Privacy Policy

This Privacy Policy explains how Lekt Software OÜ ("we", "us", "our") collects, uses, discloses and otherwise processes your personal data when you use Air9, our personal AI workspace available at air9.cloud, and any associated apps and websites that link to this Privacy Policy (together, the "Services").

Lekt Software OÜ, registered in Estonia at Harju maakond, Tallinn, Kesklinna linnaosa, Narva mnt 5, 10117, is the data controller for the personal data described in this Privacy Policy. You can reach us at hello@lekt.ai.

This Privacy Policy also describes your privacy rights. More information about your rights, and how to exercise them, is set out in the "Your rights" section.

1. Personal data we collect

1.1. Personal data you provide to us directly

1.1.1. Account and contact data. When you create an Air9 account we collect your email address, your name or display name, and, if you sign in through a third-party identity provider such as Google, the identifier, name and profile picture that the provider shares with us. You may also add an avatar and personalization details such as your occupation, preferred language and how you would like the assistant to respond.

1.1.2. Payment information. If you purchase a paid plan, credits or storage, our payment processor collects your payment details. We receive only a confirmation of the payment, the last digits of your payment method, your billing country and the transaction identifier. We do not store full card numbers.

1.1.3. Prompts and Outputs. The Services let you send prompts in a variety of forms, including text, files and documents, spreadsheets, voice recordings, photos and images, together with the metadata they contain ("Prompts"), and generate responses, documents, spreadsheets, images and other content based on them ("Outputs"). If you include personal data in your Prompts, we will process it, and it may be reproduced in your Outputs.

1.1.4. Workspace content. Files, documents, spreadsheets, images and other content you upload to or create in your Air9 workspace, including their version history, comments and sharing settings.

1.1.5. Memory and personalization. The assistant may store facts it learns from your conversations to personalize future responses. You can view, edit and clear this memory in your settings. Chats started in private mode use and update memory unless you turn personalization off for that chat.

1.1.6. Connected services. If you connect a third-party service (for example a calendar, email, storage or business application) to Air9, we store the access credentials the service issues to us and process the data you ask the assistant to read from or write to that service. We access such data only to carry out your requests. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

1.1.7. Feedback. If you rate an Output, report a bug, or send us feedback or a support request, we collect the contents of your message, any attachments and, for ratings, the related conversation.

1.1.8. Communication information. If you communicate with us, including via email or our social media accounts, we collect your name, contact information and the contents of any messages you send. Emails sent to our addresses are stored in our systems so that we can read and answer them.

1.2. Personal data we receive automatically from your use of the Services

1.2.1. Device and connection information. Your device or browser transmits to us details such as your device type, operating system, browser, language and time zone settings, screen size, referring page and IP address (including the approximate location inferred from it).

1.2.2. Usage information. We collect information about your use of the Services, such as the dates and times of access, the features you use, the pages you view, the amount of AI usage and credits consumed, and, if you arrived through a referral or campaign link, the code or campaign that brought you. On our public pages we also measure aggregate usage without storing anything on your device: page views, page speed, time spent, and clicks to sign in, pricing or other pages, counted under a random identifier that lasts only for the page you have open and is not linked to your IP address. If you create an account during that visit, we keep the page, source and campaign that brought you together with your account so we can see which channels lead to signups.

1.2.3. Log and troubleshooting information. We collect information about how the Services are performing when you use them, including log files. If you or your device experience an error, we may collect information about the error, the time it occurred, the feature being used and the state of the application at the time.

1.2.4. Cookies and similar technologies. We use cookies, local storage and similar technologies that are strictly necessary to operate the Services, for example to keep you signed in, remember your preferences and protect against abuse. Because these technologies are necessary to provide the Services you request, they are always active and no separate consent is required; you can clear them at any time through your browser settings, which may sign you out. With your consent, we also use optional analytics cookies, which help us understand how the Services are used and improve them, and optional marketing cookies, which help us show you relevant offers. We ask for this consent on the consent screen shown after you sign in, optional cookies stay off unless you allow them, and you can change your choice at any time in Settings → Privacy. Without these cookies, our analytics providers count visits and actions only in a form that stores nothing on your device and does not recognize you from one visit to the next. If you allow analytics cookies, we may also record how you move through the interface, such as clicks, scrolling and navigation, with all text, typed input, images and previews masked before the recording leaves your device. The addresses of your conversations, files and documents, their titles and their content are never included in analytics or in these recordings.

