RRoast My X

Privacy Policy

Who we are

Roast My X, including Roast My Launch, is a service operated by UNIHOLIX OÜ, a private limited company registered in Estonia (registry code 17479878), Sepapaja tn 6, 11415 Tallinn, Estonia. We are the controller of the personal data described in this policy. Contact: ceo@uniholix.com.

What we process and why

In this policy, your input means everything you submit to be reviewed: your text, any extra note a report asks for (such as a job ad or a target language), and, for Roast My Launch, the address of a web page and a one-line description.

  • Your input. We send your input to our AI model provider to produce your result: a roast, a writing report or a launch report. We do not keep your input after your result has been produced. Only a one-way fingerprint of your input travels with your payment, so that we can deliver what you paid for. The fingerprint cannot be turned back into your input.
  • Pages you ask us to review. For Roast My Launch, our server reads the one public web page you name, once, and only if the site's robots rules allow it. It sends the visible text of that page to our AI model provider. We do not keep the address, the description or the page.
  • Age choices. If you say you are under 18, the page offers only items for younger users and the AI uses a milder tone. If you confirm that you are 18 or older for an adults-only item, we use that confirmation only to allow the purchase. We do not keep either choice on our servers.
  • Payment data. Our payment processor handles your payment. We receive your email address, your country, the amount, the currency and the payment status, together with your confirmation that you asked for immediate delivery. Your card details go only to the payment processor and never reach us.
  • Emails to us. If you write to us, we use your email address and your message to answer you.
  • Technical data. Our server uses your IP address for a short time to limit the number of requests and to keep the service secure. Our hosting provider keeps standard request logs, such as the IP address, the time and the page requested. These logs do not contain your input.
  • Data on your device. The page keeps your input, your language and your result in your browser's local storage, so that it can show your result when you come back from the payment page. This data stays on your device. You can delete it at any time in your browser settings.
  • No tracking. We do not use analytics or advertising cookies, and we do not use any analytics or advertising trackers.

Your result is produced by AI for your own information. It can be wrong, and it is not professional advice. We do not use it to make any decision about you.

We do not sell your personal data, we do not use it for advertising, and we do not use your input to train AI models.

If you run a website. Our page reader visits a page only when a buyer names it, reads it once and follows the site's robots rules. It identifies itself as UniholixBot, with a link to this policy. To stop it, disallow it in your robots rules or write to us.

The service is for people aged 13 or older (or the higher minimum age in their country), people under 18 may use it only with the permission of a parent or guardian, and we do not knowingly process personal data of younger children.

Legal bases

  • Contract (GDPR Art. 6(1)(b)): producing your result, taking your payment and answering your questions about a purchase.
  • Legitimate interests (Art. 6(1)(f)): keeping the service secure, preventing fraud and abuse, answering other messages, and reading the public page you ask us to review.
  • Legal obligations (Art. 6(1)(c)): keeping accounting records, including payment records, as Estonian law requires.

Who processes it for us

We use service providers that process personal data on our behalf and on our instructions. We describe them here by category.

  • Payment processor: takes payments and emails your receipt. It also processes payment data as an independent controller for its own legal duties, such as fraud prevention, under its own privacy policy.
  • AI model providers: produce your result from your input. We use only commercial services that do not use your data to train their models. They may keep inputs and results for a limited time to detect misuse, under their own terms.
  • Hosting provider: runs the website and keeps request logs.
  • Email provider: receives and stores the emails you send us.

Some of these providers process data outside the European Economic Area, for example in the United States. Where they do, the transfer relies on an adequacy decision of the European Commission or on the Commission's Standard Contractual Clauses.

How we protect it

All connections to the service and to our providers are encrypted. Access to our systems is limited to the people who need it and is protected by two-step sign-in. Card details are handled only by our payment processor.

How long we keep it

  • Your input (text, notes, page addresses, descriptions and the pages we read for you): not kept. It is used only while your result is being produced.
  • Payment records, including the fingerprint of your input and your confirmation of immediate delivery: 7 years, as the Estonian Accounting Act requires.
  • Emails to us: as long as we need them to deal with your request, and no longer than 2 years after it is closed, unless they are part of accounting records.
  • Request and security logs: up to 2 years. Data used to limit requests is held in memory only, for a few minutes.

Your rights

You can ask us to give you access to your personal data, to correct it or delete it, to restrict its processing or to stop processing it, and to give you a copy in a portable format.

To use these rights, email ceo@uniholix.com. We answer within one month. If a request is complex, we may need up to two more months, and we will tell you so within the first month. Because we do not keep your input, we usually hold no personal data about you other than payment records and emails you sent us.

You can also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, AKI, www.aki.ee) or to the data protection authority in the country where you live or work.

Additional notices for some regions

California. If you live in California, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), gives you the right to know what personal information we collect, use and disclose, the right to have it deleted, the right to have it corrected, and the right not to be discriminated against for using these rights. We do not sell or share your personal information, as those terms are defined in that law. To use your rights, email ceo@uniholix.com.

United Kingdom. If you are in the United Kingdom, the UK GDPR and the Data Protection Act 2018 give you the rights described above. You can also complain to the Information Commissioner's Office (ICO).

Brazil. If you are in Brazil, the General Personal Data Protection Law (LGPD) gives you rights that include confirmation that we process your data, access, correction, anonymisation, blocking or deletion, portability, and information about who we share it with. To use these rights, email ceo@uniholix.com. You can also complain to the National Data Protection Authority (ANPD).

Republic of Korea. If you are in the Republic of Korea, the Personal Information Protection Act (PIPA) gives you the right to access your personal information and to ask us to correct it, delete it or stop processing it. To use these rights, email ceo@uniholix.com. Your personal information is processed outside Korea by the service providers described in this policy.

Changes

We may update this policy when the service or the law changes. The current version is always on this page. If a change significantly affects how we process your personal data, we will announce it on the service before it takes effect.