Privacy Policy – Dotika.ai

    Last updated: 10 August 2026

    Dotika S.à r.l. · 9, rue du Laboratoire, L-1911 Luxembourg · RCS Luxembourg B296675 · TVA LU36653351

    Document exported on 10 August 2026 — Source: http://127.0.0.1:4173/en/privacy

    Dotika S.à r.l. · 9, rue du Laboratoire, L-1911 Luxembourg · RCS Luxembourg B296675 · TVA LU36653351 · dotika.ai
    Dotika
    Privacy Policy

    Privacy Policy – Dotika.ai

    Last updated: 10 August 2026

    1. Introduction

    Dotika Sàrl ("Dotika", "we", "our") is committed to protecting your privacy. This policy explains how we collect, use, store, and safeguard personal data when:

    • You visit the website https://www.dotika.ai/
    • You use our advisory and training services (Dotika Advisory, Dotika Campus, Dotika Insights).
    • You access and use our Bryf.ai software solution (SaaS platform, iOS and Android apps).

    This policy therefore covers both our corporate website and the Bryf platform, whether you are an end user or a client of our services. It is drafted in accordance with Regulation (EU) 2016/679 ("GDPR") and the Luxembourg Data Protection Act of 1 August 2018.

    Dotika is the data controller for both scopes, which is why they are covered by a single document. To find your way around: if you are simply browsing dotika.ai, only the website sections concern you (contact form, newsletter, cookies, the “Dotty” assistant, job applications, registrations). Sections explicitly marked “Bryf” apply only to users and clients of the Bryf.ai platform.

    In short: We only collect the data we genuinely need, keep it for a limited time, never sell it, and you stay in control at all times.

    2. Data Controller

    Dotika Sàrl

    9, rue du Laboratoire

    L‑1911 Luxembourg

    RCS Luxembourg B296675

    E‑mail: contact@dotika.ai

    +352 621 786 827

    Data Protection Contact

    For any questions about personal data protection, please contact us at:

    privacy@dotika.ai

    3. Data We Collect

    We collect data in the following situations:

    a) Contact form:

    • First name, last name
    • Email address
    • Phone number (optional)
    • Company name (optional)
    • Message

    b) Analytics cookies (with consent):

    • Pages visited
    • Time spent
    • Browser type
    • Approximate location (city/country)
    • Referring site

    c) Newsletter subscription:

    • Email address
    • First name (optional)
    • Subscription preferences

    d) Bryf.ai platform:

    • User account: first name, last name, email address
    • Usage data: login logs, actions performed within the platform, user preferences
    • Content processed in Bryf: feedback to improve scoring, usage history, projects created, and any other data you upload depending on the selected purpose

    e) Newsletter feature within Bryf:

    • Subscribers’ email addresses (and optional first/last name, if provided)
    • Subscription preferences (topics, frequency)
    • Content drafted and managed by the user
    • Email analytics: opens, link clicks, bounces, unsubscribes

    f) “Dotty” conversational assistant (dotika.ai website):

    • The content of the messages you type and of the answers generated
    • A conversation identifier and a session key minted by our server (no account, no identification by name)
    • The language of the exchange and the timestamp of each message
    • A salted cryptographic hash of your IP address, used solely to limit abuse and request volume — it cannot be reversed to your IP address
    • We automatically filter out e-mail addresses and phone numbers found in the text before anything is stored. Please do not share sensitive or confidential data with the assistant

    g) Job applications and recruitment:

    • First name, last name, e-mail address
    • CV and, if you choose to record one, an introduction video
    • Role applied for and any information you send us spontaneously

    i) AI maturity assessment:

    • First name, last name, company, e-mail address, phone number
    • All of your answers to the questionnaire and the scores calculated from them
    • The PDF report generated from those answers, which is sent to you by e-mail

    h) Event and training registrations:

    • First name, last name, e-mail address, company
    • Event or session concerned, and actual attendance

    4. How We Use Your Data

    • Respond to your inquiries and provide requested services
    • Send you our AI newsletter (only if subscribed)
    • Improve our website and services through analytics
    • Operate our “Dotty” conversational assistant: generate an answer to your question, keep track of the thread and — in aggregate form — understand recurring topics so we can improve our content
    • Prevent abuse and keep our services secure (request rate limiting, detection of misuse)
    • Process job applications and manage registrations for our events and training sessions
    • Produce your AI maturity assessment, send you the report and follow up with you about it if you wish
    • Comply with legal obligations

    Data collected in Bryf is used to provide the platform’s features (account management, content generation, newsletter delivery, and analytics).

    We never sell your data to third parties or use it for purposes other than those listed above.

