Privacy Policy

DRAFT — pending review by qualified IT counsel and (for EU) by a Data Protection consultant before public launch.

Controller: Estonia OÜ name and address to be inserted

1. What we collect

We do not sell or rent personal data. We do not use personal data for behavioral advertising.

2. Legal bases (GDPR Art. 6)

• Contract — to provide the Service you signed up for
• Legal obligation — tax, sanctions, anti-fraud, recordkeeping
• Legitimate interest — fraud prevention, platform security, product improvement (analytics)
• Consent — marketing communications, optional cookies, recording, sensitive features

3. How we use it

• Operate, secure, and improve the Service
• Match clients with electricians
• Process payments and payouts
• Provide AI features (only on your action)
• Enforce our Terms and AUP, comply with law
• Notify you about service updates and (with consent) marketing

4. AI processing

When you use AI features, your inputs are sent to our AI subprocessors:

• Anthropic, PBC (Claude) — text, photos, video frames
• ElevenLabs Inc. — voice (when using voice agent)

These providers process inputs solely to return AI output and do not train models on your data (per their zero-retention business agreements). EU data is processed under Standard Contractual Clauses.

5. Sharing

We share personal data with:

• Service providers (subprocessors) — listed at obd2.online/legal/subprocessors. Includes AWS (hosting), Stripe (payments), Anthropic, ElevenLabs, Twilio (SMS), AWS SES (email), Cloudflare (CDN), Sentry (error logs)
• Other users — your public profile and (post-session) reviews
• Authorities — when required by valid legal process or to prevent serious harm
• Acquirers — in a merger, sale, or restructuring

6. International transfers

We host EU user data in the EU (eu-central-1, Frankfurt). Some subprocessors operate outside the EU. Transfers rely on Standard Contractual Clauses (EU Commission Decision 2021/914) and supplementary measures.

7. Retention

• Account: while active and 6 months after closure (longer for tax / dispute records as required by law — generally 7 years)
• Recordings (with consent): 90 days, then auto-deleted unless flagged for dispute
• Moderation logs: 2 years
• Anonymized analytics: indefinitely

8. Your rights

Subject to local law you have rights to:

• Access the data we hold about you
• Rectify inaccurate data
• Erase ("right to be forgotten") — exercised in product or by emailing [email protected]
• Restrict or object to processing
• Portability — export in machine-readable format
• Withdraw consent at any time
• Lodge a complaint with your supervisory authority (e.g. Estonian AKI for our HQ)

For California / U.S. state law residents (CPRA, VCDPA, CPA, CTDPA, UCPA, etc.):

• We do not sell your personal information
• We honor Global Privacy Control (GPC) browser signals
• You may exercise rights via [email protected] or the in-product Privacy page

We respond within 30 days (45 for U.S. state law where applicable, with one extension where allowed).

9. Cookies

See our Cookie Policy. Strictly necessary cookies are set without consent; analytics and preference cookies are opt-in.

10. Children

The Service is not for users under 18. We do not knowingly process data of children under 16 (under 13 in the U.S.). If you believe a child has provided us data, contact [email protected] and we will delete it.

11. Security

We use industry-standard controls: encryption in transit (TLS) and at rest (KMS), least-privilege IAM, audit logging, MFA for admin access, regular reviews. No system is perfectly secure. Suspected breach? Email [email protected].

12. AI transparency (EU AI Act Art. 50)

Our voice agent and vision diagnostics are AI systems that interact with humans. We disclose this clearly at the start of every interaction. You can always escalate to a human electrician.

13. Changes

We will notify material changes by email and in-product at least 30 days before they take effect.

14. Contact

• Data protection: [email protected]
• Postal: Estonia OÜ address to be inserted
• EU representative (Art. 27 GDPR): to be appointed if/when we become subject
• Supervisory authority: Estonian Data Protection Inspectorate (AKI), [email protected]