1.2.5. Email engagement information. When we send you news and tips by email, we record whether the email was delivered and opened and which links in it were clicked.

2. How we use personal data

2.1. We use personal data for the following purposes:

2.1.1. to provide, operate and maintain the Services, including generating Outputs, storing your workspace content, syncing documents in real time, and processing payments;

2.1.2. to personalize the Services, for example through the memory and personalization features you control;

2.1.3. to improve and develop the Services and new features, including by analyzing aggregated usage, and to conduct research;

2.1.4. to communicate with you: we always send service emails about your account, security and support requests; we send activity emails, such as notices about shares and access requests in your workspace, unless you turn them off; and, only if you opt in, we send news and tips about new features and offers and measure opens and clicks of those emails. You can turn activity emails off and withdraw your consent to news and tips at any time through the unsubscribe link in each email or in Settings → Privacy;

2.1.5. to operate referral and promotional programs;

2.1.6. to prevent fraud, abuse and misuse of the Services, to determine from your IP address whether the Services are available in your country, to enforce our Terms of Service and to protect the security of our systems and Services; and

2.1.7. to comply with legal obligations and to protect the rights, privacy, safety or property of our users, us, our affiliates or any third party.

2.2. We do not use your Prompts, Outputs or workspace content to train AI models, and we contractually prohibit our AI model providers from doing so.

2.3. We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects. Automated systems may limit or suspend accounts for abuse, and you can contact us to have such a decision reviewed by a person.

3. Legal bases for processing

Under the General Data Protection Regulation (GDPR), we rely on the following legal bases:

Where we rely on legitimate interests, we have assessed that those interests are not overridden by your interests or fundamental rights. You may object to processing based on legitimate interests as described in the "Your rights" section.

4. Disclosure of personal data

We do not sell your personal data. We may disclose personal data to:

4.1. Service providers. To operate the Services we share personal data with providers that process it on our behalf and under our instructions, including:

• cloud hosting and storage providers that host our servers and store your workspace content;
• AI model providers that generate Outputs from the Prompts and conversation context we send them, and that are contractually prohibited from using this data for their own purposes, including training;
• web search providers, which receive the search queries the assistant makes on your behalf;
• authentication providers (Google Firebase Authentication) that verify your sign-in;
• payment processors that handle your purchases;
• Amazon Web Services (Amazon SES), which delivers the emails we send;
• analytics providers (PostHog and Google Analytics) that measure how the Services are used; and
• support and safety monitoring tools.

These providers may access, process or store personal data solely based on our directions and strictly for the purpose of performing their roles for us.

4.2. Connected services. When you connect a third-party service and ask the assistant to use it, we send the relevant data to that service on your instruction. Its handling of that data is governed by its own privacy policy.

4.3. Other users and third parties you share information with. Certain features let you share information with others, for example by sharing a conversation, file or document through a share link or by inviting a collaborator. Anyone with access to a shared link or workspace can see the content you share.

4.4. Business transfers. If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, receivership or transition of the Services to a different provider (a "Transaction"), your personal data may be disclosed during due diligence to counterparties and others assisting with the Transaction and may be transferred to a successor or affiliate as part of the Transaction, together with other assets.

4.5. Government authorities and other third parties. We may share your personal data, including information about your interaction with the Services, with government authorities or other third parties (i) if required to do so by law or in the good-faith belief that such action is necessary to comply with a legal obligation, (ii) to protect and defend our rights or property, (iii) if we determine that there is a violation of our terms, policies or the law, (iv) to detect or prevent fraud or other illegal activity, (v) to protect the safety, security and integrity of our products, employees, users or the public, or (vi) to protect against legal liability.

