Privacy policy

Delegee Idonym is a tool that strips personal information out of your documents before you send them to a cloud AI service, and puts the originals back when the work returns. This Privacy Policy explains what data Idonym processes, why, how long it is kept, and what rights you have under the General Data Protection Regulation (GDPR).

1. Who is the controller?

Delegee OÜ (Estonian private limited company, registry code 17462294, registered at Pärnu mnt 139b, 11317 Tallinn, Estonia) is the data controller for the account data, audit records, and bug reports you provide to Idonym.

For the content of the documents you process through Idonym, you (or the firm you work for) are the controller. Idonym acts as a processor on your behalf. A separate Data Processing Agreement (DPA) is available on request and is the legal basis on which Idonym handles document content.

If you have a privacy question, write to shield-support@delegee.ai. We aim to respond within five working days; statutory response time under GDPR is one month.

2. What we process

2.1 Account data

• Email address.
• Password (stored as an Argon2id one-way hash; the plain password is never written to disk).
• Interface language (hr or en) and a small number of UI preferences.

Legal basis: performance of contract (Art. 6(1)(b) GDPR).

2.2 Document content (during processing)

When you upload a document or paste text, Idonym holds the bytes in the server's RAM only, never on disk. The pipeline detects personal data, replaces it with deterministic pseudonyms, and discards the original. Typical lifetime in memory: 5 to 30 seconds per document. After processing the memory region is actively overwritten with zeros.

The AI model that assists detection runs on the same server as the web application. Document content does not leave the Idonym host during processing.

Legal basis: performance of contract (Art. 6(1)(b)), under a DPA with your firm where applicable.

2.3 Anonymized output and encrypted mapping (per session)

For each document you anonymize, Idonym stores two things, both encrypted at rest. Together they are the only document-derived data that persist:

• The anonymized output: the text and the rendered file (DOCX, PDF, or plain text). This is the pseudonymized document; it carries role-tag pseudonyms, not your original personal data.
• The mapping: the correspondence between the original values (names, OIBs, court files, etc.) and the pseudonyms that replaced them. This is what makes Restore possible.

Both are encrypted with AES-256-GCM using a key (the MEK, Mapping Encryption Key) derived from your password. Idonym's database holds only the ciphertext; we cannot decrypt it without your password. You can delete any session at any time from the dashboard. Deletion cascades to the anonymized output, the encrypted mapping, any restored bytes, and per-session artefacts in a single database transaction.

Legal basis: performance of contract (Art. 6(1)(b)).

2.4 Restored file bytes (optional)

If you upload an AI-edited file back into Idonym and run Restore, the restored output is attached to the same session, encrypted at rest with the same per-user MEK. You can clear the restored bytes by clicking Remove in the verification panel; the bytes are zeroed, the verification record (substitution counts and leftover-pseudonym scan) is kept as proof the round-trip was clean.

Legal basis: performance of contract (Art. 6(1)(b)).

2.5 Audit log

Each processing event creates a metadata-only record: timestamp, document format, page count, entity counts by type, processing duration, and a session.delete event when you delete. No document content is ever written to audit logs.

The audit_log table is enforced as append-only at the database level by a BEFORE UPDATE OR DELETE trigger. We cannot rewrite it; nor can our hosting providers.

This log survives account deletion: the user_id is orphaned (no longer linked to your identity) and the metadata trail remains as compliance evidence.

Legal basis: legal obligation and legitimate interest (Art. 6(1)(c), 6(1)(f)), demonstrating accountable processing under GDPR Art. 5(2) and 30, and supporting your own compliance disclosures.

2.6 Correction records

When you correct a detection during review (remove a false positive, add a missed entity), Idonym stores the correction using the pseudonym, not the original value, so the system can learn without retaining real client data.

Legal basis: legitimate interest in product quality (Art. 6(1)(f)).

2.7 Bug reports

If you file a bug report through the in-app widget, Idonym stores: your description, browser and viewport metadata, the page URL, and (if you used the element-picker) a CSS selector plus a short markup snippet of the targeted element. You may also attach files to a report (a screenshot, or another file that illustrates the problem). Attachments are auto-purged after 30 days. Descriptions and metadata are retained indefinitely for triage. If you delete your account, the foreign key to your user is nulled; the report itself stays.

