1. Data Controller
The controller of personal data is transtorm.ai , trading as transtorm.ai OÜ, a private limited company registered in Estonia.
- Registry code: 17443658
- VAT number: EE102960433
- Address: Harju maakond, Tallinn, Kesklinna linnaosa, Pärnu mnt 388b, 10131
- E-mail: info@transtorm.ai
2. Data We Collect
This website collects only the data described below.
| Data | Source | Purpose | Legal basis |
|---|---|---|---|
| IP address, browser, page requested, referrer, timestamp, response code | Web server logs, on every request | Operation and security | Legitimate interest |
| Name, e-mail address, message, selected service categories | Contact form, on submission | Handling your enquiry | Pre-contractual measures |
| Name, e-mail address, booked slot | Booking module, hosted on our own servers | Arranging the appointment | Pre-contractual measures |
| Pages visited, navigation events, device, browser, cookie identifiers | Google Analytics 4, after you accept | Audience measurement | Consent (section 5) |
Web server logs are kept regardless of your answer to the consent banner.
This website processes no payment: no basket, no card details, no transaction. Billing data is produced outside this website, within the client relationship, from your business contact details and the terms of the contract.
We do not collect data falling under Article 9 GDPR, including health data, through this website.
3. Purposes of Processing
The purposes of the data this website collects are set out in the table in section 2, next to each category.
Outside this website, if you become a client, we process your business contact details and the terms of the contract to discuss your enquiry, your quote and your contract, and then to issue invoices and keep the accounts the law requires.
None of the data described in this policy is used to develop or improve our own services, and we train no artificial-intelligence model on it. When we operate a system on your behalf, the data that system processes falls under a separate processing agreement in which you remain the controller. Our security page describes that framework.
4. Legal Bases (GDPR)
We rely on the following legal bases:
- Performance of a contract or pre-contractual steps
- Compliance with legal obligations
- Legitimate interests (security and service operation)
- Consent (audience-measurement cookies)
The audience-measurement cookies described in section 5 rest on your consent. They are set only after you accept them. You can withdraw that consent at any time from the Cookies entry in the footer, and the withdrawal stops the measurement from the next page you load. On the page you are already on, the script that is running keeps running until you leave it, and the cookies already set stay on your device until they expire or you delete them.
5. Cookies and Tracking Technologies
Audience measurement is configured on the published site at transtorm.ai. Where it is configured, nothing is measured before you accept it: a banner asks you the question on your first visit, with two buttons of the same size, Accept and Decline. Google Tag Manager loads only if you accept. If you decline, or if you leave the page without answering, no measurement script loads and no measurement cookie is set. A build that carries no measurement container, such as a preview or beta build, shows no banner and no Cookies entry in the footer, because there is nothing to measure and nothing to accept.
Your answer is written to the local storage of your browser together with the date you gave it. We stop relying on it after thirteen months at most, and then the question comes back. The entry itself stays in your browser until you clear your browser storage. The Cookies entry in the footer reopens the banner whenever you want, so you can change your mind in either direction.
When it does load, the Google Tag Manager container serves one measurement tag, Google Analytics 4. The cookies those two set on your device measure the audience: they count visits and record how the pages are used. What the container serves is configured inside Google Tag Manager and not in the code of this website, so this paragraph describes the container as it stands on the date given at the top of this page. We ask your consent for audience measurement alone, so we add no advertising or marketing tag to that container; if that ever changes, we update this page and ask you again. We set no cookie of our own outside that container.
One third party is called on every page, so the measurement tag is not the only external code you meet here. Google Fonts serves the typefaces from fonts.googleapis.com and fonts.gstatic.com, so Google receives your IP address and your browser headers on every page view, and we do not control what it stores on your device. The booking widget runs on our own servers at book.transtorm.ai and demo.transtorm.ai, so it hands your data to nobody else. The contact form calls api.web3forms.com only when you send it, and that call carries your name, your e-mail and your message to us. The font call happens whatever your answer to the banner is, because the banner covers audience measurement alone. That is a limit of the current banner, and not a claim that the call needs no consent.
This website keeps up to two technical entries in the local storage of your browser: your choice of a light or dark theme, and your answer to the cookie question. Neither is written before you act. The theme entry appears only when you use the theme switch, and the answer entry only when you answer the banner. Both stay on your device and are not sent to us.
You can also refuse, block or delete these cookies in your browser settings, and block the measurement script with a content-blocking extension. In private browsing your answer disappears when you close the private session, so the banner comes back the next time you open one. The site stays fully readable when you decline measurement or block it.
6. Data Recipients
| Recipient | What it receives | Location |
|---|---|---|
| OVH | the hosting of this website, and therefore the web server logs | European Union |
| Web3Forms | the contents of the contact form, on submission only | outside the EU/EEA, see section 7 |
| Google Fonts | your IP address and browser headers, on every page view | outside the EU/EEA, see section 7 |
| Google Analytics 4 | the measurement data, only if you accept it | outside the EU/EEA, see section 7 |
| Google Workspace | the contents of your message, because our mailbox is hosted there | outside the EU/EEA, see section 7 |
| Our technical service providers | only the access their maintenance work requires | depends on the provider |
| Our payment service providers | what settling an invoice requires, if you become a client | depends on the provider |
| Our advisers, auditors and public authorities | what the law requires us to disclose | European Union |
The contents of the contact form pass through two services, and this page has to say so in full. You send them to Web3Forms, which relays them to us by e-mail, and our mailbox is hosted by Google Workspace, so your message does reach a Google mailbox, and it stays there for the period given in section 8. Audience measurement, by contrast, receives nothing from the form, and sending it triggers no measurement event.
The providers we contract with receive only the data necessary for their tasks, under confidentiality and security obligations. Google Fonts is a free public service that we use without a contract of our own, so that call rests on Google’s published terms alone.
7. International Transfers
Four of the recipients in section 6 process data outside the EU/EEA, and they do not receive the same thing. Google Fonts receives your IP address and browser headers on every page view, through the call described in section 5, so we describe that transfer as a fact rather than as a possibility. Web3Forms receives the contents of the contact form, and only when you send it. Google Workspace receives those same contents just afterwards, because our mailbox is hosted there. Google Analytics 4 receives the measurement data, and only if you accept audience measurement. Where we hold a contract with a provider, we rely on appropriate safeguards such as the European Commission Standard Contractual Clauses, plus suitable technical and organizational measures. The Google Workspace data processing terms include those clauses. For Google Fonts we hold no contract of our own, so no such safeguard covers that call.
8. Retention Periods
We keep personal data for no longer than necessary for the stated purposes, then delete or anonymize it.
Indicative retention periods:
- Contact data: up to 3 years after last active contact
- Contractual and billing data: according to legal obligations
- Technical logs: limited period proportionate to security and operations
- Audience-measurement cookies: they stay on your device until they expire or you delete them, and the retention of the data collected through them follows the setting of the Google Analytics 4 property and Google’s own policy
9. Your Rights
Under GDPR, you have rights including:
- Right of access
- Right to rectification
- Right to erasure
- Right to restriction of processing
- Right to object
- Right to data portability
- Right to withdraw consent at any time (where consent is the legal basis)
To exercise your rights, contact: info@transtorm.ai
10. Security
We apply reasonable technical and organizational measures to protect personal data against loss, unauthorized access, alteration, or disclosure.
11. Supervisory Authority
You have the right to lodge a complaint with a competent data protection authority, including in Estonia:
Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate).
12. Updates
We may update this Privacy Policy to reflect legal, technical, or operational changes. The current version is published on this page with its update date.