Privacy Policy

1. Data Controller

Genitco OÜ
Registered in Estonia
Email: hello@genitco.com

Genitco OÜ is the data controller for personal data processed through this website.

2. What We Collect

• Contact form submissions: name, email address, and message content you provide when contacting us via our website form (processed on our own servers).
• Newsletter subscriptions: email address, stored in ListMonk (self-hosted, EU).
• Chat messages: messages you send through our website chat widget. These are processed in real time to generate a response. An anonymised, PII-scrubbed record of the exchange (emails, phone numbers, and similar identifiers removed) is retained on our own EU infrastructure for up to 12 months to improve AI response quality. Raw personal data is not transferred to third-party model providers except on the fallback path described in section 4. Legal basis: legitimate interest (Art. 6(1)(f) GDPR) — improving a service the user is actively using.
• Analytics: we use Plausible Analytics (self-hosted on EU infrastructure), which collects aggregate, anonymised usage data. Plausible does not use cookies, does not collect personal data, and is fully GDPR-compliant. No consent is required.
• Email open tracking (transactional only): We embed a 1×1 transparent tracking pixel in the transactional emails we send you (signup acknowledgement, onboarding messages, status notifications). The pixel loads from pixel.genitco.io on our own infrastructure — no third-party tracker is involved. When your email client renders the message, we record the open event with your IP address and user-agent string for the purpose of (a) confirming our messages actually reach you and (b) spotting deliverability problems or abuse. We retain this data for 90 days, then delete it automatically. We do not use this data for advertising, retargeting, or any third-party sharing. If you prefer not to be tracked, your email client's “don't load remote images” setting suppresses the pixel entirely.
• Email click tracking (transactional only): Links in our transactional emails (for example, the “check your beta status” link in your signup acknowledgement) route through a short redirect on pixel.genitco.io before forwarding you to the destination. This allows us to record that the link was clicked, along with your IP address and user-agent string, so we can confirm our messages are actionable and detect deliverability problems. We retain this data for 90 days, then delete it automatically alongside the open-tracking data. The same principles apply: first-party only, no third-party sharing, no advertising or retargeting use. Legal basis: legitimate interest (Art. 6(1)(f) GDPR). You can opt out by not clicking the tracked links; the destination pages are also directly accessible at genitco.dev.

3. Legal Basis for Processing

• Contact forms and pre-sales chat: legitimate interest (Art. 6(1)(f) GDPR) — responding to your enquiry and qualifying whether our services are a fit.
• Newsletter: consent (Art. 6(1)(a) GDPR) — you opt in when subscribing and can withdraw at any time.
• Analytics: legitimate interest (Art. 6(1)(f) GDPR) — understanding aggregate site usage. No personal data is processed.
• Transactional email open tracking: legitimate interest (Art. 6(1)(f) GDPR) — confirming our operational messages reach you and detecting deliverability issues. 90-day retention; first-party only; no third-party sharing. Opt out by disabling remote-image loading in your email client.
• Transactional email click tracking: legitimate interest (Art. 6(1)(f) GDPR) — confirming our transactional emails prompt the intended actions and detecting deliverability issues. Same 90-day retention, same first-party-only principles. Opt out by not clicking tracked links; destination pages remain directly accessible.

4. Third-Party Processors

Chat messages are routed through our self-hosted LiteLLM gateway to a self-hosted model on EU infrastructure. If the self-hosted model is unavailable, the gateway falls back to Mistral AI SAS (France) or Nebius B.V. Token Factory (Finland) — both EU-incorporated. Messages are not stored by the model provider after the response is generated; a PII-scrubbed record is retained on our own infrastructure (see section 2).

For the full list of sub-processors with DPA links and last-reviewed dates, see our sub-processors page.

5. International Data Transfers

All primary data processing occurs within the EU on Hetzner infrastructure. Chat messages are processed by our self-hosted LiteLLM gateway. If the self-hosted model is unavailable, the gateway may fall back to a third-party LLM API; any such transfer outside the EU or UK is covered by standard contractual clauses.

DNS: our domain names (genitco.com, genitco.dev) use Cloudflare, Inc. (US) for authoritative DNS resolution. This means Cloudflare processes visitor IP addresses in DNS query logs on a transient basis. This transfer is covered by the Cloudflare GDPR Addendum (Standard Contractual Clauses). No content data is transferred.

6. Data Retention

• Contact form data: retained in our self-hosted CRM for the duration of the business relationship, then deleted. You can request earlier deletion at any time.
• Newsletter email: retained until you unsubscribe.
• Chat messages: a PII-scrubbed record (emails, phone numbers, and similar identifiers removed) is retained on our own EU infrastructure for up to 12 months to improve AI response quality. See section 2 for the full detail and the legal basis. After 12 months, records are automatically deleted.
• Analytics: Plausible retains only aggregate statistics. No personal data is stored.

7. Your Rights

Under GDPR, you have the right to:

• Access your personal data
• Correct inaccurate data
• Request deletion of your data
• Request data portability
• Restrict processing
• Object to processing based on legitimate interest
• Withdraw consent at any time (for newsletter)

To exercise your rights, you can:

• Use our self-service subject access request form — you will receive a machine-readable export of your intake data by email within minutes.
• Email hello@genitco.com for any right not covered by the self-service tool, or if you need assistance.

We will respond within 30 days.

You also have the right to lodge a complaint with a supervisory authority. For Estonia: Andmekaitse Inspektsioon (aki.ee). For the UK: Information Commissioner's Office (ico.org.uk).

8. AI-Powered Chat

Our website chat widget is powered by artificial intelligence. When you use the chat, your messages are processed by an AI model to generate relevant responses about our services.

• Chat messages are processed in real time. A PII-scrubbed record is retained on our own EU infrastructure for up to 12 months to improve AI response quality (see section 2 for full details). Raw messages are not accessible to third parties.
• The AI does not make automated decisions with legal or similarly significant effects on you.
• If the conversation suggests our services may be a fit, the chat may suggest booking a call with our team. This is informational, not a binding commitment.

9. Cookies

This website does not use analytics cookies. Plausible Analytics is cookieless. For full details, see our Cookie Policy.

10. Changes to This Policy

We may update this policy from time to time. Material changes will be noted with an updated date at the top of this page.