Privacy Policy

• An account needs only your email address. There are no passwords: you sign in with a 6-digit code we email you.
• A license is tied to one computer. To do that we store an identifier and the name of the computer you activate it on.
• Analytics cookies are used only if you accept them.
• Account data is stored in the EU. We do not sell personal data or use it for advertising.
• You can delete your account yourself on your account page.

Our hosting provider records technical data for every request: IP address, browser and device type, the page requested and the time. We use it to deliver the site, keep it secure and find faults.

Legal basis: our legitimate interest in running a secure website (GDPR article 6(1)(f)). These logs are kept for a short period by the hosting provider and then deleted.

If you click Accept in the cookie banner, we load Google Analytics. It collects the pages you view, how you arrived, your approximate location (country or city, from your IP address), and your device, browser and screen size. We use it only to understand how the site is used and to improve it. If you decline or do not choose, Google Analytics is not loaded at all.

Legal basis: your consent (article 6(1)(a)). You can change your choice at any time with Cookie settings at the bottom of every page; withdrawing removes the analytics cookies. Google keeps analytics data for at most 14 months.

When you create an account or sign in, we process:

• your email address, which identifies the account and receives sign-in codes and account notices;
• one-time sign-in codes, which work once and expire after a short time;
• when the account was created and when you last signed in;
• sign-in sessions: a cookie in your browser, which keeps you signed in until you sign out, and in the desktop app an entry in Windows Credential Manager, which lasts one month, then you sign in again;
• security logs of sign-in requests, including IP address and browser, kept by our authentication provider for a short period to detect and stop abuse.

Legal basis: providing the account and licenses you asked for (article 6(1)(b)), and for the security logs our legitimate interest in protecting accounts (article 6(1)(f)).

When you ask for a sign-in code, on this website or in the desktop app, Cloudflare Turnstile checks that the request comes from a person and not a bot, so nobody can use our service to flood inboxes. For this Cloudflare processes your IP address and technical signals from your browser, such as its user agent and connection fingerprint. Usually you see nothing; sometimes you are asked to tick a box. The check loads only on the sign-in form and in the desktop app's security check window, not on the rest of the site.

Legal basis: our legitimate interest in protecting accounts and our email sending from abuse (article 6(1)(f)). Cloudflare does this for us as a processor, and also uses the signals as an independent controller to improve its bot detection, as described in Cloudflare's Turnstile privacy addendum.

An account can hold a one-month free trial license and Pro licenses. For each license we store its type, status and dates (requested, activated, and for a trial when it ends).

A license works on one computer. When you activate it in the desktop app, we store a computer identifier (the Windows machine ID, or a random ID the app saves when that is not available), the computer name as shown in Windows, the activation date, and the last time the app checked in (when it starts and once a day while it runs). We use this to keep each license on its computer and to show you where your licenses are in use.

Legal basis: providing the licenses under our terms (article 6(1)(b)).

To stop the free trial from being used again and again, we keep a one-way hash (SHA-256) of the email address that requested a trial and of the identifier of the computer it was activated on. These hashes are kept even after the account is deleted, for as long as we offer free trials. A hash cannot be turned back into the address, but it can be matched against an address someone already knows, so we treat it as personal data.

Legal basis: our legitimate interest in preventing abuse of free trials (article 6(1)(f)).

If you write to us, we use your name, email address, company and message to answer and follow up. Legal basis: our legitimate interest in replying, or steps before a contract you ask for (article 6(1)(b) and (f)). We keep the conversation as long as needed for it and any follow-up, normally no longer than two years after our last contact.

We use these providers, each bound by a data processing agreement:

• Supabase: account database and sign-in, hosted in the EU.
• Resend: sends sign-in codes and account notices from noreply@airinspectionautomation.com.
• Vercel: hosts this website.
• Cloudflare: Turnstile bot check when you ask for a sign-in code.
• Google: Google Analytics, only if you accept analytics cookies.

Some of these companies are based in the United States and may access data from there. Such transfers are protected by the EU-US Data Privacy Framework where the provider is certified, or by the European Commission's standard contractual clauses. We do not sell personal data and do not share it for advertising. We disclose data to authorities only when the law requires it.

• Your account and licenses: until you delete the account.
• An address that asks for a code but never enters it: removed after 7 days.
• Unused accounts: an account without a Pro license that nobody has used for 24 months gets a warning email. If it is still unused 30 days later, it is deleted with its licenses.
• Sign-in codes: until used or expired. Sessions: on this website until you sign out, in the desktop app one month.
• Trial hashes: as long as we offer free trials (see above).
• Records we must keep for bookkeeping, such as invoices for Pro licenses: as Swedish law requires, currently seven years.

Under the GDPR you can ask us to:

• give you a copy of your personal data, and receive account data in a portable format;
• correct inaccurate data, such as a changed email address;
• delete your data. You can delete your account yourself on your account page; an account with a Pro license is deleted by us on request, so a paid license is not lost by mistake;
• restrict processing, or object to processing based on our legitimate interests;
• withdraw consent to analytics at any time with Cookie settings.

Email hello@airinspectionautomation.com and we answer within one month. If you think we handle your data wrongly, you can complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) at imy.se, or to the authority where you live or work.

There are no passwords to steal: sign-in uses one-time codes, and a bot check guards every request for a code. Sessions on this website are kept in cookies that page scripts cannot read. All traffic is encrypted, and access to account data is limited to what each part of the service needs.

We make no decisions about you based solely on automated processing that have legal or similarly significant effects. AiA is a professional tool and is not meant for children.

If we change this policy, we update the date at the top. If a change affects how we use your account data, we tell account holders by email before it applies.