Integritetspolicy

1. Controller

DATA-TAKOMO OY, business ID 3350883-9, Valtatie 12, 46900 Inkeroinen, Finland.

Contact for privacy matters: privacy@data-takomo.fi.

2. Personal data we process

• Sign-in details. With Google (the Android app): your name, email address, the identifier of your Google account and the other profile details Google provides, such as the address of your profile picture. With Apple (the iPhone app): the identifier of your Apple Account, an email address, which may be a private relay address Apple creates, on the first sign-in the name you chose to share, and a token from Apple with which we can ask Apple to revoke the link between your account and Ayveena (section 8). For each sign-in session: when it started and was last used. Signing in goes through our API server, so the IP address and device recorded with a session are our server’s, not yours.
• Tester list. If you were invited to test the service before its release, your email address, the date it was added and a short note are on the list that allows an account to be created.
• Profile and settings. The name Ayveena calls you, your speech language and Ayveena’s look: the outfit and hairstyle she wears. The time zone your phone is set to (for example Europe/Helsinki) and its offset from UTC, which the app sends with each call: Ayveena is told your local date and time from them, and we keep the latest time zone with your account to count how many users are in each time zone. Never a place or your precise location, and not the phone’s clock. The voice you chose is sent with each call but not stored on our servers.
• Calls. When each call started and ended, its length, the credits it used, why it ended, the IP address the call came from, the call’s scene and mood (Ayveena’s virtual surroundings, not your location), and the identifier OpenAI gives the call, which we use only when we look into a call with OpenAI. Transcripts: the text of what you and Ayveena said in a call. Your voice is processed in real time during the call and is not recorded or stored. If OpenAI’s moderation stops a call, we record when it happened, whose turn it was (yours, Ayveena’s or not known) and the error code, not what was said.
• Your country when a call starts. When you start a call, we check from the country your connection comes from (worked out from your IP address by Vercel, the host of our API server) that the service is available there: calls go through OpenAI, and a call can only be started from the countries where OpenAI offers its services. Only the country is used, never a city or a more exact location. The one exception is Ukraine: there the region is checked too (for example Crimea or the Donetsk region), because the service cannot be used from regions under sanctions. Neither the country nor the region is stored with your account. If the country or region is not one the service covers, the call does not start, and our service log records the refusal and the country code.
• Web searches. When Ayveena looks something up on the web during a call, the search query and the country your connection comes from (worked out from your IP address) are sent to OpenAI’s search tool (section 4). We do not store the query separately; what you asked and what Ayveena said are in the transcript. The addresses of the search’s source pages are shown in the app but kept only in your phone’s memory.
• Ayveena’s memories. Facts you explicitly asked Ayveena to remember during a call.
• Credits and purchases. Your credit balance and how it changed, credit purchases and subscriptions (the product, quantity, price, currency, store and the store’s order number), and the items you own. When you buy, the app gives the store a random reference to your account from which your name or email address cannot be worked out (obfuscatedAccountId on Google Play, appAccountToken on the App Store). It links the purchase to the right account also when the store tells us about it directly.
• Feedback, reports and requests. What you send in the app or on the Your account page: your message and its kind. A report about something Ayveena said, made during a call, names that call (or the previous one) automatically. App details are attached only if you choose to in the app’s feedback: app version and build, platform, device model, operating system version, app language, the app’s server environment and when your last call was. Requests about your data sent from the Your account page also carry your account’s email address, so we can answer.
• Notices to you. When you acknowledged in the app a notice about a change to the terms, this policy or the service, and for notices sent by email a delivery record (user identifier, environment, status and time), so we can show that the notice was sent.
• Use of the Your account page. For each download of your data: when it happened and the IP address.
• Actions we take on your account. For example free credits we grant or a suspension, with the reason and who made the decision, and a record of which of our staff looked at your account’s details or a call’s transcript, and why.

