Privacy Policy

1. Who we are

chimate.ai is a SaaS platform for AI-powered image analysis (OCR and analytical processing). This Privacy Policy describes what personal data we collect, why, and with whom we share it. By using the service you agree to the terms below.

2. What data we collect

Account data: your name and email from your Google account (via OAuth), Google account identifier, email-verified flag.

Technical and registration-source data: IP address, country derived from IP, browser language, browser and operating-system family and major version, device type, UTM parameters, referring-site hostname, landing-page path and attribution timestamp. We do not store the full referrer URL or raw User-Agent for this purpose.

Trial abuse prevention data: a hash of the device fingerprint for the Windows app; for browser sign-in, a first-party cookie identifier and separate diagnostic hashes of graphics, fonts, offline audio rendering, platform, screen and locale components, with their availability and change counts. Raw component values are hashed on your device and are neither transmitted to nor stored on our server. Offline audio rendering does not use your microphone or play sound. Browser FREE limits use the cookie group and Google account history; matching v2 components are only used to review possible connections. To limit automatic free subscriptions to one per Google account, we also keep a keyed hash of the Google account identifier and the date of the first free grant. This record is stored separately from the profile, contains no email or raw Google identifier, and survives account deletion to prevent repeated activation. These identifiers and diagnostic hashes are not used for advertising.

Usage data: pages visited, funnel events (pricing views, plan selection, purchases, downloads, client launches), session recordings with passwords and private fields masked.

Images and analysis results: screenshots you upload and the OCR/AI output we produce are stored on our servers for the retention period stated below.

Payment data: amounts, currencies, statuses and subscription metadata. We do not store card numbers — they are processed by our payment provider Lava.top.

3. Purposes of processing

Delivering the service (storing and analysing images, maintaining subscriptions and credits).

Account management and authentication.

Billing, invoicing, subscription confirmation and renewal.

Product analytics to improve the service.

Using questions to improve service quality and publishing them under the conditions in section 3.1.

Ad campaign attribution and optimisation.

Notifying you about important changes to the service (email).

3.1. Use of questions to improve the service and for publication

chimate.ai may use the text of questions submitted by users, including questions extracted from uploaded images, to assess answer accuracy, test the service and improve its quality.

Only questions of a general nature that contain no personal data or confidential information and do not allow the user or other individuals to be identified, directly or indirectly, are used for these purposes. Questions are screened before use and, where necessary, edited, anonymised and generalised. If these conditions cannot be met, the question is neither used for these purposes nor published.

Selected questions may appear in a dedicated, publicly accessible section of the chimate.ai website without identifying the user or linking the question to their account. Publication is limited to the question text: original images, account information and other materials submitted by the user are not published. Publication respects third-party rights.

4. Recipients of data

PostHog Inc. (EU Cloud, servers in Frankfurt) — product analytics and session replay.

Yandex LLC — Yandex.Metrika and Yandex.Direct (analytics and advertising in Russia).

Lava.top — payment processor.

OpenRouter Inc. — executing requests against AI models (Google Gemini, Anthropic Claude).

Google LLC — OAuth authentication.

We have entered into Data Processing Agreements (DPA) with each of these processors in line with applicable law including GDPR.

5. Retention

Account and subscriptions — while your account is active.

Registration attribution linked to your account — until the account is deleted. Before registration, the latest meaningful attribution touch is stored in your browser for up to 30 days.

Images and analyses — 30 days from creation, then deleted automatically.

Selected questions meeting the conditions in section 3.1 may be retained separately from the original images and analyses, without personal data or links to an account, for as long as needed for the stated purposes. These texts may be retained and remain published beyond 30 days, including after account deletion. This does not extend the retention periods for the original images, analyses or personal data.

Server logs — 90 days.

PostHog and Yandex.Metrika session recordings — 30 days.

After you delete your account, personally identifiable information is erased or anonymised; aggregated transactional records may be retained for accounting and tax compliance. The pseudonymous record of a Google account's first free grant remains after profile deletion without an automatic reset period, so registration again does not grant a new free subscription.

6. Your rights

If you are located in the EU, EEA, the United Kingdom or Switzerland, GDPR / UK GDPR / FADP grant you the following rights:

Right of access to your data.

Right to rectification of inaccurate data (via the Profile page).

Right to erasure — use the "Delete account" button on the Profile page or write to support@chimate.ai.

Right to restriction of processing.

Right to withdraw consent to optional browser analytics — select Decline whenever the consent banner is shown, or contact support to change a consent choice stored with your account.

Right to lodge a complaint with your local data protection authority.

To exercise any of these rights please email support@chimate.ai. We respond within 30 days.

7. Cookies and trackers

Authentication uses JWT tokens in Local Storage; analytics cookies are not required for sign-in or the core operation of the service.

Browser sign-in uses the first-party chimate_browser_identity cookie, containing a random signed identifier, for up to one year. The server stores a keyed hash of this identifier for browser FREE limits and separate keyed component hashes for diagnostic comparison of browser configurations. Matching diagnostic components do not automatically merge browser groups or deny FREE.

Browser analytics (PostHog and Yandex.Metrika) follow the service's current consent policy: we may ask only in regions where consent is required, ask in every region, or enable analytics without a prompt for visitors who have not made a choice. An explicit previous decision always takes priority.

Local Storage is used to remember your consent decision, interface language, session JWT tokens, and the latest meaningful registration-source touch for up to 30 days.

Declining optional analytics prevents browser-based PostHog and Yandex.Metrika from loading. It does not disable server-side transactional events needed to operate and measure the service or first-party registration attribution.

8. Transfers outside the EU/EEA

Some processors may be located outside the EU/EEA. Transfers rely on the European Commission's Standard Contractual Clauses 2021/914.

9. Children

The service is not intended for individuals under 16. We do not knowingly collect data from children. If you are a parent or guardian and discover that your child has provided us with personal data, please contact us and we will delete it.

10. Changes to this policy

We may update this Policy from time to time. We will communicate material changes by email or via on-site notification. The last-updated date is shown at the top.

11. Contact

Email: support@chimate.ai