Effective Date: [17.08.2026] Last Updated: [17.08.2026]
1. About This Policy
This Privacy Policy explains how we handle personal data in connection with the AICI platform at www.aici.com.ua (the "Platform" or "Services").
Who we are
| Legal name | Craft Innovations R&D Inc |
| Address | 1001-45 Southport Str, Toronto, Ontario, Canada, M6S 3N5 |
| General contact | support@aici.com.ua |
| Privacy contact | privacy@aici.com.ua |
This is a notice, not a contract. It does not replace the [Terms of Use] or the [Data Processing Agreement], and it does not ask you to consent to processing that we carry out on another legal basis.
2. The Two Different Roles We Play — Please Read This First
AICI handles two very different categories of personal data, and your rights differ depending on which one is involved.
2.1 Data we control (this Policy applies in full)
When you register for an account, pay for a subscription, contact support, or simply use the Platform, we act as a controller of your personal data: we decide what we collect and why. Sections 3 to 15 describe that processing.
2.2 Research data our customers control (we act only as a processor)
Our customers are research teams. They upload interview recordings, usability-test sessions, transcripts and notes ("Research Data"). That material frequently contains personal data about research participants — the people who were interviewed.
For Research Data, we act only as a processor. The research organisation that uploaded the material is the controller: it decided to record the interview, chose the participants, determined the purpose, and controls how long the material is kept.
This means:
- we do not decide what happens to Research Data and cannot lawfully use it for our own purposes;
- we do not use Research Data to train AI models (see Section 8);
- if you are a research participant and want to access, correct or delete what was recorded about you, you need to contact the organisation that interviewed you, not us. We usually cannot identify which recording relates to you without their help;
- if you contact us anyway, we will forward your request to the relevant customer and tell you that we have done so.
Our obligations to customers for Research Data are set out in the [Data Processing Agreement].
2.3 If you were interviewed and do not know who holds your data
Contact us at privacy@aici.com.ua with whatever details you have (the organisation that interviewed you, the approximate date, the project name). We will make reasonable efforts to identify the customer and pass your request on. We cannot decide the outcome of that request ourselves.
3. Personal Data We Collect as Controller
| Category | What it includes | Where it comes from |
|---|---|---|
| Account data | Name, e-mail address, password (hashed), workspace name, role within the workspace, [job title, organisation, phone number] | You, or the workspace administrator who invited you |
| Authentication data | Login and logout events, multi-factor authentication status, password change events, session identifiers | Automatically |
| Billing data | Subscription plan, transaction history, billing contact, partial card details and payment status | You and our payment processor. We never receive or store your full card number |
| Usage data | IP address, browser and device type, operating system, pages visited, timestamps, feature usage, file durations and sizes, error and diagnostic events | Automatically |
| Security audit data | Role changes, sharing actions, project deletions, export and erasure actions, and every access by our personnel to customer data | Automatically |
| Support data | The content of your messages to us and our replies | You |
| Integration credentials | Access tokens for services you choose to connect (e.g. Zoom, Google Meet), stored encrypted | You, at the point of connection |
| Marketing preferences | Whether you have subscribed to or unsubscribed from our communications | You |
We do not collect special category data (health, religion, political opinions, biometric data used for identification) about our users, and we ask you not to send it to us.
4. Why We Process It, and on What Legal Basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Creating and administering your account; providing the Platform | Performance of a contract, Art. 6(1)(b) |
| Processing payments and maintaining accounting records | Contract, Art. 6(1)(b); legal obligation, Art. 6(1)(c) |
| Responding to support requests | Contract, Art. 6(1)(b); legitimate interests, Art. 6(1)(f) |
| Keeping the Platform secure, detecting abuse, maintaining audit logs, investigating incidents | Legitimate interests in the security of our service and our customers' data, Art. 6(1)(f); legal obligation, Art. 6(1)(c) |
| Diagnosing errors and maintaining reliability | Legitimate interests, Art. 6(1)(f) |
| Understanding aggregate feature usage in order to improve the Platform | Legitimate interests, Art. 6(1)(f) |
| Sending service and security notifications you cannot opt out of while you hold an account | Contract, Art. 6(1)(b) |
| Sending product and marketing e-mail | Consent, Art. 6(1)(a), or legitimate interests for existing customers where permitted by local law — with an unsubscribe link in every message |
| Complying with legal obligations and responding to lawful requests from authorities | Legal obligation, Art. 6(1)(c) |
| Establishing, exercising or defending legal claims | Legitimate interests, Art. 6(1)(f) |
| Evaluating or completing a merger, financing or sale of the business | Legitimate interests, Art. 6(1)(f) |
Where we rely on legitimate interests, we have assessed that our interest does not override your rights, and you may object at any time (Section 12).
