Privacy policy

Version of September 30, 2026. Applies to the entire emilus.dev website, including the Emilus Agent page (in Ukrainian).

We write this in plain language and describe exactly what we actually do. If we change anything, we will change this text too.

Who processes the data

Data controller (within the meaning of the GDPR): Emilus OÜ, registry code 17490988, registered address: Sepapaja tn 6, 11415 Tallinn, Harju maakond, Estonia. This is the only legal entity behind Emilus and Emilus Agent. Processing is carried out under the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and the Estonian Personal Data Protection Act. Contact: hello@emilus.dev or Telegram @brrr28.

What data we receive

What you enter yourself. In the contact form on the site: your name, how to reach you (Telegram, phone or email), the service areas you are interested in, and your message. On the Emilus Agent page, in the configurator and in the “write to us” form: your type of business, the processes and channels you selected, and your Telegram username. We need your contact details only to reply to you.
Technical page analytics. Pseudonymized events: which pages and sections you read, how far you scrolled, what you clicked, your device type and the referral source. We use PostHog EU Cloud (European servers, eu.i.posthog.com) and Microsoft Clarity.
Session recording. PostHog and Clarity may record cursor movements and page scrolling. All input fields are masked (the maskAllInputs setting): what you type does not get into the recording. Lines that repeat your contact details after you submit them are masked as well, and the body of the request that carries your submission is not written to the recording at all.
Technical data. Device and browser type, operating system, screen size, language, approximate location based on your IP address (country or city), referral source.

Chat with Solomiia

Solomiia is Pavlo’s AI assistant in the chat on this site. She answers questions about Emilus and helps put together a brief for a conversation with Pavlo. Solomiia says that she is an AI at the start of the conversation.

What we process. The text of your conversation with Solomiia; the brief fields she fills in from your answers (you see them in the chat and can correct them); your contact details, only if you leave them yourself; the address of the page from which the chat was opened, so that the answer relates to what you are reading.
Purposes and legal basis. To answer your questions and prepare the conversation with Pavlo: steps taken at your request prior to a possible contract (Art. 6(1)(b) GDPR). And to check the quality of the answers and monitor the costs of the model: our legitimate interest (Art. 6(1)(f) GDPR).
Who processes data (processors and other recipients). Hosting, protection against attacks, storage of the conversation and the brief: Cloudflare. Search across the site’s pages to find material for an answer: also Cloudflare; your message is processed by its search model. Answers are generated by a language model from an external provider: to answer, it receives the text of the conversation and the brief. Booking a call: Google (calendar and video calls), which processes the data under its own terms if you book.
Language model provider. A US company. Under its terms, data sent through the API is not used to train models and is kept for no longer than 30 days in abuse-monitoring logs, unless the law requires a longer period. We switch off storage of responses on its side in every request. Data is transferred to the US on the basis of the EU Standard Contractual Clauses (Art. 46 GDPR) or a European Commission adequacy decision (Art. 45 GDPR), as provided for in the provider’s data processing agreement.
Booking a call. If you choose a time for a call with Pavlo in the chat, we create an event in his Google Calendar with a Google Meet link, and Google sends an invitation to the email address you provided. The event contains your email address, the chosen time, your name if you gave it, and a short description of the task from the brief, that is, the same as what you see in the invitation. Legal basis: steps taken at your request prior to a possible contract (Art. 6(1)(b) GDPR). You can decline the meeting directly in the invitation or by writing to us.
Transfers outside the EEA. Cloudflare and Google are US companies certified under the EU-US Data Privacy Framework, which means the transfer takes place on the basis of a European Commission adequacy decision (Art. 45 GDPR).
Your request to Pavlo. Solomiia shows the request in full. It reaches Pavlo in Telegram only after you press “ok, send” in the request itself.
Analytics. The text of your messages does not get into analytics. Analytics receives only pseudonymized events: chat opened, message sent, request confirmed.
Retention. Conversations are kept for 90 days and then deleted. A submitted request is kept as an inquiry (see “How long we keep data” below).
Stickers in the chat. Animated stickers: Noto Emoji Animation © Google, licensed under CC BY 4.0. We changed their size and frame rate.
Erasure. Write to hello@emilus.dev and we will delete the conversation and the brief before this period ends.

