ALBeID company and website privacy policy

Product privacy policies

Each ALBeID product has its own privacy policy, which describes how the product itself handles data. This page does not replace it, and the products do not necessarily share the same practices.

Any future ALBeID product, such as a digital identity wallet or a server-based identity verification service, will have its own privacy policy, listed here, before it processes any personal data.

1. Visiting the website

The pages are static documents. There is no login, contact form, newsletter or comment box. The site sets no cookies, uses no local storage and contains no analytics, advertising, social media buttons or tracking pixels. Fonts and images are served from the site itself.

Two services handle your request when you open a page:

• Cloudflare. The albeid.eu, albeid.al and albeid.ee domains are served through the network of Cloudflare, Inc., which protects the site against attacks and delivers it quickly. Cloudflare receives each request before the server does and handles the encrypted connection with your browser. It therefore processes your IP address, the address requested, your browser's identification and the other details of the request. Cloudflare acts as ALBeID OÜ's processor under its data processing addendum.
• Hetzner. The server is located in Germany and rented from Hetzner Online GmbH, which stores the server and its logs only on ALBeID OÜ's behalf, under a data processing agreement.

The server records standard technical information about each request: the IP address, the date and time, the address requested and the browser identification. These logs exist only to keep the service secure and working, for example to detect abuse or diagnose faults. ALBeID OÜ does not use them to identify, profile or follow visitors, does not combine them with other data and does not share or sell them. They are kept for one week and then deleted. Cloudflare also handles request data while delivering and protecting the site, under its data processing addendum.

Two Cloudflare features are switched on:

• Email address protection: this Cloudflare feature, which hides email addresses from spam robots with a small script, is switched on for the site. The addresses on these pages are excluded from it, so no script is added and they stay readable without JavaScript. It does not track you.
• Network error reports: the site asks browsers to tell Cloudflare when a page fails to load because of a network error. If that happens, your browser may send Cloudflare a short report with the address requested, the type of error and your IP address. Successful visits are not reported.

The legal basis for all of this is ALBeID OÜ's legitimate interest in operating a secure and reliable website, under Article 6(1)(f) of the General Data Protection Regulation (GDPR).

Your right to object. You have the right to object at any time to the processing of server logs concerning you. ALBeID OÜ will then stop, unless it has compelling legitimate grounds that override your interests, such as defending the server against an ongoing attack.

2. Public file downloads

ALBeID OÜ publishes public files on albeid.eu for the evID app: the trust material used to verify identity documents, the list of available languages and the language packs. These downloads go through the same Cloudflare and Hetzner infrastructure and are logged in the same way, for the same purpose and for the same week. A download request contains the device's IP address and the standard request details. It contains no document data: evID never includes document fields, access keys or facial images in these requests. A download is not an upload of a document. How the app handles document data on the device is described in the evID privacy policy.

3. Emails and support requests

When you write to ALBeID OÜ, it receives your email address, your name if you give it, your message, any attachments you choose to send, and the technical details that every email carries. ALBeID OÜ uses them to answer you, to provide the support you ask for and, where a message reports a problem, to fix and improve its products. The legal basis is its legitimate interest in answering correspondence and supporting its products (Article 6(1)(f) GDPR) or, where your message concerns a contract with ALBeID OÜ, the steps needed for that contract (Article 6(1)(b) GDPR).

Email for albeid.eu is provided by Google Workspace, which processes messages on ALBeID OÜ's behalf under Google's data processing terms. Correspondence is kept as long as needed to deal with your request and any follow-up. Messages that become part of the company's business records are kept as described in section 5. You can ask at any time for your correspondence to be deleted.

When asking for help, please do not send images of identity documents, access keys (the MRZ or CAN), document numbers or raw chip data. Describe the problem, and remove any personal data from screenshots before sending them.

4. App store diagnostics and beta feedback

Apple and Google distribute ALBeID's apps under their own privacy policies, as independent controllers: Apple through the App Store and, for beta testing, TestFlight; Google through Google Play. ALBeID OÜ receives from them:

• crash reports and diagnostics, through App Store Connect and the Google Play Console, only from people who have chosen in their device settings to share such data with app developers;
• from TestFlight testers, the feedback, screenshots and crash reports they choose to send, with the device details Apple attaches, and, for testers invited by email, the name and email address used for the invitation.

ALBeID OÜ uses this information only to run beta tests, answer testers, and fix and improve its apps, based on its legitimate interest in doing so (Article 6(1)(f) GDPR). It stays in App Store Connect and the Google Play Console under Apple's and Google's retention rules. Any copy ALBeID OÜ makes, for example of a bug report, is deleted once it is no longer needed for that purpose.

This is not the same as an analytics tool built into an app. The evID app contains no analytics, advertising or tracking code. Store diagnostics come only from the store and the operating system, and only if you allow them in their settings.

5. Business contacts and legal records

When ALBeID OÜ deals with customers, suppliers or partners, it processes the names and contact details of the people it deals with, together with contracts, orders, invoices and related correspondence. The purposes are to carry out the contract, run the business and meet legal obligations such as accounting and tax law (Article 6(1)(b), (c) and (f) GDPR). Accounting source documents are kept for seven years, as the Estonian Accounting Act requires. Other business records are kept as long as the business relationship and any legal claims require. Data is passed to public authorities only where the law requires it.

Recipients and international transfers

ALBeID OÜ does not sell personal data and does not share it for advertising. The only other organisations that process it are:

• Hetzner Online GmbH, Germany: server hosting, as processor;
• Cloudflare, Inc., United States, with a worldwide network: delivery and protection of the websites, as processor;
• Google: email through Google Workspace, as processor, and app distribution through Google Play, as an independent controller under its own privacy policy;
• Apple: app distribution and beta testing, as an independent controller under its own privacy policy.

Cloudflare and Google may process data outside the European Economic Area, including in the United States. These transfers rely on the EU–US Data Privacy Framework, under which both companies are certified, and on the European Commission's standard contractual clauses included in their data processing terms.

Links to other sites

The site links to other websites, such as the Estonian e-Business Register. When you follow such a link, the other site's own privacy policy applies.

Your rights

You are not obliged to provide any personal data to ALBeID OÜ. Without your device's IP address, however, a page or file cannot be delivered to you, and without an email address ALBeID OÜ cannot reply to you. Data needed for a contract or required by law, such as invoicing details, must be provided for that contract to be concluded.

Under the GDPR you have the right to access the personal data held about you, to have it corrected or erased, to restrict its processing, to receive it in a portable format where that applies, and to object to its processing. ALBeID OÜ answers every request within one month. No automated decision-making or profiling takes place.

You also have the right to lodge a complaint with the supervisory authority of the country where you live or work, or with ALBeID OÜ's lead authority, Estonia's Data Protection Inspectorate (Andmekaitse Inspektsioon).

Contact

The controller is ALBeID OÜ, registry code 16874333. Its registered address is public in its entry in the Estonian e-Business Register. For any privacy question or request, write to a.vrushi@albeid.eu.

Changes to this policy

If this policy changes, the new version is published on this page with a new number and date, and earlier versions remain available. Version 1 was published on 9 October 2026. Version 2 names the services behind the websites, Cloudflare, Hetzner and Google Workspace. It also covers emails and support, app store feedback and business records, and adds the list of product privacy policies.