DomintAI — Privacy Policy
Version: 1.2 Effective from: 2026-08-14 Controller: DomintAI Oy, Business ID 3618399-6, registered address c/o Bing Li, Uitontie 2 C, 79810 Karvion kanava, Finland Contact: info@domintai.com
This notice explains how DomintAI Oy ("DomintAI", "we") processes personal data about the people who use our platform, and what rights you have. It is given under Articles 13 and 14 of the General Data Protection Regulation (EU) 2016/679 ("GDPR").
Personal data inside a database or design material you upload is different: for that content you are the controller and we act only as your processor. See section 8.
1. What we process, why, on what legal basis, and for how long
| Data | Purpose | Legal basis | Retention | |---|---|---|---| | Account data: name, email address, authentication credentials or the identifier of the third-party sign-in you chose, account status and role, organisation membership | Creating and operating your account, authenticating you, answering your requests | Contract, Art. 6(1)(b) | While the account exists, and for a limited period afterwards where needed to close it out | | Sign-in and security records, including technical identifiers such as IP address and browser type | Protecting accounts, detecting and investigating unauthorised access and abuse | Legitimate interests, Art. 6(1)(f), in the security of the service | A limited period proportionate to the security purpose | | Organisation and identity-verification data you submit when applying for evaluation rights | Confirming that the organisation and the person signing for it are genuine | Contract, Art. 6(1)(b); legitimate interests in preventing misuse; legal obligation where one applies | As long as needed to make and evidence the verification decision | | Billing data: name, email address, billing address, VAT identifier, transaction records | Taking payment, invoicing, accounting | Contract, Art. 6(1)(b); legal obligation, Art. 6(1)(c), for accounting records | For the period required by applicable accounting and tax law | | Legal-document acceptances: which version of which document you accepted, and when | Evidencing the agreement that permits your account, an upload or an order | Contract, Art. 6(1)(b), where the document is contractual; legitimate interests, Art. 6(1)(f), in proving which notice and terms were presented and accepted | As long as the agreement may need to be evidenced, including any applicable limitation period | | Contract, entitlement, licence and order records | Performing the contract, issuing and administering licences and entitlements, handling your orders | Contract, Art. 6(1)(b); legal obligation, Art. 6(1)(c), for accounting records | For the term of the entitlement, then the period required by law or needed to evidence an issued licence | | Correspondence you send us | Answering you and keeping a record of what was agreed | Contract; legitimate interests | While needed to handle the matter and any follow-up | | Your marketing-email preference, with the time you opted in and, if you withdraw, the time you withdrew | Sending you product news by email, and being able to show which choice you made | Consent, Art. 6(1)(a). This is optional and is not required to use the service | Until you withdraw. The record of the opt-in and of the withdrawal is kept afterwards so the choice stays provable | | Your cookie choice | Remembering and respecting the choice you made about cookies | Legitimate interests, Art. 6(1)(f), in remembering and respecting that choice. If optional cookies are ever used, storing them will rest on your consent, Art. 6(1)(a) | 183 days, or until you change your choice — see the Cookie Policy |
Where a retention period is expressed as a criterion rather than a fixed number, it is because the period depends on the account, the order or the legal obligation involved. We do not keep personal data longer than the stated purpose requires.
2. Where the data comes from
From you, from your use of the service, and — where you sign in with a third-party provider — the account identifier that provider returns to us. Where a colleague adds you to an organisation, your name and email address may come from them.
3. What you must provide, and what happens if you do not
- Name, email address and authentication credentials are necessary to have an account. Without them we cannot create or operate one.
- Organisation and verification data is necessary only if you apply for evaluation rights. Without it we cannot grant them.
- Billing data is necessary only for a paid order. Without it we cannot invoice or take payment.
- Marketing email is optional. Not consenting has no effect on your account or on any feature.
Anything else you tell us is optional, and not providing it only limits the feature it relates to.
4. Who receives the data
We use service providers who process personal data only on our instructions and under a data-protection agreement:
- infrastructure and hosting providers on which the platform runs;
- payment processing;
- transactional email delivery;
- providers of generative AI model interfaces, for design material submitted for modernization (see section 8).
We also disclose data where the law requires it, or to our professional advisers where necessary to establish or defend a legal claim. We do not sell personal data, and we do not disclose it for advertising.
The categories of provider currently in use are listed in the Sub-processor List (`/legal/sub-processor-list`).
5. Transfers outside the EEA
Where a recipient is outside the European Economic Area, the transfer is made on the basis of a European Commission adequacy decision or the Commission's Standard Contractual Clauses.
6. Your rights
You have the right to ask for access to your personal data, its rectification or erasure, restriction of processing, and portability, and to object to processing based on our legitimate interests. Where processing is based on your consent, you may withdraw that consent at any time; withdrawal does not affect processing already carried out. For marketing email, write to info@domintai.com to withdraw.
Write to info@domintai.com. We reply within the time limits the GDPR sets, and will tell you if we need longer. We may ask for information to confirm who you are — only what is needed for that.
You may lodge a complaint with the Office of the Data Protection Ombudsman in Finland (Tietosuojavaltuutetun toimisto, tietosuoja.fi) or with the supervisory authority in the country where you live or work. Contacting us first is optional and is not a precondition.
7. Automated decision-making
We do not make decisions about you solely by automated means that produce legal effects concerning you or that similarly significantly affect you, and we do not carry out profiling for such purposes.
8. Content you upload
For personal data contained in a database or design material you upload, you are the controller and we process it only on your documented instructions, as your processor. Those terms — including our confidentiality, security, sub-processor, assistance, return and deletion obligations — are set out in the Data Processing Terms (`/legal/data-processing-terms`), which also require you to remove personal data from material before you upload it.
9. Cookies
See the Cookie Policy (`/legal/cookie-policy`).
10. Changes to this notice
We may publish a new version. Each version is published with its own version number and effective date. Where a change materially affects you, we give notice before it takes effect.
© 2026 DomintAI Oy. All rights reserved.