What we do not do. We do not sell personal data. We do not share it with third parties for their own marketing. We do not use behavioural advertising, and we do not build profiles about you for advertising purposes.
5. Cookies and Similar Technologies
We use a deliberately small set of cookies and local storage:
| Type | Purpose | Consent required |
|---|---|---|
| Strictly necessary | Keeping you logged in, maintaining your session, security and abuse prevention, remembering your workspace | No — these are essential to provide the Service you requested |
| Preferences | Remembering interface settings such as language or layout | No, where limited to settings you have chosen |
We do not use advertising cookies, third-party tracking pixels, or third-party analytics services such as Google Analytics, Sentry or PostHog. Application errors are recorded in our own database in the European Union.
Because we do not set non-essential cookies, we do not display a consent banner for them. You can clear cookies through your browser, though this will log you out.
6. How Personal Data Is Shared
We share personal data only with the categories of recipient below. Each service provider processes data on our instructions under a written data processing agreement, and none of them is permitted to use it for their own purposes.
| Recipient category | Who | What they receive |
|---|---|---|
| Infrastructure | Lovable AB (Sweden) and Supabase Inc. — hosting, database, storage, authentication, hosted in the European Union (Frankfurt) | All Platform data |
| AI processing | AI gateway operated by our infrastructure provider; ElevenLabs (speech recognition, processed in the EEA); Google Gemini and OpenAI (text analysis) | Research Data submitted for processing — see Section 8 |
| Video rendering | Shotstack Pty Ltd, Australia - only if you use the video showcase feature | Video clips selected for rendering |
| Payments | Stripe, Inc. | Billing data. Card details go directly to the processor |
| Transactional e-mail | Resend, Inc. | Your e-mail address and message content |
| Integrations you connect | Zoom, Google Workspace/Meet | Only what is needed to retrieve recordings you ask us to import |
| Professional advisers | Lawyers, accountants, auditors | Only as necessary and under confidentiality |
| Authorities | Courts, regulators, law enforcement | Only where legally required — see Section 6.1 |
| Acquirers | A buyer or investor in a corporate transaction | Under confidentiality; we will notify you before your data becomes subject to a different policy |
A current list of our service providers, with locations and transfer mechanisms, is maintained at aici.com.ua/subprocessors.
6.1 Requests from authorities
We disclose personal data to public authorities only where we are legally required to do so. Where lawful, we notify the affected customer, we challenge requests that appear unlawful or overbroad, and we disclose the minimum amount of data required.
6.2 Workspace visibility
If you join a customer's workspace, be aware that the workspace administrator can see your account details, your activity within the workspace, and any content you create there, and can remove your access or delete that content. If your employer administers the workspace, its own privacy notice also applies to you.
7. International Transfers
Personal data is stored in the European Union (Frankfurt, Germany), and audio and video recordings are transcribed within the European Economic Area.
Some processing takes place outside the EEA:
- Canada — we are established in Canada and our personnel access the Platform from there. The European Commission has recognised Canada as providing an adequate level of protection for data transferred to organisations subject to PIPEDA (Decision 2002/2/EC), and we are subject to PIPEDA.
- United States — text-based AI analysis, transactional e-mail, payments, integrations you connect, and administrative or support access by our providers' US parent entities. These transfers rely on the European Commission's Standard Contractual Clauses (Decision 2021/914) or, where the provider is certified, the EU–US Data Privacy Framework.
- Australia — video rendering, if you use the video showcase feature, under Standard Contractual Clauses.
We do not rely on your consent as the basis for these transfers, and using our Services is not treated as consent to them. You may request a copy of the relevant safeguards by writing to privacy@aici.com.ua.
8. Artificial Intelligence
The Platform uses AI to transcribe recordings, identify speakers, translate, summarise, code material thematically, apply sentiment labels and draft research deliverables. All AI requests are routed through an AI gateway operated by our infrastructure provider to the model providers listed in Section 6.
8.1 We do not train models on your data. We do not use your content to train models. AI requests are carried out via the providers’ APIs (Google Gemini paid tier, OpenAI API, ElevenLabs), the terms of which prohibit the use of customer data for model training. OpenAI retains data for up to 30 days for the purpose of monitoring abuse.
8.2 Retention by AI providers. No-training and no-retention are separate things, so to be precise:
- the AI gateway does not store request or response content;
- ElevenLabs processes audio in the EEA and does not use it for training.
- Google (Gemini) does not use content sent through the paid API for training;
- OpenAI does not use API content for training but may retain it for up to 30 days for abuse monitoring, after which it is deleted.
8.3 Sentiment analysis. Sentiment labels are derived from the text of transcripts only — from the words spoken. We do not analyse voice tone, facial expression or any other biometric characteristic, we do not operate an emotion recognition system within the meaning of the EU AI Act, and we do not permit our Services to be used to infer the emotions of people at work or in education.
