aiDIANA — Privacy Policy

Version 1.3 · 24 September 2026 · DOTSOFT S.A. · [email protected]

1. Who we are

aiDIANA is operated by DOTSOFT S.A. – Integrated Information Technology Solutions (“Dotsoft”, “we”, “us”), Poseidonos 71, Pilea 555 35, Thessaloniki, Greece, VAT EL999566850. Dotsoft is the data controller for the personal data described in this policy.

aiDIANA is delivered as a time-limited pilot in the City of Sofia, Bulgaria, together with Sofia Municipality, under the EU-funded CLIMABOROUGH programme (Phase 2, Lot 5 – Sofia). A project by Dotsoft and CLIMABOROUGH, funded by the European Union.

aiDIANA is a project application, not an official service of Sofia Municipality. It is built and operated by Dotsoft for the CLIMABOROUGH project, in co-operation with the city and using municipal information. It does not represent the city, and the city does not answer for it.

Issue reports you submit are passed to the municipal team responsible for waste services. For what it then does with them, Sofia Municipality acts as a separate data controller under its own responsibility and its own notice.

For any question about your data, or to exercise any of the rights in section 8, write to [email protected].

2. What this policy covers

This policy covers the aiDIANA mobile application for iOS and Android, the same application in a web browser at aidiana.dotsoft.gr, and the backend service behind them. It also covers the pages there that host this policy, the Terms of Use and the account-deletion page.

In the browser version, your sign-in details and guest identifier are kept in the browser’s storage rather than your device’s secure storage, the app does not read your location (you pick your district instead), and the map loads Google’s Maps script when you open it.

It does not cover the municipal waste services and websites that aiDIANA refers you to, or the separate tools Sofia Municipality uses to handle the reports it receives. Those are operated under their own notices.

aiDIANA is a free service. There is no advertising, there are no in-app purchases, and we will never ask you for payment details.

3. What data we collect

If you create an account

Other users never see your name. The leaderboard, by district or across the city, identifies everyone by an anonymous code such as “Citizen QXKF”, derived from your account in a way that does not reveal your name or email address. Your display name, your email address and your real name are never shown to another user.

If you continue as a guest

You can use aiDIANA without giving us an email address. In that case the app generates a random identifier for your installation and keeps it in your device’s secure storage, so that your progress is still there next time you open the app. We store only a one-way hash of it, never the identifier itself. It is not derived from your device’s hardware, it is not an advertising identifier, and it cannot be linked to you by anyone else. Before the guest session starts you are asked to confirm that you are 14 or older; that confirmation is not stored. You then go through the same setup as an account holder — the interface language, and optionally your district, household type and interest topics. You can change the language, district and interests later in Settings. Guest accounts are covered in section 10.

What we record as you use the app

Things you write, photograph or locate yourself

Technical data

Traffic to aiDIANA passes through Cloudflare, our content delivery network (section 6), which sees your IP address and keeps its own record of connections. Our web server records, for each request, the connecting IP address, the time, the address requested, the response status, the referring page, the response size, and the browser or app user-agent string. Our application server keeps a separate diagnostic log. This is standard server logging, used to keep the service running and secure.

What we do not collect

• No advertising and no advertising identifiers. No Android Advertising ID, no IDFA, no ad networks, no tracking of you across other apps or websites.
• No third-party analytics and no crash-reporting tool. There is no Google Analytics, Firebase, Sentry or equivalent in the app, the backend or the web pages.
• No background location. aiDIANA never asks for background location and cannot see where you are when you are not using it.
• No location tracking outside the map. Your position is read when you open the map, and shown on it and updated as you move while the map stays open; it is also read when you submit a report with location sharing switched on.
• No contacts, calendar, microphone, health or motion data. The app requests only location, camera, photo library and notification permissions. Notification permission is asked when you first open the app; the others only when the relevant feature is used.
• No push tokens. aiDIANA does not use Firebase Cloud Messaging or Apple Push Notification service. Notifications are created on your own device (see section 12).
• No third-party sign-in. No Google, Apple or Facebook login.
• No payment data, no in-app purchases, and nothing is for sale.
• No special category data. We do not ask for and do not want health, biometric, ethnic, religious, political, trade-union or sexual-life data. Please do not type anything of that kind into the Ask Diana box or a report.
• No date of birth and no gender. We ask you to confirm you are 14 or older, and we do not keep that confirmation or any age figure.
• No messaging between users, and nothing you write is shown to another user.

