1. Introduction

Umay AI ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website and use our services.

2. Information We Collect

Personal Information

We may collect personal information that you voluntarily provide to us when you:

Fill out our contact form (name, email, company, message)
Request a consultation or booking
Email us directly

Automatically Collected Information

When you visit our website, we may automatically collect certain information such as your IP address, browser type, operating system, referring URLs, and page views. This data is collected through cookies and similar technologies.

3. How We Use Your Information

We use the collected information to:

Respond to your inquiries and provide customer support
Process consultation and booking requests
Improve our website and services
Analyze website usage and trends
Comply with legal obligations under EU and Austrian law

Legal Basis (GDPR Art. 6)

We process your data on the basis of: your consent (Art. 6(1)(a)) for the newsletter and non-essential analytics cookies; the performance of, or steps towards, a contract (Art. 6(1)(b)) when you contact us or request a consultation; and our legitimate interests (Art. 6(1)(f)) in securing the website and preventing abuse (e.g. spam protection and rate limiting). You can withdraw consent at any time without affecting prior processing.

4. Cookies

Our website uses cookies to enhance your browsing experience. You can control cookie preferences through your browser settings. We use cookies for:

Essential cookies: Required for the website to function properly (e.g., language preference, theme preference)
Analytics cookies: Help us understand how visitors interact with our website

5. Data Sharing

We do not sell, trade, or rent your personal information to third parties. We may share your information with trusted service providers who assist us in operating our website and conducting our business, provided they agree to keep your information confidential.

6. Data Security & Retention

We implement appropriate technical and organizational security measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. However, no method of transmission over the Internet is 100% secure.

We keep personal data only as long as necessary for the purpose it was collected:

Contact & booking enquiries: up to 24 months after our last interaction, unless you become a client (then for the duration of the engagement plus statutory record-keeping periods).
Newsletter: until you unsubscribe; the record of your double opt-in consent is kept as proof for as long as you are subscribed.
Security & rate-limit logs (incl. IP): short-lived — typically minutes to a few days.

7. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

Right to access your personal data
Right to rectify inaccurate data
Right to erasure ("right to be forgotten")
Right to restrict processing
Right to data portability
Right to object to processing
Right to withdraw consent at any time

To exercise any of these rights, email goku@umayai.com. We respond within 30 days. You also have the right to lodge a complaint with the Austrian Data Protection Authority (Österreichische Datenschutzbehörde): dsb.gv.at.

8. Third-Party Services

We use the following third-party services, which may process limited data (such as your IP address) to provide their function. Each has its own privacy policy, which we encourage you to review:

Vercel — website hosting and content delivery.
Vercel Analytics & Speed Insights — aggregated, privacy-friendly usage and performance analytics (loaded only with your consent).
Cloudflare Turnstile — bot and spam protection on our contact and booking forms.
Resend — delivery of emails generated by our contact, booking, and newsletter forms.
Upstash — Redis-based rate limiting that briefly processes your IP address to protect our forms and APIs from abuse.
OpenStreetMap — the map embed on our contact page.
OpenAI — powers our chat assistant and the UmayAI Get demo where enabled; the text you send is processed to generate a response.

These providers offer Data Processing Agreements under GDPR Art. 28, and where data is processed outside the EU/EEA, transfers rely on appropriate safeguards such as the EU Standard Contractual Clauses.

For details on cookies and how to manage your preferences, see our Cookie Policy.

9. Children's Privacy

Our services are not directed to individuals under the age of 16. We do not knowingly collect personal information from children.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "Last updated" date.

11. Contact Us

If you have any questions about this Privacy Policy, please contact us at:

Email: goku@umayai.com
Address: Florianigasse 50/2/7, 1080 Vienna, Austria

Data Protection Officer: you can reach our DPO for any data-protection matter at goku@umayai.com.

See also our Impressum for full company details.