Privacy Policy

This website uses no analytics or trackers. Our web server, which we run at Hetzner in Finland, logs each request with your IP address, browser and the page requested, to protect the site against abuse. Your language choice is stored in a cookie, described in the Cookie Policy. Legal basis: Legitimate interest in publishing the website and protecting it from abuse.

If you write to support@ourai.dk or another OurAI inbox, we keep the email and its attachments in our email system, so we can reply and keep a record. Legal basis: Performance of the contract when you are an individual customer writing about your account, and otherwise legitimate interest in answering inquiries and keeping a record of them.

To create and run your account, we process:

• –your name and email address
• –for organisation accounts, your organisation and role
• –a hash of your password, never the password itself
• –billing information. Name, address and payment method, and for organisations also company name and VAT number. Stripe handles the payment itself, see Who we share it with
• –for individual accounts, when you accepted the terms and gave the consent described below, and which wording you saw

Legal basis: For an individual account, performance of the contract with you. For an organisation account the contract is with your organisation, so the basis is our legitimate interest in providing the service your organisation has bought to the people it names, and in billing the organisation. We keep billing records because Danish bookkeeping law requires it, a legal obligation.

If your organisation created your account, we receive your name, work email and role from its administrator, not from you.

We process:

• –the prompts and files you send to AI models through OurAI, and the titles of your conversations
• –the models’ answers, and files the assistant creates for you
• –memories, short facts the assistant saves about you, when your workspace has switched memory on
• –usage data such as model, token counts and timestamps, for billing and, in organisations, aggregated usage insights

OurAI receives and stores your content as you wrote it. Redaction, where your plan and settings apply it, replaces personal data only in what is sent to an AI model outside OurAI. It does not change what is stored in your conversations and files.

For individual accounts, the legal basis is performance of the contract with you. Your conversations and files can reveal special categories of personal data about you: Your health, genetics, biometrics, ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, sex life or sexual orientation, as well as your CPR number or criminal offences. We process these only with your explicit consent (GDPR Article 9(2)(a), and sections 8(3) and 11(2) of the Danish Data Protection Act), which we ask for when you create your account. We record when you gave it and which wording you saw. Personal data about other people that you include is your responsibility under the Terms of Service.

For organisation accounts, your organisation is the controller and OurAI its processor, see the DPA. The organisation’s audit log keeps conversations apart from identity. Identity can only be revealed through a formal procedure, which is itself recorded.

We keep a security log of sign-ins and account changes, with IP address and browser, and our servers log each request with IP address and the address requested. When something fails, our services send an error report to Sentry. Filters remove content, email addresses and other recognised personal data, but a free-text error message can still contain personal data. Legal basis: Legitimate interest in keeping accounts and the service secure and running.

We analyse how the service is used, for example which plans and models are used, how often people sign in, and the answers you give when you start using OurAI. The analysis runs on our own server and uses user and workspace IDs, never names, email addresses, IP addresses or the content of conversations. It uses no cookies or tracking, and it is not shared with anyone. Legal basis: Legitimate interest in understanding how the service is used, to improve it.

We keep contact details, correspondence and meeting notes about customers, prospects, suppliers, investors and other business contacts. We receive them from you, from your organisation, from our advisers, or from public sources such as the Danish Central Business Register (virk.dk). Legal basis: Legitimate interest in answering inquiries and keeping business relationships. We send no newsletters or other marketing by email.

If you apply for a job, we keep your application and our correspondence about it in our email system, to assess the application. Legal basis: Steps taken at your request before entering into a contract.

Users can write about other people in their conversations and files, for example a colleague, a client or a relative. We receive this from the user, not from you, and we cannot tell who is mentioned, so we cannot inform you individually (GDPR Article 14(5)(b)). This section informs you instead. What users write is stored encrypted, sent only to the AI models and tools the user chooses, never used to train AI models, and deleted with the conversation or the account. In an organisation workspace the organisation is the controller, so contact it to exercise your rights. For an individual account OurAI is the controller, so write to support@ourai.dk. Legal basis: Our legitimate interest in providing the service the user has asked for. The user is responsible under our Terms of Service for having the right to share information about you.