your account.
Age data. Your date of birth is used once to check that you meet the minimum age. We store only the year of birth, the age threshold applied, and the time of confirmation. The full date is not retained. See "Minimum age" below.
Country and legal regime. We record the country you state and the country inferred from your IP address, and we store a marker of the legal regime that applies to your account. All users currently have the same rights under this policy regardless of that marker.
Assessment data. The information you enter about your AI systems and the reports generated from it.
Technical and security data. IP address, user agent, endpoint accessed, authentication method, security events and application logs.
Support data. Your messages to us and any attachments.
Consent and acceptance records. What you consented to or accepted, when, by what method, from which IP address, and the document version, with a snapshot of the text you were shown.
Billing data. Handled by Paddle, not by us. See "Payments".
We do not collect special categories of personal data and do not ask for them.
Why we process it, and on what basis
| Purpose | Basis |
|---|---|
| Providing the service, generating reports, managing your account | Performance of a contract with you |
| Transactional email: verification, password reset | Performance of a contract |
| Age verification and, where needed, parental consent | Legal obligation |
| Security, abuse prevention, audit and access logs | Legitimate interest |
| Keeping records of consent and accepted terms | Legal obligation |
| Analytics | Your consent |
| Marketing email | Your consent |
| Transfer to processors for non-essential functions | Your consent |
We do not use your data for advertising or automated decisions that produce legal effects for you.
Minimum age
The minimum age to use AiActs is 16, or higher where the law of your country requires it. If you are below that age, the account is not activated until consent is given by a parent or guardian. For that process we store the parent's and the child's email addresses in encrypted form, the country, the year of birth and the status of the request, and nothing further.
Who we share it with
We do not sell your data. Service providers are listed in the External Processors register: hosting, transactional email, LLM report generation, application logging, the support mailbox, analytics (only after consent), and Paddle for payments.
Payments
Paddle.com is the Merchant of Record for all purchases made through this site. Paddle collects and processes payment and billing data as a separate controller under its own privacy policy. We never receive or store your full card number or security code.
Where your data is stored
On servers in Georgia. Some processors are located outside Georgia; transfers and safeguards are listed in the External Processors register.
Security
Access to personal data is restricted and logged. Email addresses are stored encrypted, passwords as hashes. Security incidents and staff access to user data are recorded.
How long we keep it
See the Retention Policy. In short: account and assessment data are kept while your account is active and deleted or anonymised after a valid deletion request, unless a record must be kept for legal, security or accounting reasons.
Your rights
You may request access to your data, ask us to correct or delete it, ask us to restrict processing, receive a copy in a portable format, and object to processing based on legitimate interest. Where processing is based on consent, you may withdraw it at any time without losing access to the service.
Requests are made from Account → Legal & Requests, or by writing to hello@aiacts.ai.
We answer a request for access, information, rectification or completion within 10 working days. Where the request is complex we may extend that period once by up to 10 further working days, and we tell you as soon as we do.
Where you ask us to stop processing, erase or destroy your data, we act within 5 days unless another ground obliges us to keep processing. Where you withdraw consent, processing for that purpose stops within 7 working days. A request to stop direct marketing is carried out within 7 working days.
You may lodge a complaint with the Personal Data Protection Service of Georgia or, if you are in the EU/EEA, with your local supervisory authority.
Cookies
Necessary storage is used for login, security and service operation. Analytics and marketing cookies are optional and are not set unless you accept them in the cookie banner. Rejecting them does not restrict access to the service.
Changes
We publish a new version before a change takes effect and record it in Document Versions. Registered users are notified by email of material changes.