Privacy Policy

1. Who We Are

This Privacy Policy applies to Oliver Mall Consultants Ltd, trading as Ainm ("Ainm", "we", "us", "our"), based in Cork, Ireland. We operate:

• ainm.ai — the core HR management platform
• comply.ainm.ai — AI governance and compliance tooling
• transparency.ainm.ai — pay transparency and gender pay gap reporting

This policy explains how we collect, use, and protect personal data in connection with these services. It covers two distinct roles:

• Data controller — when we process your data as a customer (account holder, admin, manager)
• Data processor — when we process your employees' data on your behalf, under your instructions, as described in our Data Processing Agreement

2. Data We Collect About You (as a Customer)

When you register for and use Ainm, we collect the following categories of data about you as an account holder:

Account Information

• Full name and work email address
• Organisation name and company size
• Job title and role within the platform
• Password (stored as a hashed value; we never store your plain-text password)

Billing Information

• Subscription plan and payment history
• Payment card details are processed and stored by Stripe — we do not store card numbers on our systems

Usage Data

• Pages visited and features used within the platform
• AI chat conversations and queries submitted to the HR assistant
• Documents uploaded, log timestamps, and audit trail data

Technical Data

• IP address and browser/device type at login
• Session tokens stored in browser local storage (not tracking cookies)

3. Employee Data We Process on Your Behalf

When your organisation uses Ainm to manage its workforce, you (the client company) are the data controller for your employees' personal data. Ainm acts as a data processor, processing that data only on your instructions for the purpose of providing the HR platform.

Categories of employee data we may process on your behalf include:

• Names, contact details, job titles, and employment dates
• Attendance and leave records
• Performance reviews and feedback
• Salary, pay grade, and compensation data
• Training records and certifications
• Gender (for gender pay gap reporting purposes only)
• Documents uploaded by your HR team relating to employees

We do not sell employee data. We do not use employee personal data to train AI models. Full details of our obligations as processor are in the Data Processing Agreement.

4. How We Use Your Data

Providing the Service

• Creating and managing your account
• Processing subscription payments via Stripe
• Operating the HR platform and all its features
• Providing AI-assisted HR guidance through the chat assistant

Improving the Platform

• Analysing aggregate, anonymised usage patterns to improve features
• Identifying and resolving technical issues
• Developing new functionality based on usage trends

Communications

• Sending transactional emails (account setup, billing receipts, password resets)
• Notifying you of relevant legal or regulatory updates where you have opted in
• Product updates and release notes (you may opt out at any time)

Legal Compliance

• Complying with Irish and EU legal obligations
• Responding to lawful requests from regulatory or law enforcement authorities

5. Legal Basis for Processing

We process your personal data on the following legal bases under GDPR:

• Contract performance — processing necessary to provide the subscription service you have signed up for
• Legitimate interests — improving the platform, preventing fraud, and maintaining security, where these interests are not overridden by your rights
• Legal obligation — where we are required to process data to comply with Irish or EU law
• Consent — for optional marketing communications and for advertising cookies on our public pages, both of which you may withdraw at any time

6. Sub-Processors

We use the following third-party sub-processors to deliver the Ainm platform. Where these sub-processors handle personal data on our behalf, they are bound by appropriate data processing agreements:

SCCs = Standard Contractual Clauses (EU Commission approved mechanism for international data transfers).

7. Data Storage and Security

All customer and employee data is stored on servers located in the European Union (Hetzner, Germany). We implement the following security measures:

• Encryption in transit (TLS 1.2/1.3 for all connections)
• Access-restricted PostgreSQL databases on EU infrastructure, isolated per customer
• Role-based access controls limiting data access to authorised personnel
• Audit logging of data access and changes
• Regular automated backups with retention periods
• No employee data used for AI model training

Where data is transferred to sub-processors outside the EU (Anthropic, Stripe, Resend, Google), we rely on Standard Contractual Clauses approved by the European Commission.

8. Data Retention

• Account data: Retained for the duration of your subscription and deleted within 30 days of account closure, unless we are legally required to retain it longer.
• Employee data: Retained while your account is active and deleted within 30 days of account closure. You may request deletion of specific records at any time.
• Billing records: Retained for 7 years in accordance with Irish tax and accounting requirements.
• AI conversation logs: Retained for up to 12 months for quality and safety review purposes, then deleted.
• Backup data: Backups are retained for up to 90 days before being overwritten.

9. Cookies

The Ainm platform uses essential storage only. We do not use tracking cookies, advertising cookies, or third-party analytics cookies anywhere in the platform.

This token is stored in browser local storage, not a cookie. We do not use Google Analytics, Meta Pixel, or any behavioural tracking technology in the platform.

Public pages (ainm.ai marketing pages, the Pay Transparency Readiness Check and the webinar page)

Our public pages use Google Ads conversion measurement (the Google tag, with Google Consent Mode v2 in advanced mode) so we can tell whether our advertising brings people to the site and whether they go on to make an enquiry, download a resource or book a call. When you first visit, a banner asks for your consent. Until you accept, or if you decline, no advertising cookies are set or read. The Google tag still loads and sends Google cookieless signals: the page address, the time, your browser type, a random number generated afresh on each page load, and a yes/no flag for whether an enquiry, download or booking happened. Google uses these only to estimate aggregate conversion numbers; they are not used to build a profile of you or to personalise advertising. If you accept, the following are used:

If you accept, we also load Apollo.io's website visitor tracking, which tells us which companies (not which people) visit our site. It does not load unless you accept.

Your Readiness Check answers and score, and anything you type into our forms, are not sent to Google. Google processes conversion data under its own privacy policy (policies.google.com/privacy). To withdraw consent, use the Cookie settings link in the footer of our public pages (the banner reappears and you can choose Decline), clear this site's data in your browser, or email fionnan@ainm.ai.

10. Your Rights Under GDPR

As a data subject, you have the following rights in relation to your personal data:

• Right of access — request a copy of the personal data we hold about you
• Right to rectification — request correction of inaccurate data
• Right to erasure — request deletion of your personal data (subject to legal retention obligations)
• Right to data portability — receive your data in a structured, machine-readable format
• Right to object — object to processing based on legitimate interests
• Right to restrict processing — request that we limit how we use your data
• Right to withdraw consent — where processing is based on consent, withdraw it at any time without affecting prior processing

To exercise any of these rights, contact us at fionnan@ainm.ai. We will respond within 30 days. If you believe we have not handled your data correctly, you have the right to lodge a complaint with the Data Protection Commission Ireland at www.dataprotection.ie.

11. Children's Data

Ainm is a B2B platform intended for use by organisations and working adults. We do not knowingly collect personal data from individuals under 18 years of age. If you believe a minor's data has been submitted to the platform, contact us immediately at fionnan@ainm.ai.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or a notice on the platform before the changes take effect. The updated policy will always be available at ainm.ai/privacy.

13. Contact and Data Controller Details