Privacy Policy

This Privacy Policy explains how Equipmeter OÜ collects, uses, shares, and protects personal data when you visit our website, create an account, or use the Equipmeter service. We are committed to handling personal data in accordance with the EU General Data Protection Regulation (GDPR) and applicable Estonian law.

01The data we collect

Account and profile data

When you sign up or are invited to a workspace, we collect your name, work email, password (stored hashed), organization, role, and similar account details. If you sign in with Google, we receive your name and email address from Google.

Customer Data you put into the Service

As you use Equipmeter you create records such as assets, work orders, inspections, spare parts, vendors, and team members. These records may contain personal data of your staff or contacts. For this Customer Data, you (our business customer) are the controller and Equipmeter acts as a processor on your behalf.

Billing data

Payments are handled by our reseller and Merchant of Record, Paddle.com. We receive limited billing information (such as plan, billing country, and the last digits or type of card) but we do not receive or store your full payment-card number.

Usage and device data

We collect technical data such as IP address, device and browser type, pages and features used, and timestamps, to operate, secure, and improve the Service.

Communications

If you contact us (for example by the website form, email, or a demo request) we keep the content of those communications and your contact details.

02How we use data and our legal bases

• To provide the Service — creating and managing your account and delivering the features you subscribe to. Legal basis: performance of a contract.
• To process payments — through Paddle. Legal basis: performance of a contract and compliance with legal (tax/accounting) obligations.
• To secure and operate the Service — monitoring, troubleshooting, and product development. Legal basis: our legitimate interests in running a safe, reliable, and improving product.
• To measure our website and advertising — analytics and advertising cookies on our marketing site, as described in section 08. Legal basis: your consent, which you give through the cookie banner and can withdraw at any time.
• To communicate with you — service notices, support, and (where permitted) product updates. Legal basis: legitimate interests or your consent, which you can withdraw at any time.
• To comply with law — for example accounting, tax, and responding to lawful requests. Legal basis: legal obligation.

03How we share data

We do not sell personal data. We share it only with:

• Service providers (sub-processors) who help us run the Service, listed by name in the table below;
• Paddle, our reseller and Merchant of Record, which receives billing data to process payments as an independent controller under its own privacy notice;
• Your own organization — other authorized users in your workspace can see the Customer Data you create there;
• Authorities or third parties where required by law or to protect our rights, users, or the security of the Service.

Sub-processors

These providers process Customer Data on our behalf, under our Data Processing Agreement with business customers. We give business customers 30 days’ notice of a new sub-processor before it starts processing their data, and they may object to it.

AI features

Some features use AI models: the assistant that answers questions from your manuals and records, document type suggestions for uploaded files, drafts of work orders, requests, maintenance plans and checklists, and reading equipment nameplates from a photo. When you use one of them, the text, document excerpt or photo it needs is sent to the model provider. By default this is Anthropic, in the United States; Amazon Bedrock in the EU is used as a fallback, or exclusively for workspaces that choose EU-only processing. Voice input is transcribed by Amazon Transcribe in the EU.

• We do not use your data to train AI models, and under their commercial terms our AI providers may not either.
• Under its commercial terms Anthropic deletes the data it receives within 30 days, except where it must keep it longer by law or to investigate a breach of its usage policy. Amazon Bedrock does not share it with the model developer.
• A business customer who needs AI processing to stay in the EU can ask us to switch its workspace to EU-only processing (Amazon Bedrock) at info@equipmeter.ee.

04International transfers

Where you consent to analytics or advertising cookies, Google may process that data in the United States under the EU–US Data Privacy Framework and Standard Contractual Clauses. Declining those cookies avoids the transfer entirely.

We host data in the European Union. Some sub-processors listed in section 03 process data outside the European Economic Area: in the United States (Anthropic, Zoho, Google, Apple) and in the United Kingdom (OpenStreetMap Foundation). For Anthropic we rely on the European Commission’s Standard Contractual Clauses, which are part of its data processing addendum; for Zoho, Google and Apple, on the EU–US Data Privacy Framework or Standard Contractual Clauses; for the United Kingdom, on the European Commission’s adequacy decision.

05Data retention

We keep personal data for as long as your account is active and as needed to provide the Service. After your account is closed, we delete or anonymize Customer Data within a reasonable period, except where we must retain certain records (for example, invoices) to meet legal obligations.

06Your rights

Subject to applicable law, you have the right to access, rectify, erase, restrict, or object to the processing of your personal data, the right to data portability, and the right to withdraw consent where processing is based on consent. To exercise these rights, contact info@equipmeter.ee. If we process your data as a processor on behalf of a business customer, we will direct your request to that customer. You also have the right to lodge a complaint with a supervisory authority — in Estonia, the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon).

07Security

We use technical and organizational measures appropriate to the risk — including encryption in transit, access controls, and secure cloud infrastructure — to protect personal data against unauthorized access, loss, or misuse. No method of transmission or storage is completely secure, but we work continuously to protect your data.

08Cookies and similar technologies

We use three categories of cookie. Necessary cookies are always active — without them the site and app cannot function. Analytics and Advertising cookies are set only after you consent, and never before. You choose when the cookie banner first appears, and you can change or withdraw that choice at any time by reopening cookie settings.

Until you consent, we use Google’s consent-mode signals, which do not store cookies or identifiers on your device. If you decline, no analytics or advertising cookie is set and none of the above third parties receives an identifier for you.

09Children

The Service is intended for business use and is not directed to children. We do not knowingly collect personal data from children under 16.

10Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will take reasonable steps to notify you, and we will update the “last updated” date above.

11Contact