Privacy Policy

00Introduction

This policy describes how we collect and handle personal data — any information relating to an identified or identifiable person, such as a name, an email address or an IP address. It covers this website, the Amazi platform (the “Platform”), and contact with us by email or through our forms.

01Who is responsible

1.1 Controller. The controller within the meaning of Article 4(7) of the General Data Protection Regulation (GDPR) is PRIME ORGANIC OÜ, Ehitajate tee 110, 13517 Tallinn, Estonia, registry code 16974721, email team@amazi.ai.

1.2 Two different roles. We handle personal data in two capacities, and which one applies changes who you should talk to.

1.3 Getting in touch. For anything concerning this policy or your rights, write to team@amazi.ai.

02Legal bases

Depending on the processing, we rely on one of the following. We name the relevant one in each section below.

• Article 6(1)(a) — your consent, which you can withdraw at any time with effect for the future.
• Article 6(1)(b) — performing a contract with you, or taking steps at your request before entering into one.
• Article 6(1)(c) — complying with a legal obligation, for instance under accounting and tax law.
• Article 6(1)(f) — our legitimate interests, where your rights and freedoms do not override them.

03When you visit the website

3.1 Server logs. Every request our servers answer is logged: IP address, date and time, the page requested, the HTTP status, the volume of data transferred, the referring page, and your browser, operating system and language. We use this to deliver the site and keep it stable and secure — a legitimate interest under Article 6(1)(f). Logs are deleted on a short rolling cycle.

3.2 Hosting and delivery. The website and the Platform run on cloud infrastructure, and static files are delivered over a content delivery network. These providers act as our processors under Article 28 GDPR contracts. Our legitimate interest is providing a reliable, fast service — Article 6(1)(f).

3.3 Fonts and icons. Pages on this site load typefaces from Google Fonts and integration logos from the Iconify API. Your browser fetches those files directly from those services, which means your IP address and basic request data reach them. Our legitimate interest is presenting the site consistently — Article 6(1)(f).

3.4 Cookies and similar storage. We keep browser storage to what the site actually needs. Storage that is strictly necessary to deliver a function you asked for is used on that basis. Anything beyond that — analytics or advertising in particular — is used only with your consent, which you can give, refuse and change at any time.

3.5 Demo requests and other enquiries. When you submit the demo form or email us, we process what you give us — first name, company email address and the content of your message — in order to reply and, where relevant, to prepare a possible contract. Legal bases: Article 6(1)(b) for steps taken at your request before a contract, and otherwise our legitimate interest in answering enquiries addressed to us, Article 6(1)(f). We delete enquiries once they are no longer needed, unless a retention obligation applies.

04When you have an account

4.1 Account data. To open and run your account we process your email address, authentication data, your plan and credit balance, and the settings and applications you create. Legal basis: performance of the contract, Article 6(1)(b).

4.2 Usage data. We record how the Platform is used — sign-ins, actions taken, features used, credits consumed and technical events — to operate the service, bill correctly, detect and prevent abuse, and improve the product. Legal bases: Article 6(1)(b) and our legitimate interest in a secure service that gets better over time, Article 6(1)(f).

4.3 Billing. Payments are handled by a payment service provider. We receive and store what accounting requires — name, billing address, VAT number, invoices and transaction records. Full card details are handled by the payment provider and are not stored by us. Legal bases: Article 6(1)(b) and Article 6(1)(c). Accounting records are kept for seven years, as Estonian law requires.

4.4 AI features. When you use a feature that calls an AI model, the instructions and the context you supply are transmitted to the model provider so that a result can be returned to you. We engage those providers as processors, on terms limited to processing the content in order to return your result. Data reaches a provider only when you use a feature that calls one. Legal basis: performance of the contract, Article 6(1)(b).

4.5 Support. If you contact support, we process your message and the account context needed to resolve it. Legal basis: Article 6(1)(b), and Article 6(1)(f) where the request is not about an existing contract.

05Marketing

5.1 Newsletter. If you subscribe, we use your email address to send product news. Legal basis: consent, Article 6(1)(a). Every message carries an unsubscribe link; withdrawing costs nothing and takes effect for the future, without affecting what was lawful beforehand.

5.2 Email to existing customers. We may tell existing customers about services similar to those they already use, on the basis of our legitimate interest in direct marketing, Article 6(1)(f) and recital 47. You can object at any time, at no cost beyond your own transmission charges.

5.3 Measurement. We measure whether our emails are opened and which links are followed, so that we send fewer and better ones. Where consent is required for that measurement, we ask for it together with the subscription.

06Who receives data

Within our company, access is limited to people who need it for their work. Outside it, we use service providers who process personal data on our behalf under Article 28 GDPR contracts, in the following categories:

We also disclose data where we are legally obliged to — to public authorities — and to professional advisers and auditors bound by confidentiality. We do not sell personal data. The current list of our processors is available on request from team@amazi.ai.

07Transfers outside the EEA

We prefer providers inside the European Union. Where personal data is transferred to a country outside the European Economic Area, we rely on an adequacy decision of the European Commission under Article 45 GDPR where one exists for that country or framework. Otherwise the transfer is based on the Commission’s standard contractual clauses under Article 46(2)(c), together with any additional technical and organisational safeguards the situation requires. You can ask us for a copy of the safeguards that apply to a particular transfer.

08How long we keep data

We keep personal data only as long as it is needed for the purpose it was collected for, and then delete it. Where deletion conflicts with a retention obligation, we restrict processing instead: the data is blocked and used for nothing else. In practice:

• Account data — for as long as the account exists, and 30 days after it closes.
• Accounting records — seven years, as required by Estonian law.
• Enquiries and support requests — until the matter is dealt with and any follow-up period has passed.
• Server logs — a short rolling cycle.
• Newsletter data — until you unsubscribe.

09Your rights

In relation to your personal data you have the right to:

• ask whether we process it and receive a copy — Article 15;
• have inaccurate data corrected — Article 16;
• have data erased — Article 17;
• have processing restricted — Article 18;
• receive your data in a portable format and have it transmitted onward — Article 20;
• object to processing based on legitimate interests, and to object at any time to direct marketing — Article 21;
• withdraw consent at any time, without affecting the lawfulness of what came before — Article 7(3).

Write to team@amazi.ai. We respond within one month and tell you if we need longer, which the GDPR allows in complex cases.

You can also complain to a supervisory authority. In Estonia that is the Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, info@aki.ee. You may also complain to the authority in the country where you live or work.

10Whether you must provide data

To enter into and perform a contract with us you have to give us the data that contract needs — an email address, and billing details for a paid plan. Without it we cannot open an account or provide the Platform. Anything else is voluntary, and where data is required we mark it as such.

11Automated decision-making

We do not take decisions about you that produce legal effects or similarly significantly affect you by automated means within the meaning of Article 22 GDPR. The Platform’s AI features generate applications, content and automations on your instruction; they do not make decisions about you. If that ever changes, we will inform you separately where the law requires it.

12Security

We apply technical and organisational measures appropriate to the risk: encryption of data in transit, access control on a need-to-know basis, separation between customer environments, logging of access, and regular review of the measures we have in place. No system is perfectly secure, but where a personal data breach occurs we act on it and notify the supervisory authority, and where required those affected, as Articles 33 and 34 GDPR provide.

13Changes to this policy

We update this policy when our processing changes or the law requires it. The current version is always at this address, with the date of the last update at the top. Where a change materially affects account holders, we announce it by email before it takes effect.

§Company details