Privacy Policy

This Privacy Policy explains how Talivio Technology OÜ (registry code 16991406, Ahtri tn 12, Kesklinna linnaosa, Tallinn, Harju maakond, 15551, Estonia — "Talivio", "we") processes personal data in connection with the Citablio AI search readiness audit service. We are the data controller for the data described below, except where this policy says we act as a processor. For privacy questions, contact [email protected].

1. Data we collect

• Check input: the URLs you submit to the checker.
• Account data: name, email address and a hashed password.
• Billing data: subscription and purchase records. Payments are handled by Stripe; we never see or store full card numbers.
• Monitoring and scan history (accounts): the domains and pages you add, the findings derived from them over time, and the reports we generate. Findings include short HTML excerpts of the flagged page elements.
• Technical data: IP address, browser information and server logs, used for security and to operate the service.

2. Why we process it and our legal bases (GDPR)

We process data on the following legal bases under Article 6(1) GDPR:

• Contract (Art. 6(1)(b)): to provide the service — loading the pages you submit, running automated AI-readiness checks, operating monitoring, generating reports, and managing your account and billing.
• Legal obligation (Art. 6(1)(c)): to keep accounting records required by Estonian law.
• Legitimate interest (Art. 6(1)(f)): to keep the service secure and reliable (for example abuse prevention, logging and blocking scans of private networks) and to send service-related communications.

3. Scanned pages — our role

The pages you scan or monitor may contain personal data of people other than you (for example names or photos published on the scanned website). You decide which pages to submit; for any personal data contained in scanned page content and in the findings derived from it, you are the data controller and we act as your processor, handling that content only to provide the service. On request, we will enter into a GDPR Article 28 data processing agreement with business customers covering this processing; our standard DPA is available at [email protected].

4. On-demand scans

When you run a free one-off scan without an account, we load the target page, evaluate it, and show you the results. The result is cached for 24 hours under a random, non-guessable link so you (and only someone holding that exact link) can return to it; it is not tied to your identity and expires automatically. Only ordinary server logs remain after that.

5. Who we share it with

We do not sell personal data. We share it only with the recipients needed to deliver the service.

Processors (act on our behalf). These providers process personal data only on our instructions:

• The Talivio AI gateway (operated within the Talivio group), which we use to generate the optional executive-summary paragraph of AI readiness reports and the autonomous blog roundup. The gateway forwards only the data needed for that (score/grade/finding counts for reports; public news headlines for the blog — never full findings, page content, or your account data) to a centrally-chosen underlying AI provider; we do not integrate with any AI provider directly.
• Our hosting provider and mail infrastructure, which store data and deliver messages on our behalf. These operate within the EU.

Independent controllers (act on their own account).

• Stripe, our payment provider, which acts as an independent (separate) controller for the payment data it needs. We do not sign a controller–processor DPA with Stripe for the payment flow; Stripe's own privacy terms govern that processing.

6. Where your data is held and transfers

We host within the EU, and we do not transfer your personal data outside the EEA. Some of our sub-processors process data outside the EEA under appropriate safeguards. In particular, the underlying AI provider behind the Talivio AI gateway may process the limited data described above outside the EEA, under the gateway operator's own transfer safeguards. Stripe, as an independent controller, transfers payment data under its own safeguards (standard contractual clauses and/or an adequacy decision).

7. How long we keep it

• One-off scans without an account: not stored (see section 4).
• Scan history, monitoring data and reports: kept while the related domain remains in your account; deleted when you remove the domain.
• Account data: kept while your account is active and deleted or anonymised within 90 days after your account is closed or you request deletion.
• Invoices and billing records: retained for seven years as required by Estonian accounting law.
• Server logs: retained for a short rolling period for security purposes.

8. Your rights

Under the GDPR you may request access to your data, rectification, erasure, portability, restriction of processing, and object to processing. You may lodge a complaint with a supervisory authority — for us that is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), but you may also contact the authority in your own country. To exercise a right, email [email protected]. Where we process scanned page content as your processor (see section 3), we will refer requests concerning it to you.

9. Security

Passwords are hashed, traffic is served over TLS, and access to production systems is restricted. No system is perfectly secure, but we apply technical and organizational measures appropriate to the risk.

10. Cookies

We use only essential first-party cookies: a session cookie that keeps you signed in, a CSRF cookie that protects forms against abuse and — if you choose "remember me" — a persistent sign-in cookie. We do not use analytics or advertising cookies.

11. Changes

We may update this policy from time to time. The date at the top shows when it last changed; material changes will be communicated where appropriate.