Privacy Policy — Oinride AI

Oinride Oy (Finland) operates Oinride AI and is the data controller for the personal data described here. Contact: support@oinride.com.

Account data: email address, username, your first and last name, and a securely hashed password. If you sign in with Google: your Google account ID, name, email, and profile picture URL.

The country and town you signed up from:worked out from the network address you created the account from. Unlike the visit record described below, this one is stored on your account, so it is information about you rather than about an anonymous visit. We keep it to understand where the people using Oinride are, and to spot accounts being created in bulk. It is a country and a town, never a precise location, and the town is approximate. If you use a VPN it records the VPN's. You can see both values in your data export, and they are deleted with your account. The address they were worked out from is covered separately below.

Your conversations: the questions you ask and the answers you receive are stored so your chat history works. They are kept until you delete them or your account. A small number of named Oinride staff can read them, only for the reasons in section 3.

Your documents: files you upload are stored on our server, along with the extracted text that makes them searchable for you. Our staff do not open them. If the AI quotes one of your documents in an answer, someone reviewing that conversation (section 3) sees the quote in the answer, not the document.

Billing data: your subscription plan, usage (credits/tokens), and transaction history. Card details never touch our servers; payment runs entirely through Stripe.

Technical data: your IP address is used for rate-limiting and abuse prevention and appears in short-lived server logs (rotated after about 14 days). With one exception, described next, we do not keep IP addresses in our database. Unless you accept advertising cookies (section 9), we use no third-party analytics and no tracking across other websites. We do not sell or share any of this with anyone.

The address you signed up from: when you create an account we record the network address you created it from, together with the country and town we work out from it. We keep the address for 90 days and then delete it automatically; the country and town stay on the account. We keep it to see whether one person is opening many accounts, which is the one thing a country on its own cannot show. It is the most personal thing on your record, so: you can see the exact value in your data export, it is deleted with your account, and it is never shared. The town comes from a public dataset that is often approximate, so treat it as a rough area rather than a fact, and a VPN changes both.

The address you last signed in from: we also record the network address of your most recent sign-in, with the country and town worked out from it. It is replaced each time you sign in, not added to, so we hold one address, not a history of where you have been. It is deleted automatically after 90 days without a sign-in. We keep it for the same reason as the one above, and because it is what tells us an account is being used from somewhere it never was before. Same terms: you can see it in your data export, it is deleted with your account, and it is never shared.

Where visits come from: when a browser opens our site we record one row saying when it happened, which of our public pages it started on, and which website or tagged link it came from. That is used to understand which of our own channels reach people.

Country of a visit: separately from the account field above, we work out a country from your network address at the moment you arrive, and then discard the address. Only the country is kept. It tells us a visit came from, say, Egypt; it cannot tell us who you are, and a country is not something anyone can be identified by. If you use a VPN it records the VPN's country instead, which we say plainly wherever the figure is shown. The country data is licensed from DB-IP under Creative Commons Attribution 4.0.

What that visit row deliberately does not contain (the account field above is a separate record and is linked to you): no IP address, no cookie, no visitor or device identifier, no browser fingerprint, no account link, and not the full address of the page you came from, only its website name. Nothing in it can identify you or recognise you on a later visit, so it cannot be used to build a profile and it is not linked to your account even when you are signed in. (If you create an account, the account separately records which ad or link brought you, as section 3 explains; we keep that record apart from these visit rows and do not match the two.) We store coarse labels only, such as "mobile" or "desktop", "Chrome" or "iOS", and discard the browser identification string they came from. Never a version number, and never the full string, which is detailed enough to help tell one person from another.

To provide the service (contract, GDPR Art. 6(1)(b)): accounts, chat, document search, billing.

To keep the service safe (legitimate interest, Art. 6(1)(f)): rate-limiting, abuse prevention (including CAPTCHA at signup, and the address, country and town an account was created from and last signed in from, which is how we can tell whether one person is opening many accounts), security logging of sign-in events.

