Privacy Policy

We collect as little as we can, keep it in the EU and never sell it. The website kinnita.com uses no cookies and no trackers.

Who is responsible

Kinnita Technologies OÜ (registry code 17634016), Padriku tee 6/3-5, 11912 Tallinn, Estonia — hello@kinnita.com. Write to this address about anything in this policy.

What we keep and why

• Your account: name, e-mail, company name and registry code, and from the public Business Register the company's VAT number and address; your language; where you came from (for example the name of an ad). We need them to run your account and send you what you ask for (contract).
• Your keys: when you add Face ID, Touch ID or a fingerprint, your device gives us only a public key. Your face and fingerprint never leave your device. If you approve with Smart-ID, we keep your Smart-ID identity code so that the request reaches the right person (contract).
• Your websites and requests: the domain, the keys that connect it, the plugin's status reports, and every request — what was about to change, who started it (as your website reports it, for example a user name, e-mail or IP address), your decision and when you made it. This is your journal and the proof that nothing happened without you (contract; for the people on your website we act on your behalf — see the Terms).
• Where we reach you: the channels you connect — a Telegram chat ID, your browser's push address, an e-mail address, a Slack or Teams address — and a record of what we sent and whether it arrived (contract).
• Domain watch: public facts about your domain — name and mail servers, SPF, DMARC, certificate and expiry dates — and how they change (contract).
• Invoices: your company details, amounts and payments. Estonian law requires us to keep accounting records for 7 years (legal obligation).
• The free check: we do not store the domain you check or your IP address — only the score and which ad brought you. If you leave your contact details, we keep them to reply to you (legitimate interest).
• Visits to kinnita.com: our own server notes each page request — the page, the address you came from, your browser and type of device, and your IP address with its last part removed, so that it no longer points to you. We keep these notes for 30 days and use them only to count visits by page, country and source. No cookies, no scripts, nothing is shared (legitimate interest).
• News: if you subscribe at the bottom of kinnita.com — your e-mail, your language and which ad brought you. First we send one letter asking you to confirm; without that click we send nothing more and delete the address after 7 days. Once you confirm, Kinnita news comes at most once a month (consent). Every letter has a link to unsubscribe in one click, and then we delete your address.
• Questions you ask in My Kinnita: the text of the question, so that our team can answer it (contract).
• Signing in: one strictly necessary cookie on api.kinnita.com keeps you signed in; we store only a fingerprint (hash) of it. IP addresses are used only in memory to stop abuse, such as too many sign-ups, and are not saved.
• Signing in with Smart-ID, Mobile-ID or the ID card: if you choose it, eeID of Eesti Interneti SA confirms who you are and tells us your name, country and personal identification code. We do not store the code: we keep a keyed fingerprint of it, which cannot be turned back into the code without a secret kept apart from the data, and your name as eeID gave it — so that you can sign in again, or get back in after losing the phone with your key (contract).

We do not use your data for advertising, we do not sell it, and we do not use it to train AI models. No decisions about you are made automatically.

Who processes it for us

• UpCloud Ltd (Finland) — our servers and database in Helsinki, with nightly copies kept for 7 days.
• Cloudflare, Inc. — DNS of kinnita.com, and protection against attacks for My Kinnita (api.kinnita.com); there it passes visitors' IP addresses on.
• Resend (Plus Five Five, Inc., USA) — sends our e-mails from its EU region in Ireland.
• Google Ireland Ltd (Google Workspace) — our mailbox, when you write to us.
• Only if you choose them: Telegram, Slack, Microsoft Teams and your browser's push service (Apple, Google or Mozilla) receive a short notice with a link; SK ID Solutions AS receives the Smart-ID request.
• Only if you sign in with Smart-ID, Mobile-ID or the ID card: Eesti Interneti SA (eeID, Estonia) and, through it, the provider of the method you pick — SK ID Solutions AS for Smart-ID and Mobile-ID, the ID card's certificate check, or your country's eIDAS node.
• Payments: AS LHV Pank for bank transfers, and Paddle.com for card payments. Paddle is the seller of record for card orders and handles that data under its own privacy policy. Our accounting is kept in accounting software.

Where a provider is outside the EU/EEA, the transfer is protected by the EU–US Data Privacy Framework or by the European Commission's standard contractual clauses.

How long we keep it

• Account, websites, channels and journal: while your account is open; we delete them within 30 days after you close it.
• Invoices and accounting records: 7 years, as Estonian law requires.
• Contact requests: as long as needed to reply and follow up, then we delete them.
• News: until you unsubscribe; an address that was never confirmed, 7 days.
• Server notes of visits to kinnita.com: 30 days.
• Backups: 7 days.

Your rights

You can ask to see your data, correct it, delete it, limit how we use it, get a copy to take elsewhere, or object to how we use it. Write to hello@kinnita.com and we answer within a month. You can also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee).

Security

Data travels encrypted, the server of My Kinnita accepts connections only through Cloudflare, and only our team's keys can reach it. Requests are approved with your keys — we cannot approve them for you.

Changes

If we change this policy in a way that matters, we tell you by e-mail before the change applies.