Privacy policy

Who processes your data

The controller is ÜLLIMSON OÜ, registry code 16842928, address Põltsamaa tee 32, 71017 Viljandi, Viljandi maakond. Contact: joosep@ullimson.ee, +372 5301 3016.

What we collect and why

• Booking a call: your name, email address, an optional message, the time you chose and your language. We use them only to arrange the call and stay in touch with you. We email you a confirmation with a calendar file. The event in our Google calendar contains only your name, the time and a Google Meet link; your email address and message stay in our database and mailbox.
• Contact form: your name, email address and message. We use them only to reply to your enquiry. Please do not put sensitive data (for example health information) in the form.
• Writing to us directly: if you email or call us, we keep your message and contact details in order to reply.
• AI assistant: you are chatting with an AI, not a person. The question you type is sent to Anthropic to write the answer. We do not store the text of your question. To limit abuse and cost we store a keyed hash of your IP address (not the address itself) and a count of questions.
• Bot check: to protect the contact form, booking and the assistant we use Cloudflare Turnstile. Cloudflare receives your IP address and technical browser data for this.
• Hosting: the site runs on Netlify, which logs technical data (IP address, time, the address requested) so the site works and stays secure.

Cookies and tracking

This site uses no advertising, analytics or tracking cookies, and we collect no visitor statistics. We send no newsletters or marketing messages. The bot check may use technical storage in your browser to tell people from robots.

Legal basis

• Steps taken at your request before entering a contract (GDPR Art. 6(1)(b)): booking, the contact form and replying to your messages.
• Legitimate interest (Art. 6(1)(f)): keeping the site secure, stopping bots and abuse, and limiting the assistant’s costs.
• Legal obligation (Art. 6(1)(c)): if you become a customer, we keep accounting records for the time the law requires.

Who receives your data

We use the following service providers, who act on our instructions:

• Supabase: database (bookings and enquiries), servers in Europe
• Netlify: the site and server functions
• Resend: sending email
• Zoho Mail: our mailbox
• Google: calendar and Meet (name, time, link)
• Cloudflare: bot check
• Anthropic: the AI assistant’s answers

Transfers outside the EEA

Some of these providers are located or process data outside the European Economic Area, for example in the USA. In that case we rely on safeguards such as the EU standard contractual clauses or the EU–US Data Privacy Framework.

How long we keep data

• Bookings and contact-form messages: 24 months, then they are deleted from the database automatically. Within the same period we also delete the matching calendar event and emails from our mailbox.
• Assistant abuse-limit data (hashed IP and counters): 30 days, then deleted automatically.
• Server logs: as long as Netlify keeps them under its terms.
• If you become a customer, accounting records: as long as the law requires.

How we protect data

The database is not publicly accessible: only our server can reach it. Connections are encrypted, the forms are protected by a bot check and request limits, and service keys are kept in a secure vault, not in the site’s code.

Your rights

You have the right to access your data, correct it, have it deleted, restrict or object to its processing, and receive it in a portable form. Write to us at joosep@ullimson.ee. We answer within one month.

If you believe we process your data wrongly, you may complain to the Estonian Data Protection Inspectorate (www.aki.ee, info@aki.ee).

Automated decisions

We make no automated decisions or profiling about you. The AI assistant answers questions but decides nothing about you.