Last updated: 7 October 2026
AI Vision ADS SRL ("we") explains here how we handle personal data on this website and in XPI CRM.
1. Two roles.
- Controller: for your own account data, website visitors and enquiries.
- Processor: for the customer data you and your team put into your workspace (for example your customers' contacts). There we act only on your instructions under our Data Processing Agreement, and your organisation is the controller.
2. What we collect and why.
| Data | Purpose | Legal basis | Kept for |
|---|---|---|---|
| Account: name, email, password (hashed), workspace memberships, preferences | Provide the service, sign-in, security | Contract | While the account exists + 30 days |
| Customer data in workspaces | Provide the service on your behalf | Your instructions (processor) | Until you delete it or close the workspace + 30 days; backups up to 7 days |
| Enquiry form: name, work email, company, job title, team size, message | Reply and discuss the Enterprise plan | Consent / legitimate interest | 24 months or until you ask us to delete it |
| Technical logs: IP address, browser, timestamps, errors | Security, abuse prevention, debugging | Legitimate interest | 90 days |
| Emails we send (confirmations, invites, password resets) | Provide the service | Contract | As above |
We do not sell personal data and do not use it for advertising.
3. Who processes data for us (sub-processors).
| Provider | Purpose | Location |
|---|---|---|
| Supabase (through Lovable Cloud) | Database, authentication, file storage | EU, Ireland (AWS eu-west-1) |
| Lovable | Hosting the application and sending sign-in emails (confirmation, password reset, invites) | Global, served from the Cloudflare edge network (Cloudflare Workers) |
| Resend | Sending Enterprise enquiry notifications | EU, Ireland (eu-west-1) |
| Google Fonts (only with consent) | Fonts | Global |
Transfers outside the EEA/UK use appropriate safeguards (e.g. Standard Contractual Clauses).
4. Cookies and similar storage.
| Group | What it does | Examples | Consent |
|---|---|---|---|
| Strictly necessary | Sign-in session, security, remembering your layout choices and your cookie choice | Supabase auth storage, xpicrm.consent.v1 | Not required |
| External fonts | Loads IBM Plex fonts from Google; Google receives your IP address | fonts.googleapis.com | Only if you allow it |
| Analytics | Not used today. If added, only with your consent | None | Only if you allow it |
Change your choice at any time under Cookie settings.
5. Security. Encryption in transit (HTTPS) and at rest, row-level access rules that separate workspaces, hashed passwords and API keys, an audit log of record changes, and regular backups.
6. Your rights. Depending on where you live, you can ask to access, correct, delete, restrict or export your personal data, object to processing, and withdraw consent. Account holders can export and delete data in the app. For data in someone else's workspace, contact that organisation (the controller). Email adrian@minidigital.tech. You may also complain to a data protection authority, in Romania the National Supervisory Authority for Personal Data Processing (ANSPDCP, www.dataprotection.ro), or the authority where you live.
7. Children. The service is for businesses and not intended for children under 16.
8. Changes. We'll update this page and the date above when things change, and notify account holders of material changes.
9. Contact. AI Vision ADS SRL, Splaiul Independentei 313B, Bucharest, Romania. Email: adrian@minidigital.tech.