Legal basis: legitimate interest in fixing defects (Art. 6(1)(f)).

2.8 Server logs

Operational logs capture metadata (timestamps, request paths, status codes, duration, entity counts) and do not contain document text. They are retained for up to 30 days for security and debugging.

Legal basis: legitimate interest in service security (Art. 6(1)(f)).

3. What we never do

• We never send document content to OpenAI, Anthropic, Google, Microsoft, or any other third-party AI provider. The AI model used for detection is self-hosted on the Idonym server.
• We never sell, rent, or share personal data with advertisers or data brokers.
• We do not run advertising trackers, analytics pixels, or session-replay tools on the application.
• We do not train the AI model on your documents. The model is a fixed, locally hosted open-weights model; it has no learning loop from your data.

4. Where data is stored

• Application server and AI model: EU data centre in Germany (Hetzner, "GEX44" host class), under EU jurisdiction. Full-disk encryption (LUKS).
• Database: managed PostgreSQL hosted within the European Union (Neon), replicated off-host within EU regions.

Data does not leave the EU. We do not operate a US-hosted tier, and we will not introduce one without an updated policy and a clear notice.

5. Subprocessors

The following providers process limited categories of personal data on our behalf, under written processor agreements. A current subprocessor list is available on request.

If you have signed a DPA with us, we will notify you in writing before adding a new subprocessor and give you a reasonable period to object.

6. Retention

7. Your rights under GDPR

Subject to the conditions in the GDPR, you have the right to:

• Access (Art. 15): confirm what we hold about you and obtain a copy.
• Rectification (Art. 16): correct inaccurate account data.
• Erasure (Art. 17): delete your account from the Settings page. This wipes your profile, sessions, mappings, restored bytes, and active login tokens. Audit-log metadata (no PII) is intentionally preserved as evidence under Art. 5(2) and 30.
• Restriction (Art. 18) and Objection (Art. 21): write to us to limit or object to specific processing based on legitimate interest.
• Portability (Art. 20): export your account data and audit log in a machine-readable format. A per-session audit-log JSON download is available directly from each session's review page.
• Lodge a complaint with a supervisory authority. Because Delegee OÜ is established in Estonia, our lead supervisory authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee). You may also lodge a complaint with the supervisory authority of your own country of residence or workplace. For users in Croatia, that is AZOP (Agencija za zaštitu osobnih podataka, azop.hr).

To exercise any of these rights, write to shield-support@delegee.ai.

8. Security

• TLS 1.3 for all traffic between your browser and the server.
• Argon2id password hashing with high cost parameters.
• AES-256-GCM for the mapping and restored bytes, with a key derived from your password (the MEK) that the Idonym team cannot reconstruct.
• LUKS full-disk encryption on the application host.
• Append-only audit log enforced by a database trigger.
• Per-request ownership checks on every session-scoped operation: an attempt to act on another user's session ID returns a uniform 404, indistinguishable from a session that doesn't exist.
• No outbound connections from the AI model during processing.

A note about lost passwords

9. Cookies and similar technologies

Idonym uses only the cookies necessary to operate the service:

• A session cookie / token to keep you logged in.
• A shield_lang cookie to remember your interface language.

No analytics cookies, no advertising cookies, no third-party tracking. We do not require a cookie banner under EU ePrivacy rules because the cookies above are strictly necessary for the service you requested.

10. International transfers

Personal data is processed in the European Economic Area. If a subprocessor's support staff (for incident response) must temporarily access data from outside the EEA, the transfer is governed by Standard Contractual Clauses and is documented in our subprocessor agreements.

11. Children

Idonym is a professional tool intended for adults. We do not knowingly collect personal data from anyone under 18.

12. Changes to this policy

We will post material changes here and, where the change affects how we use existing data, notify you by email before the change takes effect. The "Last updated" date at the top of this document always reflects the current version.

13. Contact

For privacy questions, data-subject requests, or DPA signing:
shield-support@delegee.ai
Delegee OÜ · Pärnu mnt 139b, 11317 Tallinn, Estonia · Registry code 17462294 · delegee.ai