1. Who We Are
Alertitude d.o.o., registered in Slovenia (Reg. No: 7401051000, Tax No: SI85415464). Our platform is accessible at alertitude.eu. For data protection inquiries: office@alertitude.eu.
2. Information We Collect
We collect the following data to provide the service:
- Assessment inputs (activity type, description, country, language) — sent to the Anthropic AI API for processing
- Assessment log — for each generated report we store server-side: the activity type and your description, country, language, tier (Single/Black), the generated report text, token usage and a shortened IP address (the last block is removed)
- Shared report links — each generated report is saved as a private snapshot page so you can share it by link; anyone who has the link can open it
- Saved reports — if you are signed in, reports you save are stored in your account
- Account data — if you register: name, email address and hashed password
- Site photos — if uploaded for photo hazard detection, sent to the Anthropic AI API for analysis; the photo itself is not stored in our report logs (a shared report snapshot can contain the annotated photo)
- Safety-sign usage — country, selected hazards and sign codes, time, a shortened IP address, and the company name and project name you enter on the sign, so we can see which companies and projects use this free tool. Names and phone numbers of people (supervisor, HSE advisor), custom text and uploaded logos are not sent to or stored on our server.
- Email address — if you leave it to receive updates or downloads (stored with a shortened IP address)
- Usage analytics — page views, visit duration, referring website and interaction events, with a shortened IP address and an approximate country derived from your browser's time zone; collected only if you accept analytics in the cookie banner
- Security log — your full IP address is kept for at most 30 days to enforce usage limits and prevent abuse
- Payment data — processed by PayPal; we store the PayPal order number, your name, email address, amount and invoice (we never see or store card details)
3. Legal Basis for Processing (GDPR Art. 6)
We process your data on the following legal bases:
- Contract performance (Art. 6(1)(b)) — processing assessment inputs to deliver the service you requested
- Legitimate interests (Art. 6(1)(f)) — storing assessment logs with shortened IP addresses, and full IP addresses for up to 30 days, for service improvement and abuse prevention; recording company and project names in safety-sign statistics to understand who uses our free tools
- Consent (Art. 6(1)(a)) — optional analytics (Google Analytics and our own visit statistics), only after you accept them; you can withdraw consent at any time on the Cookie Policy page
We do not use your data for advertising, profiling, or any purpose beyond delivering and improving the service.
4. Data Retention
- Assessment logs and safety-sign statistics (with shortened IP address): deleted automatically after 12 months
- Visit statistics: deleted after 12 months; live-visitor records after 90 days
- Security log with full IP address and rate-limit counters: at most 30 days
- Shared report snapshots: kept until you ask us to delete them, or at most 12 months
- Saved reports and account data: kept as long as your account exists; you can delete saved reports yourself or ask us to delete your account
- Invoices and payment records: 10 years, as required by Slovenian tax law (ZDDV-1)
5. International Data Transfers
Our website, database, logs and email are hosted on servers in Slovenia (EU). Assessment inputs are sent to the Anthropic API (United States) for AI processing. This transfer is covered by Anthropic's Data Processing Addendum, which includes the EU Standard Contractual Clauses. Payment is processed by PayPal (international). All transfers are secured via HTTPS.
6. Third-Party Services
- Anthropic API — AI model provider. Inputs transmitted securely over HTTPS. See Anthropic's Privacy Policy.
- PayPal — Payment processing. See PayPal's Privacy Policy.
- Web hosting provider — hosts the website, database, logs and outgoing email on our behalf under a data processing agreement.
- Google Analytics 4 — Usage statistics, only after you accept analytics cookies.
Fonts are hosted on our own server; no data is sent to Google Fonts.
7. Cookies and Local Storage
See our Cookie Policy for full details. We use strictly necessary cookies for sign-in and security, and local storage for your language and consent choice. Analytics are used only with your consent. No advertising cookies are used.
8. Your Rights (GDPR Art. 15–22)
Under the GDPR, you have the right to: access your personal data, rectify inaccurate data, request erasure, restrict processing, data portability, and object to processing. To exercise any of these rights, contact us at office@alertitude.eu. We will respond within 30 days.
9. Supervisory Authority
You have the right to lodge a complaint with the Information Commissioner of the Republic of Slovenia (www.ip-rs.si), or with the data protection authority in your country of residence.
10. Security
All data is transmitted over HTTPS. API keys and database credentials are stored outside the public web folder and never exposed to the browser. Passwords and sign-in tokens are stored only as hashes. Logins and forms are rate-limited against abuse. We follow industry-standard security practices.
11. Changes to This Policy
We may update this policy from time to time. The "last updated" date at the top will reflect any changes. Continued use constitutes acceptance of the updated policy.
12. Contact
For privacy-related inquiries: office@alertitude.eu. Alertitude d.o.o., Slovenia.