    5. Legal Basis

    • Consent (Article 6.1.a GDPR): For newsletter subscriptions and analytics cookies
    • Contract execution (Article 6.1.b GDPR): To fulfil your service requests, deliver our advisory and training engagements, and process Bryf payments via Stripe
    • Legitimate interests (Article 6.1.f GDPR): To improve our services and prevent fraud

    6. Data Retention

    • Contact form data: 3 years from the last interaction
    • Analytics data: 26 months
    • Newsletter data: Until you unsubscribe
    • Bryf account data (profile, preferences): retained while the account is active, then up to 12 months after deletion to meet legal obligations
    • Bryf technical logs and usage data: 12 months, unless a longer retention period is legally required
    • Content created or uploaded in Bryf: kept for as long as the related project or workspace remains active, then deleted or anonymized when closed
    • Bryf payments: billing data is retained for the applicable statutory period; payment card details are processed exclusively by Stripe and never stored by Dotika
    • Conversations with the “Dotty” assistant: 60 days, after which the messages and the conversation are deleted automatically by a scheduled job
    • Technical security logs for the assistant (salted IP hashes, refused exchanges): 60 days
    • Job applications: 12 months after the recruitment process closes, unless you agree to a longer retention period for future opportunities
    • Event and training registrations: 3 years after the event, for business relationship and record-keeping purposes
    • AI maturity assessment: 3 years from the date of the assessment, including answers and report

    At the end of these periods, data is deleted or anonymised. Conversations with the “Dotty” assistant are purged automatically by a scheduled job; for the other processing activities, deletion is carried out during our periodic reviews. You may at any time request immediate deletion of your data by writing to privacy@dotika.ai, and we act on it within the one-month period provided for by the GDPR.

    7. Data Sharing

    We only share your data with:

    • Our technical providers (hosting, email, analytics) under strict confidentiality agreements
    • Competent authorities when required by law
    • Stripe Payments Europe, Ltd. (and Stripe, Inc. in the United States where applicable) for secure payment processing on the Bryf platform, in accordance with Article 28 GDPR and the EU Standard Contractual Clauses. No payment is collected on dotika.ai
    • Our emailing providers (SMTP services, email hosting) to enable the delivery and tracking of newsletters created within Bryf
    • Our language model providers (LLMs) such as OpenAI, Anthropic, Mistral, or equivalent vendors, who temporarily process your data solely to generate responses. The data is not used to train their models unless explicitly stated and subject to prior consent
    • Anthropic PBC (United States), for the “Dotty” conversational assistant on dotika.ai: the content of your messages is sent to it in order to generate the answer. Anthropic acts as a processor, does not use this data to train its models, and the transfer is governed by the EU Standard Contractual Clauses
    • Supabase Inc., which hosts the website’s database and server functions in the European Union (contact forms, job applications, registrations, assistant conversations)
    • Netlify, Inc. (United States), which hosts and delivers the website pages and therefore processes technical connection data
    • Resend, Inc. (United States), which delivers our transactional e-mails: contact confirmations, application acknowledgements, registration confirmations and reminders. The transfer is governed by the EU Standard Contractual Clauses
    • Google Ireland Limited, for audience measurement via Google Analytics 4, only where you have consented to it

    All our providers are located in the EU or offer adequate protection (Standard Contractual Clauses and, where applicable, the Data Privacy Framework).

    8. Your Rights

    Under GDPR, you have the right to:

    • Access your personal data
    • Rectify inaccurate data
    • Request deletion ("right to be forgotten")
    • Restrict processing
    • Data portability
    • Object to processing
    • Withdraw consent at any time
    • Manage or delete your Bryf account
    • Request deletion of your data hosted in Bryf

    To exercise these rights, contact us at: privacy@dotika.ai

    Newsletter subscribers managed by our clients through Bryf also have rights (unsubscribe, deletion, etc.). Bryf provides tools so our clients can fulfil these requests.

    When a client uses Bryf to manage a newsletter, they remain the data controller for their subscribers. Dotika acts as a data processor and handles this data only on the client’s instructions, in line with Article 28 GDPR.

    You may also lodge a complaint with the CNPD (Luxembourg data protection authority): https://cnpd.public.lu

    9. Security

    We implement appropriate technical and organizational measures:

    • HTTPS encryption for all data transmission
    • Regular security audits
    • Access limited to authorized personnel
    • Regular backups with encryption
    • Automatic filtering of e-mail addresses and phone numbers in exchanges with the “Dotty” assistant before anything is stored
    • IP addresses processed as a salted cryptographic hash, never in clear text, for abuse limitation

    10. Cookies

    Other than strictly necessary cookies, we only set a cookie with your prior consent. You can change or withdraw it at any time via the “Manage cookies” link at the bottom of every page. The full inventory, including retention periods, is set out in our Cookie Policy.

    • Necessary cookies: storing your consent choices, your language, and the thread of your conversation with the “Dotty” assistant
    • Analytics cookies: audience measurement via Google Analytics 4, with IP anonymisation — loaded only after your consent
    • Marketing cookies: no advertising, retargeting or social network cookie is set on dotika.ai to date

    11. Children

    Our services are not intended for children under 16. We do not knowingly collect data from minors.

    12. Changes to This Policy

    We may update this policy. Significant changes will be communicated via our website or email (for subscribers).

    13. Contact

    For any privacy-related questions:

    • Email: privacy@dotika.ai
    • Postal: Dotika Sàrl, 9, rue du Laboratoire, L‑1911 Luxembourg