What we collect, and why.

This is not a reviewed privacy notice, and it is not legal advice. The formal notice — with the subprocessor list and a data-processing agreement to sign — is in preparation and has not been reviewed by counsel. Until it exists, this page is an honest description of the system written by the people who built it, and nothing on it should be treated as a commitment a lawyer has checked.

If you need the formal documents before you can use the product, write to info@klaari.ee and say so. That is genuinely useful to know, and it is the honest answer to “when?”

The product holds data about two groups, and conflating them is how privacy pages become useless.

You, the customer. We hold your email address, the workspace you created, your role in it, and a record of the leads you captured and the model calls your workspace made — the last one because usage is metered and capped.

The visitors at your stand. Their data is yours, not ours. You decide what to collect and on what basis; the product stores it, separates it from every other customer’s, and hands it back to you. We do not sell it, do not use it to train anything, and do not combine it with another customer’s data for any purpose.

Everything below comes from one of three places, and nowhere else:

• The photograph your staff tookthe card image itself, and the name, company, role, email, phone, website and address read out of it.
• The conversation at the booththe answers to your own qualifying questions, any notes typed in, and — if your team chose one — the lawful basis with the exact wording of the notice shown at the time.
• The public weban enrichment pass searches for the person and the company and keeps the URLs of the pages it actually read. It writes a LinkedIn URL only when it found and opened one, and leaves a field empty rather than guessing.

Two third parties are involved in doing the work, and both see only what that work requires:

A model provider receives the card photo in order to read it, and the sparse lead record in order to run the enrichment search. It does not receive your other leads, your analytics or your team’s details.

A mail provider receives an email address and a sign-in link in order to deliver it.

Both will be named, with their locations and their terms, in the formal notice. They are not named here because naming a subprocessor is a commitment about a contract, and the section above is honest about which commitments exist.

In the EU — see security for the specifics of hosting and separation.

For as long as you keep it. There is no automatic retention schedule and no scheduled deletion; that engine is not built, and saying it is would be the easiest lie on this page to tell. Practically: your data stays until you delete it or ask us to. If you need a retention rule enforced by the system rather than by you, it does not exist yet.

One cookie, and it is the session — sealed, and set only once you sign in. There is no analytics script on this page, no advertising pixel, no third-party tag manager and no cross-site identifier. The reason the page loads quickly is that there is nothing else on it.

Export is a feature, not a request: every lead your workspace holds comes out as a CSV with the columns you choose, or as JSON through a read-only API key.

Deletion is a request today, to info@klaari.ee, and a person carries it out. A self-service “delete my workspace and everything in it” button is not built. If a visitor at your stand asks you to delete their record, you can delete the lead yourself in the workspace.

info@klaari.ee reaches the people who built this. There is no data-protection officer appointed, which is the kind of thing this page should tell you rather than let you assume.