Unartificial Intelligence AS
← Home

Updated 20 October 2026

Privacy at UAI.

This notice covers the UAI website, enquiries to UAI and the private investor room: how data is used, how long it is kept and how to exercise your rights.

Go to investor-room privacy

Who is responsible?

Unartificial Intelligence AS, organisation number 934 846 303, Oslo, Norway, is the controller. Contact info@unartificial-intelligence.net about privacy and your rights. Other services, including Ideallya, have separate notices; processing for customer services is agreed separately.

Visiting the UAI website

Google Firebase Hosting serves these pages. IP address, browser information, time and requested URL are processed to deliver pages, prevent abuse and troubleshoot. The basis is legitimate interests in secure, reliable operation, GDPR Article 6(1)(f). Firebase states that Hosting retains IP data for a few months. UAI adds no analytics tools, advertising trackers or tracking cookies. Fonts and images are served by the website.

Contacting UAI

The email button opens your own email app; the website does not send or store the enquiry. If you send an email, UAI processes your address, name and the content you share to reply and follow up. The basis is steps before, or performance of, a contract with you (Article 6(1)(b)), or legitimate interests in replying to other enquiries (f). Data is kept as needed for follow-up, the customer relationship or legal claims; legally required records follow the relevant rules (c). Please do not send sensitive information. An enquiry does not subscribe you to marketing.

Privacy in the investor room

UAI uses your email address to give personal access to confidential investment material. An “approved email address” is one UAI has added to the access list after contact with you or your representative. The address is checked when you request a code. Use is voluntary, but email verification and acceptance of the confidentiality agreement (NDA) are required for access. You do not need a ChatGPT account.

Data recorded in the investor room

UAI processes email address, technical user ID, access status and access changes. Login records include a code hash, attempt count, technical session IDs and expiry. NDA acceptance records include email, user ID, agreement version, document hash, acceptance time and expiry. Sources are the access list, your input and technical events. Owner login with ChatGPT may also supply the owner’s account ID, name and email. Abuse prevention uses keyed hashes of email and IP address; this part of the application database does not store raw IP addresses. The hosting platform may retain IP address, browser, URL and time in its own operational and security logs.

Purposes and legal bases

The access list, login, code delivery and security logs rely on UAI’s legitimate interests in sharing material with selected recipients and protecting confidential information (Article 6(1)(f)). The NDA is processed to enter into and perform the agreement with you (b); proof of acceptance and legal claims also rely on legitimate interests (f). Data is not used for advertising, investor profiling or automated investment decisions. NDA acceptance is not marketing consent.

Retention and cookies

The investor room uses one essential login cookie, __Host-investor-session, to keep you signed in for up to 12 hours. JavaScript cannot read it and it is sent only over HTTPS. Blocking it prevents login. The app has no behavioural analytics or open/click tracking in code emails.

  • Codes are valid for 10 minutes. The app stores only a keyed hash, not the code itself. Sessions expire within 12 hours and end on logout.
  • Person-linked rate-limit counters expire within one hour. Access-change logs are kept for 90 days. Expired code, session and counter records and old access logs are deleted on new code requests; expiry does not mean immediate physical deletion.
  • NDA acceptance is normally kept for the agreement’s three-year term. Expired acceptance records are removed when the room is used. Necessary evidence may be retained until a specific dispute is resolved.
  • The access list is retained while the investment review and access administration remain relevant. Revocation stops access but does not automatically delete the historical entry. UAI reviews and removes it when access and documentation needs have ended.
  • Email and hosting providers keep their own delivery and security logs. Retention follows the service’s current periods and needs for delivery, troubleshooting, abuse prevention and legally required records. Ask UAI for further details or erasure where applicable.

Who receives the data?

Access is limited to UAI’s access administrator and people who need it for operations or rights requests. The room runs on OpenAI ChatGPT Sites using Cloudflare infrastructure. OpenAI processes stored room data on UAI’s behalf under the applicable processing terms. Sweego, provided by Mindbaz in France, receives your email address, code, message content and technical message ID to send the login code and record delivery. Your own email provider receives the message. Other investors cannot see your email address or NDA record. Data may be disclosed if required by law or necessary for specific legal claims.

Providers and transfers outside the EEA

EEA-only storage is not guaranteed. OpenAI/Cloudflare and Google use international infrastructure, including the United States. OpenAI’s Sites terms describe EU standard contractual clauses (SCCs) or a European Commission adequacy decision as transfer safeguards. Google describes corresponding safeguards, including the EU–US Data Privacy Framework. Sweego lists hosting in France; email is forwarded to your email provider. See the provider terms below, or contact UAI for details and a copy of the relevant safeguards.

Your rights

You may request access, correction, erasure and restriction, and object to processing based on legitimate interests. Data portability may apply to data you provided under a contract. Rights apply subject to GDPR conditions; necessary agreement or dispute records may limit erasure. Contact info@unartificial-intelligence.net. UAI normally replies within one month and requests only necessary identity verification. You may complain to the Norwegian Data Protection Authority (Datatilsynet). See its guidance on how to complain. This notice is updated for material changes and affected recipients are informed where required.