4. Why we use your data, and on what legal basis

We do not rely on your consent for any of the processing above. Where we rely on legitimate interests you have the right to object — see section 8.

5. The Ask Diana assistant, and what leaves the EU

Diana is an artificial intelligence system, not a person. We say so plainly because the assistant writes in the first person and it would be easy to assume otherwise. Diana can be wrong, and nothing she tells you is official municipal instruction. Check anything important against Sofia Municipality’s own information.

When you send a message to Diana, the following leaves our server:

• the text of your message, exactly as you typed it;
• up to the last ten messages of that conversation, so the assistant can follow the thread;
• the instructions we wrote for the assistant, and the educational material for the episode you are on;
• if your message mentions places, bins, recycling or similar words — which many questions do — the public list of Sofia recycling centres.

We do not send your name, your email address, your account identifier, your district or your location. The provider receives your message; it does not receive you.

The message is handled by OpenRouter, which passes it to a large language model. Requests enter through OpenRouter’s European gateway, and we ask that they be routed only to model providers that do not retain prompts — if none is available the request fails rather than quietly falling back to one that does. The model is Google Gemini 2.5 Flash, and Dotsoft has confirmed that it runs on servers in the European Union. Your message is therefore not transferred outside the EU.

What we keep. Your messages and Diana’s replies are stored in our database as your conversation history, so you can scroll back through them, and are deleted twelve months after they were sent. Because free text is unpredictable, please do not type personal details, other people’s names, addresses, or anything sensitive into the Ask Diana box.

Limits. There is a cap on how many messages you can send per day, and a limit of 1,000 characters on each one.

No automated decisions about you

Nothing in aiDIANA makes a decision about you by automated means. Your points, streak, badges and leaderboard position are simple arithmetic on the actions you took. There is no profiling for advertising, no scoring of you as a person, and no decision with a legal or similarly significant effect on you is taken automatically. Which learning content is suggested to you next follows the fixed episode structure and the topics you chose, not an inference about you.

6. Who we share your data with

We do not sell personal data and we do not share it for advertising. We share it only with the following.

We may also disclose data where the law requires it, or to establish or defend legal claims. A current list of our processors is available on request from [email protected].

Where your data is held, and transfers outside the EU

Your account, learning progress and reports are held on Dotsoft’s own on-premises servers in Greece, inside the European Union. The Ask Diana assistant also runs on servers in the European Union, as described in section 5.

Two things can reach recipients outside the EU: traffic passing through Cloudflare’s global network, and the map tile requests your device makes to Google Maps when you open the recycling centre map, which carry your IP address. Both rely on the safeguards required by Chapter V of the GDPR. Nothing else is transferred outside the EU and EEA.

7. How long we keep your data

At the end of the pilot we delete or irreversibly anonymise all personal data, other than anything we must keep by law.

8. Your rights

Under the GDPR you have the right to:

• Access — ask for a copy of the personal data we hold about you.
• Rectification — have inaccurate data corrected. You can change your district, interests and language yourself in Settings, and your display name if you have a full account. For anything else, write to us.
• Erasure — have your data deleted. See section 9; you can do this yourself in the app.
• Restriction — ask us to stop using your data while a question about it is resolved.
• Object — object to processing we base on our legitimate interests.

Write to [email protected] and we will reply within one month.

If you are not satisfied with how we handle your request, you can complain to your data protection authority. In Bulgaria that is the Commission for Personal Data Protection (Комисия за защита на личните данни, cpdp.bg). You may also complain to the Greek authority, the Hellenic Data Protection Authority (dpa.gr), or to the authority where you live.

9. Deleting your account

You can delete your account at any time:

• if you have a full account, in the app at Profile → Settings → Delete account, or on the web at aidiana.dotsoft.gr/delete-account;
• if you are using a guest session, by tapping Sign out — which deletes the guest account, because there is no email address with which to sign back in. The app warns you before it does;
• by writing to [email protected].

Deletion is immediate and cannot be undone. It removes your account and everything tied to it: your profile, points history, streak, badges, learning and mission progress, quiz answers, mission check-ins, survey answers, notifications, your entire Ask Diana conversation history, and every issue report you submitted, with its photo, notes, typed location and coordinates. The sign-in tokens and identifier stored on your device are cleared too; our server’s records of those tokens can no longer be used and are deleted on the schedule in section 7. Centres you bookmarked stay on your device until you remove the app.

