Privacy policy

1. Controller

AI Prishtina, Prishtina, Kosovo (contact: support@ai-prishtina.com) is the data controller for personal data processed via ai-prishtina.com.

2. Data we process

Account data: name, email address, and credentials (password hash, second-factor configuration such as TOTP secrets and passkeys) held in our identity service (Keycloak), plus session metadata (IP address, user agent) needed to secure your account.

Sign-in provider data: if you choose to sign in with GitHub or Google (optional, only shown when enabled), we receive the profile fields those providers share with us — name, email address and avatar — and link them to your account.

Lead data: the contents of contact, booking, collaboration, waitlist and newsletter forms you submit, including the consent text shown at submission and the page you submitted from.

Security events: authentication and security-relevant actions (sign-in, MFA-related outcomes, rate-limit rejections) recorded in an audit log with timestamp and IP address.

We do not use tracking cookies. Where analytics are enabled we use self-hosted, cookie-less analytics (Umami) that do not identify you.

3. Purposes and legal bases

Operating your account and securing the service — including the mandatory second factor (performance of contract; legitimate interest in security).

Responding to your requests and managing waitlists (your request; consent).

Newsletter email — only after you confirm the double opt-in link (consent). You can withdraw consent at any time.

Abuse prevention and security monitoring (legitimate interest).

4. Sharing, transfers and processors

We do not sell or share personal data with third parties for marketing. The site runs on infrastructure we operate in the European Union.

Transactional email is delivered via our email provider (one.com SMTP), which processes recipient addresses solely to deliver mail. Spam protection is self-hosted ALTCHA proof-of-work — no third-party captcha service and no cookies.

No third-party analytics, advertising, or tracking processors are used.

When GitHub or Google sign-in is enabled and you use it, those providers act as independent controllers for the data they process during sign-in; our identity service (Keycloak) processes credentials and second factors as our processor.

5. Retention

Account data is kept while your account is active and deleted when you delete your account. Unfinished account registrations whose email was never verified are deleted automatically after 24 hours. Unconfirmed form submissions (verification code never entered) are deleted after 24 hours. Security audit-log entries are kept for 12 months and then deleted automatically.

Consent records are kept for 13 months.

Account deletion and data retention

You can delete your account at any time from Account → Settings. Deletion requires re-authentication with your password and an authenticator code.

Our identity service (Keycloak) deletes your login identity immediately. We then erase your account profile, linked sign-in records, active sessions and pending verification codes, and unsubscribe your address from the newsletter.

Contact and lead form submissions are retained as business correspondence under the retention periods described above — unverified submissions are deleted after 24 hours.

Security audit-log entries — including the account-deletion event itself, with your IP address and user agent — are kept for up to 12 months for security and legal-obligation purposes, then deleted automatically.

Registrations that were never completed (missing email verification or authenticator setup) are deleted automatically: never-verified sign-ups after 24 hours, all other incomplete registrations after 72 hours.

For erasure requests you cannot complete yourself, contact support@ai-prishtina.com.

6. Account security

Every account requires a second factor — an authenticator app (TOTP) or a passkey — enforced by our identity service (Keycloak) and re-checked by this website for every session.

If you lose your second factor, recovery is handled by the identity service: backup codes issued during enrollment, or a support-assisted reset via support@ai-prishtina.com with identity proofing.

All security-relevant actions (sign-ins, sign-outs, session revocations) are written to the audit log.

Cookies and similar technologies

We use a small set of strictly necessary cookies plus, with your consent, privacy-friendly analytics (Umami, hosted on our own infrastructure — cookieless, no cross-site tracking). We do not use advertising or marketing trackers.

Whether analytics is on by default depends on your region, which we derive server-side from your IP address using the DB-IP country database. The IP is used only for this lookup — it is not stored — and only the resulting region is sent to your browser. IP geolocation by DB-IP (https://db-ip.com), CC BY 4.0.

A Global Privacy Control (GPC) signal from your browser is treated as an opt-out of all non-essential storage, wherever you are.

Your rights by region

European Union / EEA / UK / Switzerland / Kosovo and the Western Balkans — GDPR and GDPR-aligned laws (Kosovo law 06/L-082): you have the rights described above, including access, erasure, objection and the right to lodge a complaint with a supervisory authority — in Kosovo, the Information and Privacy Agency (Agjencia për Informim dhe Privatësi).

United States — CCPA/CPRA and similar state laws: you may request access to, correction of, or deletion of your personal information via support@ai-prishtina.com. We do not sell or share personal information for cross-context behavioural advertising. We honour Global Privacy Control signals as a valid opt-out request.

Wherever you are, you can change your consent choices at any time via the “Cookie settings” / “Your Privacy Choices” link in the footer.

7. Your rights

You can export your data as JSON from the account area, and manage or delete your account at any time from the account console (linked from Account → Security). You may also request access, rectification, restriction or erasure by emailing us. You have the right to lodge a complaint with your supervisory authority.

Newsletter

If you subscribe to our newsletter we store your email address, the language you subscribed in, the consent text shown at signup and the timestamps of signup and confirmation.

We use double opt-in: a confirmation email is sent first and the subscription only becomes active when you click the link. Confirmation links expire after 72 hours and unconfirmed signups are deleted automatically.

You can unsubscribe at any time via the unsubscribe link in every newsletter email (one click), or by emailing support@ai-prishtina.com. Unsubscribing never deletes your account or other data.

8. Security

We apply the measures described in our Trust Centre, including TLS, least-privilege database access, rate limiting, Content Security Policy hardening, signed container images and mandatory MFA for accounts.