Privacy Policy

Effective Date: March 2026 · Last updated: July 2026

1. Introduction

Welcome to WhAiT OÜ ("we," "our," or "us"). We respect your privacy and are committed to protecting your personal data in accordance with the General Data Protection Regulation (EU 2016/679) ("GDPR"). This Privacy Policy explains what information we collect through our website whait.ee, how we use it, and what rights you have as a visitor.

2. Data Controller

WhAiT OÜ
Registry code: 17400927
Address: Pae tn 21, Lasnamäe linnaosa, 11415 Tallinn, Harju maakond, Estonia
Email: info@whait.ee

This company acts as the data controller for all personal data processed through this website.

3. What Data We Collect

We collect the following data when you interact with our website and services:

Email address — when you use the AI quiz, chatbot, or contact form
Chat transcripts — messages exchanged with our AI chatbot
Quiz responses — answers to the AI Readiness Assessment
Contact details — name and phone number, if voluntarily provided
Technical data — IP address, browser user agent, language preference

Additionally, our hosting provider may automatically log minimal technical information for security and server functionality.

We do not use cookies or any third-party tracking technologies.

4. Purpose and Legal Basis of Processing

We process your personal data for the following purposes:

To provide personalized AI readiness assessments and recommendations
To respond to your inquiry submitted through the chatbot or contact form
To maintain communication records in case of follow-up or project discussions
To improve our services and chatbot quality
To send a summary of your chat conversation to your email
To ensure the security and proper functioning of our website

Legal basis under GDPR:

Article 6(1)(a) — consent (when you submit your email or start a chat)
Article 6(1)(b) — performance of pre-contractual steps, when you contact us to request our services
Article 6(1)(f) — legitimate interest (website security, analytics without personal identification)

We do not sell your data to third parties. We do not use your data for advertising.

5. Data Retention

We retain your data for as long as necessary to provide our services:

Chat transcripts: 12 months, then automatically deleted
Email addresses: until you request removal
Quiz results: 12 months
Server logs: automatically deleted after 90 days

6. Data Recipients and Transfers

Your data may be processed by trusted third parties strictly for hosting and technical support:

OVH — EU-based hosting provider (France)
Migadu — EU-based email provider
Google Fonts — for typography (Google's privacy policy applies; IP address may be transmitted)
DeepSeek API — primary AI model for chat responses (conversation context only; email addresses, phone numbers and card numbers are automatically masked before sending). DeepSeek is based outside the EEA (China); transfers are governed by Standard Contractual Clauses (SCCs) with supplementary measures documented in our Transfer Impact Assessment.
Moonshot AI (Kimi) — fallback AI model, used only if the primary model is unavailable. Receives the same masked conversation context; based outside the EEA, SCCs with supplementary measures apply.
OpenAI — voice message transcription (Whisper) and secondary AI fallback. OpenAI participates in the EU-US Data Privacy Framework.
Telegram — internal notifications to our sales team about new inquiries (contact details and a summary of the conversation you provided in the chat).

For transfers to providers outside the EEA we rely on Standard Contractual Clauses and have carried out a Transfer Impact Assessment, applying supplementary measures such as automatic masking of direct identifiers before any data leaves our server. We do not sell, rent, or share your data with third parties for marketing.

7. Local Storage

We use browser localStorage (not cookies) for:

wcw_client — your chat session ID (to restore conversation if you return)
wcw_sound — your sound preference for the chatbot
whait_lang — your language preference

This data stays in your browser and is not transmitted to our servers. You can clear it at any time via browser settings.

8. Your Rights under GDPR

Under GDPR, you have the right to access, correct, delete, or export your personal data at any time. To exercise these rights, email us at info@whait.ee.

Right of access — request a copy of all data we hold about you
Right to rectification — correct inaccurate data
Right to erasure — request deletion of your data ("right to be forgotten")
Right to restriction of processing — limit how we use your data
Right to data portability — receive your data in a structured format
Right to object — object to processing of your data
Right to withdraw consent — withdraw your consent at any time without affecting the lawfulness of prior processing

We will respond to all requests without undue delay and within one month. This period may be extended by two months for complex requests.

If you believe your data has been mishandled, you may lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) — aki.ee.

9. Children's Privacy

Our website is intended for business use and is not directed at children under 16 years old. We do not knowingly collect or process children's data.

10. Data Security

We apply appropriate organizational and technical measures to protect data against unauthorized access, alteration, loss, or destruction. This includes encrypted connections (HTTPS), secured hosting, and access control within our infrastructure.

11. Updates to This Policy

We may update this Privacy Policy from time to time to reflect changes in law or website functionality. The latest version will always be available on this page.

Contact

WhAiT OÜ
Registry code: 17400927
Pae tn 21, Lasnamäe linnaosa, 11415 Tallinn, Estonia
Email: info@whait.ee