What is not affected: aggregated statistics that were already irreversibly anonymised, which cannot be traced back to you; and anything municipal staff already recorded outside aiDIANA while handling one of your reports, which Sofia Municipality holds under its own notice (section 1).

Server logs, which contain your IP address, are not deleted on request — they age out on the schedule in section 7.

10. Guest accounts

You can use almost all of aiDIANA without giving us an email address. A guest account is held against the random installation identifier described in section 3, kept in your device’s secure storage, and stored on our side only as a one-way hash.

What that means in practice:

• your progress survives closing the app, and is restored automatically on the same installation;
• if you delete the app, get a new phone, or clear its data, the identifier is gone and the guest account cannot be recovered — not by us either;
• you can turn a guest account into a full account at any time by adding an email address and a password, and your progress carries over;
• a guest account whose session is not opened for 12 months is deleted.

11. Location, photos and reports — how they actually work

Location

aiDIANA asks for location permission in two places only: when you open the recycling centre map, and when you submit an issue report with location sharing switched on. Location sharing on a report is off by default — you turn it on if you want it, or type a location instead. A report reads your position once, when you submit it. The map reads it when it opens and, while it stays on screen, shows your position and updates it as you move. Both work only while the app is open. The permission is “while using the app” only, and aiDIANA has no background location permission at all.

You can decline. If you do, the map still works — you pick your district from a list instead.

Map coordinates are used to sort centres by distance, are not stored in our database, and are sent in a way that keeps them out of our web-server logs. Coordinates attached to a report are stored, because the municipality needs to know where the issue is.

Photos

The camera and photo library are used in one place: attaching a photo to an issue report. You choose whether to take a new photo or pick an existing one, you can remove it before you submit, and nothing is uploaded until you press submit. aiDIANA never reads your photo library on its own and never uploads a photo you did not attach.

Every photo is re-encoded on our servers before it is stored, so the metadata a camera writes into a photo file — including the GPS coordinates of where it was taken — is removed whatever your device sends. Stored photos are not publicly reachable: viewing one requires a signed link that expires after an hour.

Even so, please avoid photographing people, faces, vehicle number plates or anything else that identifies someone. Photograph the waste, not the neighbours.

Reports

A report is a message to Sofia Municipality. Assume that municipal staff will read it, along with anything you typed and any photo you attached. There is no way to withdraw a single report from within the app; write to us if you need one removed. Deleting your account deletes all of your reports.

12. Notifications

aiDIANA does not use a push service. Instead, while the app is installed, it checks periodically in the background whether the service has anything new for you and, if so, shows a notification created on your own device. Nothing about you is sent to Apple or Google in the process, and no push token exists.

You control notifications in two places: the categories in the app’s Settings, and your device’s own notification settings, which override everything.

13. Children

aiDIANA is intended for people aged 14 or over — the age from which, under Bulgarian law, a person can consent to an information society service for themselves. You are asked to confirm this when you register or start a guest session, and neither can be completed without it. We do not keep that confirmation and we do not ask for your date of birth or your age.

The app is not designed for younger children and contains no content aimed at them. If you believe a child under 14 has created an account, write to [email protected] and we will delete it.

14. Security

Data is encrypted in transit using HTTPS. Traffic reaches us through Cloudflare, our content delivery network, which terminates that encryption in order to filter and forward it, as described in section 6.

Passwords are stored only as secure hashes, never in readable form. They must be at least 8 characters long, may not be all digits or one of the most commonly used passwords, and may not contain the app, partner or city names. Repeated failed sign-in attempts on an account are rate-limited. Sign-in tokens are held in your device’s secure storage — the iOS Keychain or the Android Keystore — or, in the browser version, in the browser’s storage. The account-deletion page signs you in so that you can delete your account; on a shared computer, close the browser and clear its data afterwards.

The servers are Dotsoft’s own, on its premises in Greece. The database is not reachable from the public internet, uploaded photos require a signed link that expires, access is limited to the Dotsoft staff who need it for their work, and administrative interfaces require a staff account. Through those interfaces, authorised staff can view account details, reports and Ask Diana conversations.

No system is perfectly secure. If a breach affects your rights and freedoms we will notify the competent supervisory authority within 72 hours and tell you directly where the law requires it.

15. Changes to this policy

If we make a material change we will tell you in the app before it takes effect, and where the law requires it we will ask for your consent again. The version and date at the top of this document always tell you which text is current.

16. Contact