When our staff read a conversation: staff we have named and given this access one by one can read your questions and the AI's answers for these reasons only: you asked us for help with it; we are checking whether the AI answered correctly, for example after an error was reported; we are investigating misuse of the service or a security problem; we are finding out which questions the service answers badly so we can fix them; or the law requires it. Helping you when you ask is part of providing the service (Art. 6(1)(b)), reading a conversation because the law requires it is a legal obligation (Art. 6(1)(c)), and the other three reasons rest on our legitimate interest (Art. 6(1)(f)). Each time, we record who opened which conversation, when, and for which reason. Staff never see conversations you have deleted, do not open your uploaded documents, and do not copy conversations out of Oinride. You can object to the accuracy checks and the reviews of badly answered questions at any time by writing to support@oinride.com, and we will then leave your conversations out of them.

To understand who we are building for(legitimate interest, Art. 6(1)(f)): counting how many people sign up and which countries they are in, so we know where our users are. This is counting, not profiling: it produces totals, and nothing about it changes what any individual sees or is charged.

To measure our advertising, only if you accept it (consent, Art. 6(1)(a)): counting how many sign-ups and paid plans our ads lead to, through Google Tag Manager for our LinkedIn and Google ads and by your browser remembering the first ad or tagged link that brought you, as described in section 9. You can withdraw this consent at any time from Cookie settings.

To learn which of our ads work(legitimate interest, Art. 6(1)(f)): when you create an account, we record which ad or link brought you, if your browser told us: the ad network named by the marker an ad adds to its link (for example ChatGPT Ads or Google Ads, never the click's own identifier), the tags on a campaign link (its source, medium and campaign name), the name of the website or app that linked to us, the page you landed on, and whether you signed up with email or Google. If your browser remembered an ad or tagged link from an earlier visit (section 9), we also record the day of that visit, never the time. It tells us which ads bring people who sign up and buy a plan, and it is used for nothing else.

To meet legal obligations (Art. 6(1)(c)): invoicing and tax records via Stripe.

Apart from that ad measurement and the record of which ad brought you, we do not use your data for advertising. We do not sell it, and we do not process it for any purpose not listed here.

Our servers are hosted in Frankfurt, Germany (EU). Document text extraction and search indexing run locally on our own server — your uploaded documents are not sent to third-party processing services for parsing or indexing.

To operate the service we share specific data with these processors:

If you connect an AI assistant (such as Claude or ChatGPT) to your Oinride account, that assistant sends Oinride the lookups it makes for you and receives Oinride's results. The assistant's provider is not our processor: you chose it, and what it does with those results is governed by its own terms. We keep a record of each lookup (which tool, when, and the credits used) to bill and protect your account. You can disconnect an assistant at any time in your account settings.

If you accept advertising cookies (section 9), your browser also sends data directly to Google, through Google Tag Manager, and to LinkedIn, through its conversion pixel. Section 9 says what they receive. They handle it under their own privacy policies.

Transfers outside the EU rely on European Commission adequacy decisions, the EU-US Data Privacy Framework where the provider is certified, or Standard Contractual Clauses.

Your conversations and documents are used to answer your questions and, for conversations, for the staff review described in section 3. Nothing else. We do not train or fine-tune AI models on your content, and we do not permit our AI providers to do so on our behalf.

Your account, conversations, and documents: until you delete them or your account (you can delete individual conversations and documents at any time).

Billing records: as long as accounting law requires.

The record of our staff opening your conversations: 12 months, then deleted automatically. It says who opened which conversation, when and why, never what the conversation said. We keep it for those 12 months even after you delete your account, because it is how we show that each access was proper.

The record of our email to you about staff review: as long as your account. It says when we sent it and whether your mail server accepted it. Deleting your account deletes it.

The address you signed up from: 90 days, then deleted automatically. The country and town worked out from it stay on the account.

The address you last signed in from: 90 days after your last sign-in, then deleted automatically. Signing in replaces it rather than adding to it.

Which ad or link brought you: as long as your account. Deleting your account deletes it.

The first ad or tagged link that brought you, kept in your browser only if you accept advertising cookies: it counts for 30 days, and is deleted when you create an account or sign in, when you switch advertising off, or the first time you open the app after that.

