DRAFT FOR LEGAL REVIEW — not final
This is a working draft prepared from AIMER's verified data inventory and current production implementation. It is provided for legal review, is not legal advice, and is not yet in force. Qualified legal counsel must review and approve it before it becomes binding.
DRAFT FOR LEGAL REVIEW. This draft describes how AIMER actually collects, uses, shares and protects personal data in the current production build, in line with the EU General Data Protection Regulation (GDPR). It is prepared from AIMER's verified data inventory and is provided for legal review; it is not yet in force.
1. Who we are and our two roles
AIMER provides an AI Employee that businesses configure to serve their own customers. AIMER acts as data controller for its own account, billing and platform data (business accounts, subscriptions, security and audit logs). AIMER acts as data processor for the personal data that business customers process about their end-customers through the service (conversations, bookings and knowledge-base content). The legal entity name, registered address and contact point are to be confirmed at legal review.
2. Data we collect and why
Account data: name, email, hashed password (bcrypt) and role, used for authentication and authorisation. Business/workspace data: business name, plan, settings and knowledge-base content, used to provide the service. Conversation content: messages exchanged with the AI Employee, processed on behalf of the business. Booking and reminder data: contact name/email and booking times, used to send reminders. Integration tokens: Google Calendar OAuth tokens (encrypted at rest with AES-256-GCM), used only when a business connects Google Calendar. Payment data: a Stripe customer reference and transaction records (plan, amount, status) - no card numbers are stored by AIMER. Security and log data: session records, rate-limiting keys, email delivery logs and audit logs, used for security, reliability and compliance. Privacy request records: details of data-subject requests, kept to handle and evidence them.
3. Data we do not collect
AIMER does not store card numbers (payment card data stays with Stripe on its hosted checkout). Website chat-widget visitors are pseudonymous (a visitor identifier only) - no end-customer accounts or passwords are created. AIMER sets no analytics or marketing trackers today. No uploaded binary files (e.g. PDF/OCR) are processed - that feature is marked as coming soon. The public homepage demo chat is stateless and nothing from it is stored.
4. Legal bases for processing
Performance of a contract (providing the service to account holders); legitimate interests (security, fraud and brute-force prevention, service reliability); consent (for optional analytics cookies, a category that exists in our cookie tool but is currently unused); and legal obligations (e.g. bookkeeping for payment records). The final mapping of lawful bases is subject to legal review.
5. AI processing and model providers
AI Employee responses are generated using OpenAI models accessed through the Emergent LLM gateway. Conversation messages and the business's own knowledge-base content are sent to generate answers. Under the providers' API terms, this API data is not used to train their models. Responses are automated and may be inaccurate; a human at the business remains responsible for outcomes, and the AI does not autonomously confirm bookings or take payments. Chat interfaces disclose that users are talking to an AI (EU AI Act transparency).
6. Cookies and similar technologies
AIMER uses only essential cookies and browser storage needed to log you in, remember your language and store your cookie choice. An optional analytics category exists in our cookie tool but is not active today, and we set no advertising trackers. See the Cookie Policy for details and use Cookie Settings in the footer to review your choices at any time.
7. Sharing and sub-processors
We share data only with vetted service providers acting under data processing terms: Emergent (application hosting and database infrastructure), OpenAI via the Emergent LLM gateway (AI responses), Resend (transactional email) and Stripe (subscription billing). Google Calendar is used only when a business connects it. The always-current list is published as our Subprocessor List (/legal/subprocessors).
8. International transfers
Some providers process data in the United States (e.g. OpenAI via Emergent, Resend). Such transfers rely on appropriate safeguards such as EU Standard Contractual Clauses and/or the EU-US Data Privacy Framework. The exact safeguards per provider are being verified and confirmed as part of legal review before commercial launch.
9. Data retention
Retention reflects the actual implementation: password-reset tokens expire after 5 minutes (single use); team invites expire after 7 days; sessions last until expiry or are revoked on password reset/removal; conversations are retained for a period each business configures (off, or an auto-purge window of at least 7 days); payment records are kept as required by bookkeeping law (indicatively 7 years in Sweden, subject to legal review); platform email and audit logs follow the platform retention setting. Deleting an account erases the associated personal data, subject to any legal retention obligations.
10. How we protect data
Data is encrypted in transit (TLS). Passwords are stored only as bcrypt hashes and OAuth tokens are encrypted at rest (AES-256-GCM) and never exported or logged. Each business's data is isolated by tenant, access is role-based (Owner, Admin, Manager, Agent, Viewer), and authentication is protected by rate-limiting and brute-force controls.
11. Your rights
You have the right to access, rectify, erase, restrict and port your data, and to object to certain processing. Account holders can export and delete their data directly in the app under Settings, and a Privacy Request Center is available to handle data-subject requests. Where AIMER acts as processor, requests from end-customers are directed to the relevant business (controller), which AIMER assists.
12. Complaints
Please contact us first so we can help. You also have the right to lodge a complaint with your supervisory authority - in Sweden this is IMY (Integritetsskyddsmyndigheten).
13. Changes to this policy
Material changes are versioned in our internal Legal Version Register and communicated where required. This draft will only take effect once approved through legal review.
14. Contact
A dedicated privacy contact (and, if appointed, a data protection officer) will be published here at launch. Draft contact: hello@getaimer.ai.
For legal and privacy questions during this draft period, contact hello@getaimer.ai. Final contact and data controller details will be published at launch.