5. International transfers

We are established in Estonia and primarily store your data within the European Economic Area (EEA). Some of our service providers, including AI model providers, search providers, authentication providers and analytics providers, are located in or process data in the United States and other countries outside the EEA. Where we transfer personal data outside the EEA, we rely on an adequacy decision of the European Commission (including the EU-US Data Privacy Framework for certified providers) or on the European Commission's Standard Contractual Clauses, together with additional safeguards where appropriate. You can request a copy of the relevant safeguards by contacting us.

6. Retention

6.1. We retain your personal data only for as long as we need it to provide the Services to you or for other legitimate business purposes, such as resolving disputes, safety and security, or complying with our legal obligations. How long we retain personal data depends on factors such as our purpose for processing it, the amount, nature and sensitivity of the data, the potential risk of harm from unauthorized use or disclosure, and any legal requirements we are subject to.

6.2. In particular:

• Conversations, files and documents are kept until you delete them or your account. Deleted files are held in your Bin, where you can restore them, and are permanently removed when you empty the Bin or after 30 days.
• Deleted conversations and content are permanently removed from our systems within 30 days, except from backups, which are overwritten on a rolling basis.
• Chats started in private mode end two hours after their last message and their content is erased within seven days.
• Usage and billing records, such as the amount of AI usage, credits consumed and orders, are retained for as long as your account exists and thereafter as required by accounting and tax law (in Estonia, seven years).
• Server logs are retained for a limited period, typically no longer than 90 days.
• Support tickets and correspondence are retained for up to three years after they are closed.

6.3. When you delete your account, we delete or anonymize your personal data within 30 days, except where we must retain it to comply with a legal obligation or to establish, exercise or defend legal claims.

7. Security

We protect personal data with technical and organizational measures appropriate to the risk, including encryption in transit, access controls, isolated execution environments for code run by the assistant, and monitoring for abuse. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we become aware of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify you as required by law.

8. Your rights

8.1. Under the GDPR you have the following rights in relation to your personal data:

8.1.1. to access your personal data and information about how it is processed;

8.1.2. to have your personal data rectified or updated;

8.1.3. to have your personal data deleted;

8.1.4. to receive your personal data in a structured, commonly used and machine-readable format, and to have it transmitted to another controller (data portability);

8.1.5. to restrict how we process your personal data;

8.1.6. to withdraw your consent at any time, where we rely on consent as the legal basis for processing, without affecting the lawfulness of processing before the withdrawal. You can withdraw consent to optional cookies and to news and tips emails in Settings → Privacy; and

8.1.7. to lodge a complaint with a supervisory authority. Our lead supervisory authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee). You may also complain to the supervisory authority in the EEA country where you live or work.

8.2. You also have the right to object:

8.2.1. to our processing of your personal data for direct marketing at any time, including through the unsubscribe link in each email or in Settings → Privacy; and

8.2.2. to how we process your personal data when our processing is based on our legitimate interests, on grounds relating to your particular situation.

8.3. You can exercise many of these rights directly through your Air9 account: you can update your profile and personalization details, review and clear memory, download your files and documents, delete conversations and files, and delete your account from your settings. For anything else, please send your request to hello@lekt.ai. We will respond within one month, and we may ask you to verify your identity before acting on a request.

8.4. These rights may be limited, for example if fulfilling your request would reveal personal data about another person, or if you ask us to delete information that we are required by law or have compelling legitimate interests to keep.

9. Children

The Services are not directed to, or intended for, children under 13. We do not knowingly collect personal data from children under 13. If you have reason to believe that a child under 13 has provided personal data to us through the Services, please email us at hello@lekt.ai. We will investigate and, if appropriate, delete the personal data from our systems. Users under 18 must have permission from their parent or guardian to use the Services.

10. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will post the updated version on this page and update the effective date. If the changes are material, we will notify you by email or within the Services before they take effect.

11. Contacting us

If you have any questions or concerns about this Privacy Policy or our handling of your personal data, please contact us:

• Lekt Software OÜ
• Address: Harju maakond, Tallinn, Kesklinna linnaosa, Narva mnt 5, 10117
• Email: hello@lekt.ai
• Support: air9.cloud/support