Your answer to the cookie banner: 12 months, kept in your browser, then we ask again.

Sign-in security logs: rotated, weeks not years. Expired login sessions and tokens are purged daily. Short-lived server logs containing IP addresses rotate after about 14 days.

Under the GDPR you can access, rectify, export, delete, restrict, or object. Most of these are one click inside the app, no email needed:

• Download my data (account menu, Edit Profile): a complete machine-readable export of your profile, conversations, documents, and billing history, including when and why our staff opened your conversations and when we emailed you about it.
• Delete my account (account menu, Edit Profile): permanently erases your account, conversations, documents, search index entries, and your Stripe billing profile. We email a six-digit code first and nothing is erased until you enter it, so a stolen session cannot delete your account.
• Delete any single conversation or document from within the app.
• Change your email or password from within the app.

For anything else, write to support@oinride.com. You also have the right to lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi) or the supervisory authority in your EU member state.

We always set what the service needs to function: two secure, HTTP-only authentication cookies (30 minutes and 7 days) and one interface-preference cookie. These are strictly necessary and need no consent.

Advertising cookies, only if you accept. A banner asks for your consent to optional advertising cookies, which measure how our ads perform. Nothing in this paragraph happens before you choose Accept All Cookies, or switch on Advertising in Cookie Settings, and none of it happens if you choose Reject All or ignore the banner. If you accept, your browser loads Google Tag Manager from Google, which gives Google your IP address and browser details. When you create an account or start a paid plan, Tag Manager is also told that it happened: how you signed up (email or Google), or the plan, how often it is billed and its price. Never your name or email address. It reports this to Google and, through a conversion pixel, to LinkedIn. Both receive your IP address and browser details with it and can set or read their own cookies. If you are signed in to LinkedIn in the same browser, LinkedIn can link it to your LinkedIn account. We use this only to count how many sign-ups and purchases our ads lead to, not to show you ads. We do not use LinkedIn's Insight Tag in this app, so LinkedIn is not sent the pages you open here or what you click. How long these cookies last is set by LinkedIn and Google, not by us.

Changing your mind. Use Cookie settings (here, on the start page, in the account menu, or at the foot of the pricing pages) to see your choice and change it at any time. If you switch advertising off after accepting, the page reloads without these tags, and so does any other tab of this app you have open. Cookies they stored before that stay in your browser until they expire or you delete them.

Your answer is remembered in your browser's local storage for 12 months, so the banner does not ask on every page; then it asks again. That entry is strictly necessary to respect your choice: it needs no consent, holds no identifier and is never sent to us.

If you accept advertising cookies, your browser also keeps the first ad or tagged link that brought you (a click on an ad, which carries the ad network's marker, or a link carrying campaign tags, such as the ones ChatGPT adds to links in its answers) in its local storage (oinride_ad_source), so it still counts if you come back later and create an account. A link from a website without either is not kept. It holds the marker or the campaign tags, the name of the website that sent you, the page you landed on and when, never the ad's click identifier. It counts for 30 days, and nothing is kept while you are signed in. It is deleted when you create an account, sign in or switch advertising off, and otherwise the first time you open the app after those 30 days or after your consent expires. Your browser sends it, with the time cut to the day, with a sign-up, or with a Google sign-in because that can create an account; we keep it only if an account is created.

One further item is worth naming because it is stored in your browser, even though it is not a cookie: a single flag that records that this visit has already been counted, so that reloading a page does not count you twice. It is never sent to us, it holds no identifier, and it is erased when you close the tab. It exists to make our own visit counts less wrong, not to follow you, and it cannot follow you: it does not survive the tab, and it is not readable by any other website.

All traffic is encrypted (HTTPS with HSTS). Passwords are stored only as salted hashes. Authentication cookies are HTTP-only and secure. Sign-in events are logged for breach detection. Access to production systems is restricted and key-based. Access to customer conversations is limited to named staff, granted one person at a time, and every access is recorded.

Oinride AI is a professional tool and is not directed at children under 16.

When this policy materially changes we update the version date above and, where required, ask for your acceptance again. Your acceptance is recorded with a timestamp and the version you accepted.