Please do not write passwords, payment details or health information in the chat: they are not needed for the brief.

We do not collect passport data, payment details, health data or other sensitive categories of data. We do not buy or sell databases.

Why we process data (purposes and legal bases)

to reply to you (in Telegram, by phone or by email) and prepare a review of your case, on the basis of your request, that is, steps taken at your request prior to a possible contract (Art. 6(1)(b) GDPR);
to understand which parts of the site work and which do not: our legitimate interest in improving the product (Art. 6(1)(f) GDPR);
to fix errors in the interface: the same legitimate interest (Art. 6(1)(f) GDPR).

Cookies

For visitors from the European Economic Area, the United Kingdom and Switzerland, analytics runs in cookieless mode: Microsoft Clarity is not loaded at all, and PostHog keeps its state only in the memory of the browser tab: no cookies or other persistent identifiers on your device, so each visit is counted separately. If the country cannot be determined, we switch this mode on as well. For all other visitors, both services may set their own cookies to tell a returning visit from a new one.

Site language cookie. In addition, the site sets its own cookie, emilus_lang. It remembers the site language you chose (value uk or en) so that the site opens in that language next time. The cookie is set when you switch the language on the site, or when the site picks the language from your browser settings on your first visit. It is a functional cookie, strictly necessary to show the site in the language you chose: it contains no identifier, is not linked to analytics and is not used for tracking. Retention period: 1 year. It applies to all visitors, regardless of country.

Browser storage. Besides cookies, the site keeps a few entries in your browser’s storage (localStorage and sessionStorage). Unlike cookies, the browser does not send them automatically with requests:

emilus-theme (localStorage): the color theme you chose, light or dark. Kept until you clear the site data in your browser.
sol-v1 (localStorage): your chat session with Solomiia, that is the conversation ID, the messages and the brief, so the conversation continues when you move between pages. After 7 days without activity in the chat, the site stops using it and overwrites it. sol-ui (sessionStorage): whether the chat window is open, until you close the tab.
Analytics storage (localStorage): for visitors outside the EEA, the United Kingdom and Switzerland, PostHog stores its pseudonymized visit identifier together with its cookie. In cookieless mode nothing is stored.

Who we share data with

Only with services without which the site does not work: PostHog (analytics, EU), Microsoft Clarity (session recordings), Cloudflare (hosting, protection, storage of chat conversations and site search for answers), the language model provider (Solomiia’s answers in the chat; a US company, the terms are described in the section “Chat with Solomiia”), Google (calendar and Google Meet, when you book a call in the chat), Telegram (delivery of your inquiry to us), and the brief service brief.emilus.dev. Cloudflare, PostHog, Microsoft Clarity, the language model provider and the brief service process this data on our behalf under their data processing terms. Google and Telegram process data under their own terms when you use them: when you book a call in the chat or send us your inquiry. We use PostHog’s European cloud service: the data stays on servers in the EU. Microsoft Clarity is a US service, and that is exactly why it is not loaded at all for visitors from the EEA, the United Kingdom and Switzerland. Public authorities receive data only upon a written lawful request.

How long we keep data

Inquiries: for as long as our communication continues, and then for up to 24 months as a record of what was agreed. Chat conversations with Solomiia: 90 days; we keep the record of a booked call in our database for the same period. The language model provider: no longer than 30 days (see above). The event in Pavlo’s calendar is kept like an inquiry. Analytics events and session recordings: for as long as the default settings of PostHog and Microsoft Clarity provide; we do not extend these periods.

Your rights

Under the GDPR, you can request access to your data and a copy of it, rectification of inaccurate data, complete erasure, restriction of processing or data portability, and you can object to processing based on legitimate interest, including analytics. Write to hello@emilus.dev or in Telegram to @brrr28: we respond within one month, delete everything that concerns you within 30 days and confirm this with a message. If you are not satisfied with our response, you can lodge a complaint with the supervisory authority where we are registered, the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee), or with the supervisory authority of your own country.

How to opt out of analytics

Use a tracker blocker in your browser: the site will work the same way. You can also object to analytics as described under “Your rights”.