Privacy Policy

1. Controller

Hiiu AI Studio OÜ (registry code 17588629), Nõmme tee 1, Käina, 92101 Hiiumaa, Estonia, is controller for trial registration, the customer relationship, its websites and Studio’s own usage data. Privacy requests: info@hiiustudio.ee.

For personal data placed in a Client workspace, the Client is controller and Hiiu AI Studio OÜ is processor under the data-processing section of the Terms.

2. People concerned

• trial registrants, Client representatives and Users;
• business leads and contacts who approach us;
• employees, customers, suppliers and contacts placed in a Client workspace;
• website and Service visitors represented in technical logs.

3. Data we collect

Passwords are not stored in readable form; only a secure one-way hash is kept.

• account and contact data: email, name, role, organisation and sign-in security identifiers;
• company data: name, website, registry data, description, size, goals and selected configuration;
• acceptance evidence: policy versions, acceptance time, pseudonymised IP identifier and browser user-agent information;
• referral data: the referring company's workspace identifier and the attribution, paid-conversion and licence-credit status;
• usage data: sign-ins, activity logs, feature use, technical AI metadata, tokens and spend;
• Client Content: contacts, leads, email, documents, projects, tasks, invoices, notes, approvals and connected integration data;
• technical and security data: IP address, timestamp, browser/device details, errors, abuse prevention and security events;
• public information from a selected company website and Estonian business-register sources.

4. Purposes and legal bases

Essential service messages cannot be disabled while using the Service. Marketing follow-up can be stopped at any time via info@hiiustudio.ee.

• contract steps and performance: registration, email verification, provisioning, support, secure sign-in and trial lifecycle messages;
• legitimate interests: B2B relationship management, relevant follow-up, security, fraud and abuse prevention, debugging and aggregated service analysis;
• contract performance and legitimate interests: referral attribution, abuse checks and accounting for earned licence credit;
• legal obligations: accounting, lawful authority requests and establishment or defence of legal claims;
• consent: only where separately and voluntarily requested, such as optional marketing or a specific integration; consent can be withdrawn for the future.

5. Sources

Data comes from you and your organisation, Service use, connected integrations, the public company website and public Estonian business-register sources. A Client adding other people’s data is responsible for lawful collection and notice.

6. AI processing

Studio OS sends the portion of a request and context needed for a task to the configured AI provider and limits data where practicable. AI supports summaries, drafts, recommendations and workflows.

Studio does not make solely automated decisions about a registrant that produce legal or similarly significant effects. Clients must provide necessary human oversight and lawful basis in their own workflows.

7. Recipients and subprocessors

Subprocessors are bound by data-protection duties. A current list and workspace-specific configuration are available from info@hiiustudio.ee.

• European Economic Area server and database infrastructure providers;
• AI providers, principally OpenAI and, where configured, Google;
• Google Workspace or Microsoft 365 where connected by the Client;
• Langfuse technical observability where enabled for a workspace;
• professional advisers and authorities where necessary for legal duties or claims.

8. Transfers outside the EEA

We prefer EEA processing. Where a provider processes data outside the EEA, we rely on an adequacy decision, standard contractual clauses or another GDPR Chapter V safeguard and assess supplementary measures where necessary.

9. Retention

• unverified registrations: normally up to 2 days;
• active trial content: during the trial and up to 7 days after expiry;
• the deleted-trial control record, including acceptance evidence and usage cost: up to 3 years for disputes, abuse prevention and the one-trial rule;
• contract and billing data: through the contract and mandatory statutory period;
• security and application logs: generally up to 12 months, unless needed for an incident or claim;
• Client Content: through the contract, agreed recovery period and limited backup rotation.

10. Security

Measures include workspace isolation, role-based access, one-way password hashing, encrypted transport, restricted administration, audit logs, backup/recovery and security updates. No system is risk-free. We notify Clients and authorities of qualifying incidents as required by law.

11. Your rights

Depending on the legal basis, you may request access, correction, erasure, restriction and portability, object to legitimate-interest processing, and withdraw consent for the future. Contact info@hiiustudio.ee; we may verify identity and normally respond within one month.

Where your employer or another Studio Client controls the data, we may direct the request to that Client and assist it.

12. Complaints

Please first contact info@hiiustudio.ee. You may also complain to the Estonian Data Protection Inspectorate at info@aki.ee or aki.ee and seek a judicial remedy.

13. Cookies and local storage

Trial and application pages use technically necessary local browser storage and session information for sign-in, security, language/theme preferences and trial-flow continuity. The trial registration does not use third-party advertising cookies. Optional analytics or marketing cookies will be subject to separate consent where required.

14. Changes and contact

We may update this Policy when the Service, processing or law changes. We publish the version and effective date and give reasonable advance notice of material changes.

Hiiu AI Studio OÜ · Nõmme tee 1, Käina, 92101 Hiiumaa, Estonia · info@hiiustudio.ee · https://hiiustudio.ee.