We use Google Analytics 4 and the Meta Pixel on the basis of our legitimate interests in understanding how visitors use ajelix.com and in measuring the effectiveness of our marketing. In weighing these interests against your rights, we take into account that: the data is used in aggregated form for statistical and measurement purposes; it does not control decisions about you; you can object to this processing at any time (see Section 7); and you can prevent the cookies responsible through your browser or cookie settings. If you object, we will stop the affected processing for you.

We share data only with the categories below. The current list of specific providers, their locations, and their roles is maintained in our Subprocessor List.

We never sell personal data. Website analytics and marketing measurement cookies are described in the Cookie Policy; you can object to that processing at any time (see Section 3.1 and Section 7).
Corporate events. In a merger, acquisition, or asset sale, personal data may be transferred subject to this policy.
Legal disclosures. We disclose data when required by law, court order, or to protect rights, safety, and security.

1. Inference on our own infrastructure. AI models run on servers owned and operated by Ajelix, located in the EU. Your prompts and files are not sent to any external AI provider; data does not leave the EU/EEA for AI processing.
2. Service continuity fallback. In exceptional situations — such as a disruption or failure of our own infrastructure — we may use a vetted external AI provider to keep the Service available to you. Where this happens: the provider is engaged under data protection terms no weaker than those described in this policy and the DPA, the provider does not use your content to train AI models, any transfer outside the EU/EEA is covered by the Standard Contractual Clauses or an adequacy mechanism, and the provider is added to the Subprocessor List with advance notice as described there. We will use such a fallback only as long as needed and will communicate it to affected customers.
3. No model training. We do not use customer content to train any AI model — by Ajelix or by any external provider engaged under Section 5.2.
4. Encryption and access control. Data is encrypted at rest; access to production systems requires VPN and 2FA; audit logging is in place; access rights are reviewed up to twice a year.
5. Retention. Prompts, outputs, and files are retained for the life of your account so that the Service can function. When you delete data or your account, all such data is permanently deleted, including prompts, outputs, files, and usage data.
6. Deletion on request. You can request deletion of your data at any time via support@ajelix.com.
7. AI outputs are machine-generated. They may contain errors; you remain responsible for verifying outputs before relying on them (see Terms §9).

After retention ends, data is deleted or irreversibly anonymized.

You have the right to: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), object to processing based on legitimate interests or for direct marketing (Art. 21), and withdraw consent at any time (Art. 7(3)). You also have the right to lodge a complaint with a supervisory authority in your country of residence or where the alleged infringement took place.
Requests are free of charge. We respond within 30 days, extendable by a further two months for complex requests with notice. We may ask for identity verification and may refuse manifestly unfounded or excessive requests with an explanation.
Self-service controls: you can delete your whole account in settings; upon account deletion, all data — prompts, outputs, files, and usage data — is permanently and irreversibly deleted immediately, with no recovery possible. Export anything you wish to keep before deleting your account. Billing management is available in the billing portal. If you need an export of your data before deletion, request it at support@ajelix.com and we will provide it.

Our infrastructure (Hetzner Germany, OVHcloud Germany, and our own EU-based servers) is located in the EU/EEA. The following providers may involve transfers outside the EEA:

• Google (OAuth and Workspace add-on platform): transfers covered by the EU Standard Contractual Clauses and/or the EU–US Data Privacy Framework (Google is DPF-certified);
• Stripe (payments): transfers covered by the EU Standard Contractual Clauses (Stripe is DPF-certified);
• Mailtrap (email delivery): processes data on servers in the United States (AWS / Google Cloud), under the EU Standard Contractual Clauses — see the Subprocessor List.

A copy of the safeguards is available on request.

We apply the measures summarized on our Security page — encryption in transit and at rest, VPN and two-factor authentication for access control, least-privilege internal access, audit logging, and vulnerability management. No method of transmission or storage is completely secure; we protect data to a standard consistent with the sensitivity of the data and legal requirements.

If you are a California, Colorado, Connecticut, Virginia, or Utah resident:

• Know/access, delete, correct, portability: you may exercise the equivalent rights listed in Section 7 via support@ajelix.com.
• Do Not Sell / Share: we do not sell personal data for money, and we do not share personal data for cross-context behavioral advertising as defined by US state laws; our use of website analytics and marketing measurement cookies is based on legitimate interests, and you can object to it at any time (see Section 3.1). If you prefer, you can also use the Global Privacy Control browser signal, which we honor where technically possible.
• Non-discrimination for exercising your rights.
• We respond within 45 days.

If you use Ajelix through your employer or as an end user invited by a business customer:

• That organization is the controller of data processed in the workspace; Ajelix is the processor acting on its instructions.
• Direct your rights requests to the organization — we will assist them but cannot act on your request without their direction, except where legally required.
• The controller–processor terms are in our DPA, which your organization accepts when agreeing to our Terms.

The service is not directed to children under 18, and business accounts require users to be at least 18. We do not knowingly collect data from children below that age. If you believe a child has provided data, contact us and we will delete it.

We will post any changes on this page and update the “Last updated” date. For material changes affecting the processing of personal data, we will notify registered users by email or in-product notice at least 14 days before the change takes effect. Where a change requires new consent, we will ask for it.

SIA AJELIX, reg. no. 40203482950, Peldu iela 7, Jelgava, LV-3002, Latvia
support@ajelix.com