Privacy Policy

Last updated:

This policy explains what personal data deepscope collects, why, how long we keep it and what rights you have under the EU General Data Protection Regulation (GDPR).

1. Who is responsible for your data

The controller of your personal data is , registry code , (“deepscope”, “we”, “us”).
Contact for all privacy questions: .

2. What data we collect

• Your answers in the form: first name, country of residence, age, gender, an optional Instagram username, and who you think might be looking for you.
• Your photo: the image you upload and the metadata stored in the file (for example location coordinates, device model, date and time).
• Your email address: to deliver your report and send your payment receipt.
• Payment data: payments are processed by Stripe. We receive only the payment status, amount, a payment reference and limited card information (such as card brand and the last four digits). We never see or store your full card details.
• Technical data: when you visit the website, our hosting provider processes your IP address and basic request information to deliver the website and protect it against abuse.

We do not use the photo to identify you, and we do not process biometric data for the purpose of uniquely identifying a person.

3. Why we use your data and on what legal basis

• To create and deliver your report (answers, photo, email): performance of a contract, GDPR Art. 6(1)(b).
• To process your payment and prevent fraud: performance of a contract, Art. 6(1)(b), and our legitimate interest in secure payments, Art. 6(1)(f).
• To keep accounting records (order reference, amount, date, email): legal obligation, Art. 6(1)(c), under the Estonian Accounting Act.
• To answer your questions and handle complaints: performance of a contract and our legitimate interest, Art. 6(1)(b) and (f).
• To run and secure the website (technical data): our legitimate interest, Art. 6(1)(f).

We do not use your data for advertising, we do not build profiles about you, and we do not sell your data. The report is created automatically, but it does not produce any decision with legal or similarly significant effects on you within the meaning of GDPR Art. 22.

4. How the report is created

Your answers and photo are sent to an AI model provided by OpenAI, which writes the text of your report. The photo metadata is read automatically by our server. OpenAI processes this data on our behalf only to generate your report and, under its commercial terms, does not use it to train its models.

5. How long we keep your data

• Photo: deleted automatically as soon as your report has been sent. If you do not complete the payment, the photo is deleted automatically within 7 days.
• Form answers: deleted when your report has been sent (or within 90 days for unpaid orders).
• The report itself: we do not keep a copy after sending it to you.
• Order record (email, order reference, payment reference, date): kept in our system for 90 days so we can help you with delivery questions, then deleted.
• Payment and accounting records: kept for 7 years as required by the Estonian Accounting Act, in our payment provider’s and accounting records.
• Emails you send us: kept for as long as needed to handle your request, and no longer than 3 years.

6. Who processes your data for us

We use the following service providers (“processors”). Each processes data only on our instructions and under a data processing agreement:

• Cloudflare, Inc. — website hosting and temporary file storage.
• Stripe Payments Europe, Ltd. — payment processing. Stripe is also an independent controller for some data it must keep by law (for example for anti-money-laundering purposes); see stripe.com/privacy.
• OpenAI, PBC — AI model that writes the report text.
• Resend — sending the email with your report.

Some of these providers are based in the United States or may process data outside the European Economic Area. Such transfers are protected by the EU–U.S. Data Privacy Framework where the provider is certified, and otherwise by the European Commission’s Standard Contractual Clauses (GDPR Art. 46).

7. Cookies

deepscope itself does not set cookies and does not use analytics or advertising trackers. On the payment step, Stripe may set cookies that are strictly necessary for secure payment and fraud prevention. These do not require your consent.

8. Your rights

You have the right to access your data, to have it corrected or deleted, to restrict or object to its processing, and to receive it in a portable format. Where processing is based on our legitimate interest, you may object at any time. To exercise your rights, email . We will reply within one month.

You also have the right to lodge a complaint with a supervisory authority, in Estonia the Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee), or with the authority in your own EU country.

9. Security

Data is transferred only over encrypted connections (HTTPS). Uploaded photos are stored in private storage that is not publicly accessible and are deleted automatically as described above.

10. Age

deepscope is intended for people aged 18 and over. We do not knowingly collect data from anyone under 18.

11. Changes to this policy

We may update this policy, for example when we change service providers. The date at the top shows the latest version.