8.4 No synthetic voice. We do not generate synthetic speech, clone voices, or identify anyone by their voice.
8.5 AI output is not reliable on its own. Transcripts, translations, summaries, thematic codes and sentiment labels are produced by statistical models and are often wrong — particularly with irony, accents, overlapping speech, specialist vocabulary and translated material. They must be reviewed by a human and must never be used as evidence about an individual.
8.6 No automated decisions about you. We do not make decisions about you by automated means that produce legal effects or similarly significantly affect you (Art. 22 GDPR).
9. How Long We Keep Data
| Data | Retention period |
|---|---|
| Account data | For as long as your account is active, then deleted within 30 days |
| Research Data | As configured by the customer. On termination, a 30-day retrieval window, then deletion from production within 30 days and from backups within 7 days (rolling point-in-time-recovery window) |
| Security audit log | 24 months, then purged automatically |
| Usage and error data | 12 months |
| Billing and accounting records | 6 years, as required by Canadian tax law and up to 10 years where required by an EU member state |
| Support correspondence | 12 months after the matter is closed |
| Marketing preferences | Until you unsubscribe, plus a record of the unsubscribe so we do not contact you again |
| Data retained for legal claims | Until the relevant limitation period expires |
10. Security
We protect personal data with measures including: TLS 1.2+ for all connections; AES-256 encryption at rest; additional application-layer encryption of integration tokens; role-based access control with database-level tenant isolation; least-privilege architecture where privileged credentials are confined to server-side functions; multi-factor authentication, mandatory for administrative access; an immutable audit log retained for 24 months; hourly automated anomaly detection; encrypted backups with 7-day point-in-time recovery; peer code review; and automated dependency and secret scanning in our development pipeline.
A fuller description is in Annex B of our [Data Processing Agreement]. No system is completely secure, and we cannot guarantee absolute security. If a breach affects your personal data and is likely to result in a high risk to your rights, we will notify you and the competent authority as required by law.
11. Children
The Services are for business use by people aged 18 or over. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, contact privacy@aici.com.ua and we will delete it.
Customers must not upload research material involving children without an appropriate legal basis, as set out in the [Data Processing Agreement].
12. Your Rights
12.1 If the GDPR or UK GDPR applies to you
You have the right to: access your data and receive a copy; rectify inaccurate data; erase data ("right to be forgotten"); restrict processing; object to processing based on legitimate interests, and to direct marketing at any time and without justification; data portability for data you provided, where processing is based on consent or contract; and withdraw consent at any time, without affecting processing already carried out.
You may exercise these rights at privacy@aici.com.ua. We respond within one month, extendable by two further months for complex requests, and we will tell you if we need the extension. We may ask you to verify your identity. Exercising your rights is free unless a request is manifestly unfounded or excessive.
You also have the right to lodge a complaint with a supervisory authority — in the EU, the authority in your country of residence or work; in the UK, the Information Commissioner's Office. Our EU representative under Art. 27 GDPR is listed in Section 1.
Note the limits of what we can do. For Research Data, we act as processor. If your request concerns an interview you took part in, please read Section 2.2.
12.2 If you are in Canada
Under PIPEDA you may request access to your personal information and challenge its accuracy, and you may complain to the Office of the Privacy Commissioner of Canada. Where we rely on consent, you may withdraw it, subject to legal and contractual restrictions.
12.3 If you are in Ukraine
Under the Law of Ukraine "On Personal Data Protection" you have rights of access, rectification and erasure, and you may complain to the Ukrainian Parliament Commissioner for Human Rights.
12.4 If you are in a US state with a comprehensive privacy law
[If you serve US consumers, add rights of access, deletion, correction, portability, and opt-out of sale/sharing/targeted advertising, plus a statement that you do not sell or share personal information and do not engage in targeted advertising, and an appeals process. Confirm whether any US state law applies to you before publishing this section — see Annex A.]
12.5 Marketing
Every marketing e-mail contains an unsubscribe link. You can also write to [privacy@aici.com.ua]. Service and security messages continue while you hold an account, because we need them to operate the Platform.
13. Links to Other Sites
The Platform may link to sites we do not operate. We are not responsible for their content or privacy practices, and we recommend reading their policies.
14. Changes to This Policy
We may update this Policy. If a change materially affects how we handle your personal data, we will notify you by e-mail or in-product notice at least [30] days before it takes effect, and update the "Last Updated" date.
15. Contact
Privacy questions and rights requests: [privacy@aici.com.ua] General enquiries: support@aici.com.ua Post: Craft Innovations R&D Inc, 1001-45 Southport Str, Toronto, Ontario, Canada, M6S 3N5