Privacy notice for account holders

ai-eye runs this website and the accounts on it. We decide what an account holds and why, which under the GDPR makes us the controller of that data.

Write to us about anything on this page at info@ai-eye.eu

When you register you give us an e-mail address, a first and last name, and the language you want to read the site and our messages in. Keycloak, the sign-in software we run on our own server, sets and stores your password. Nobody at ai-eye can read it.

When you sign in we record that a session started, when your browser was last seen and when the session ended. On this website your browser keeps two cookies from us: one carries the session, the other ties a sign-in to the browser that began it. On the sign-in host Keycloak sets cookies of its own: some live only while a log-in is in progress, and one keeps you signed in on that host. None of these cookies is used for advertising or measurement.

The sign-in service records more than this, including the address your browser connects from. The next section says what.

We hold your e-mail address, name and language so that you can have an account, sign in to it and be reached about it. The legal basis is the contract between you and us: without this data there is no account.

We hold the records of sign-ins and of changes to an account so that we can keep accounts safe and look into misuse. The legal basis is our legitimate interest in the security of the service, which Recital 49 of the GDPR names.

We also use your address to write to you about your own account. That is part of running the account, and for the notices about a changed password or a changed address it is part of keeping it safe.

Signing in runs on Keycloak, the sign-in software we host ourselves. Keycloak writes an event for every registration, sign-in, refused sign-in, password change and e-mail change. Every one of those events carries the IP address your browser connected from, and its records of live sessions and of failed sign-ins hold that address too.

We keep these events for 90 days and then delete them. They also outlive the account: after an erasure they run out on their own clock, within those 90 days.

We write to you only about your own account: to confirm your address, to carry a password reset you asked for, and to tell you that your password or your e-mail address has changed. There is no newsletter and no marketing mail.

The messages leave our server through an external SMTP provider, so that provider handles your address and the text of the message on the way to you.

Our own mail service holds the text of a message only until it goes out: at most one hour for a message from the sign-in service, at most 24 hours for a notice from our own services. After that it keeps only the record that a message to a domain was sent or failed, without your address and without the text, for 30 days.

Our staff can open an internal console and look at accounts, so that we can answer a question about one or stop one being misused. That access is not part of an ordinary account and cannot be asked for through the website: we grant it by hand on the server, and an account that carries it must carry a second factor as well. An account without that access is turned away from the console and sees nothing.

In the console we can list every account that has registered, newest first, and search that list by e-mail address.

Opening one account shows its e-mail address, whether that address is confirmed, the language it is set to, when it was registered, when it was last signed in to, whether we have blocked it, whether it is itself a staff account and how many sessions it has open. Below that are those sessions, with the time each one began and was last seen, and the account's own history: sessions starting and ending, and changes of the profile, the password or the e-mail address, as our account service recorded them. The password itself is not shown and nobody at ai-eye can read it.

Two things can be changed from the console. An account can be blocked from signing in, which also ends every session it has open, and the sessions of an account can be ended without blocking it. A block can be lifted afterwards, and an ended session only means signing in again. Either change asks the member of staff to retype the address of the account. A member of staff can also delete an account from the console, unless it is itself a staff account, and the deletion is written down like a change. Your name, your language, your address and your password are changed only by you on the account page or by us at the server, where an account is also deleted.

Every one of those reads and both of those changes are written down: which member of staff did it, when, which account and how it ended. A search also records the term it was made with, which is usually an e-mail address. Granting that access at the server and withdrawing it go into the same record. A member of staff who has lost the password or the second factor of their own account is put back into it at the server, and that goes into the record as well. Reading the record is written down too. A row that has been written cannot be edited or removed from the console. Only two things happen to it afterwards: we delete it when its 90 days are up, and we clear your address out of it if we erase your account.

We keep the record for 90 days and then delete it. We keep it so that it stays possible to say afterwards who looked at your account and what they did with it. The legal basis is our legitimate interest in the security of the service, the same one as for the sign-in records above.

Our e-mail leaves through an external SMTP provider, and the server everything runs on is rented from a hosting company. Both act only on our instructions and for no purpose of their own. Nobody else receives your data.

We do not use your data for advertising and we do not sell it. We build no profile of you, and we make no decision about you automatically. The website loads no analytics and no third-party scripts.

Every kind of record has its own clock, and the record is deleted when the clock runs out.

• Your e-mail address, name and language in the sign-in service: for as long as the account exists.
• The copy of them in our own account database: deleted at the same time as the account in the sign-in service.
• The events Keycloak records about the account, with the IP address in them: 90 days, also after the account has been deleted.
• A registration whose e-mail address is never confirmed: deleted 72 hours after it was made.
• The record that a session started or ended, or that you changed your profile, your password or your address: 180 days.
• A web session that has ended: 30 days.
• The record of what a member of staff listed, searched for, read or changed, in the console or at the server, including the address a search was made with: 90 days.
• What our mail service knows about a message it handled, without your address and without the text: 30 days.
• The text of a message still waiting to go out: at most one hour from the sign-in service, at most 24 hours from our own services.

Anyone can type someone else's address into a registration form, so a registration counts for nothing until the address is confirmed. We delete a registration that is never confirmed 72 hours after it was made, together with the name and the address that were entered. The events Keycloak recorded about it run out on their own 90-day clock.

We delete an account on request. There is no delete button on the account page yet, so we do it by hand.

We delete the account in the sign-in service and every row our own account database holds about you, apart from the record of what our staff did. Three things outlive that deletion: Keycloak's events about the account, with the IP addresses in them, run out within 90 days of the event; a message already waiting to be sent leaves the queue within 24 hours; and the rows saying what a member of staff read or changed stay until their own 90 days are up. While we delete the account we clear your address out of those rows, so what is left says what was done and who did it.

Ask for a deletion at info@ai-eye.eu

Under the GDPR you can ask us for a copy of the data we hold about you, have it corrected or deleted, limit what we do with it, or receive it in a form you can take elsewhere. You can also object to the processing we base on our legitimate interest, which is the sign-in records and the record of what our staff did.

You can correct your name and your language yourself on the account page, and change your e-mail address and your password there as well.

We answer a request within one month. If our answer does not satisfy you, you can complain to the data protection authority of the country you live in.

To use any of these rights, write to us at info@ai-eye.eu