Data stored on your phone. The app keeps your sign-in on your phone (your user identifier and the token needed to renew the sign-in, in the system’s secure storage) and your settings: the voice you chose, the app language, captions on or off, Ayveena’s skin tone, camera motion, light lip sync and whether you have seen the AI notice. It also keeps a cache so that Ayveena loads faster. These are needed for the app to work and do not leave your phone other than as described above. Your sign-in is removed from the phone when you sign out, and all of it when you delete the app.

Crash reports. If you have allowed your phone to share diagnostics with app developers, Apple or Google sends us a report when the app crashes or stops responding: the device model, the operating system version, the app version and a technical description of the error. The reports do not contain your name, your email address or what was said in your calls, and we do not link them to your account. Apple and Google handle them under their own privacy policies, and you can stop the sharing in your phone’s settings.

What you say in a call can reveal things about your health, beliefs, sex life or other special categories of personal data. We do not ask for them, but if you mention them, they can appear in the transcript. Ayveena’s memories never keep them, even if you ask her to remember them. We process this information only with your explicit consent (section 3).

Signing in is required to use the service. Everything else above is created by using it.

3. Purposes and legal bases

• Providing the service - your account and sign-in, calls with Ayveena, transcripts, memories you ask for, the web searches she makes for you during a call (section 4), checking when a call starts that the service is available in the country your connection comes from (section 2), your settings, items and credits: performance of the contract between you and us (GDPR Article 6(1)(b)).
• Payments and bookkeeping - purchase records: the contract, and our legal obligation under the Finnish Accounting Act (Article 6(1)(c)).
• Security and preventing abuse - sign-in sessions, the IP addresses of calls and data downloads, limits on how often things can be done, checking memories and display names with automated moderation, records of our staff’s access to your details, and suspending or closing accounts that break the terms: our legitimate interest in keeping the service safe and working (Article 6(1)(f)). For those limits we count, in short time windows, how many requests come from your account or your IP address; of the address we store only a hash made with a secret key, never the address itself.
• Following calls stopped by moderation - when and on whose turn OpenAI’s moderation stopped a call, and the call’s OpenAI identifier: our legitimate interest in knowing how often moderation stops harmless calls and in taking cases up with OpenAI (Article 6(1)(f)).
• Feedback, reports and support - handling what you send us and improving the service on the basis of it: our legitimate interest (Article 6(1)(f)).
• Answering requests about your data - our legal obligation under the GDPR (Article 6(1)(c)).
• Notices about changes to the service, the terms or this policy: the contract and, where the law requires a notice, our legal obligation.
• Statistics - counts of calls, credits and use, and the number of users per language and time zone with groups of fewer than five users merged: our legitimate interest in running and planning the service. Our staff see only counts, and they identify nobody.
• Safety statistics - after a call, what you said in it is checked once by OpenAI’s automated moderation, so that we know how often calls touch on self-harm, violence or similar risks. The text is processed only for that moment and is not stored; we keep only anonymous daily counts per category, with no link to you or to the call, and show them to our staff only as monthly totals in which small numbers are hidden. Basis: the same explicit consent as the call itself for the sensitive information involved, and our legitimate interest in keeping the service safe.

Where we rely on legitimate interest, you can object to the processing (section 7).

We do not use your data for advertising, we do not sell it, and we make no decisions about you based solely on automated processing that have legal or similarly significant effects. The moderation of memories only decides whether a fact is saved.

Sensitive information in calls (section 2): your explicit consent (GDPR Article 9(2)(a)). Before your first call the app explains what happens to what you say, including that Ayveena may look things up on the web for you during a call (section 4), and asks for this consent with a separate switch that is off until you turn it on. You can also give the consent earlier: when you start using the app (section 9), the app shows the same information and the same switch and asks whether you want to give the consent now or later. There it is optional: if you choose later, nothing changes, the rest of the app works without the consent, and the app asks for it before your first call. We record when you gave it and to which version of the text. When the text changes, the app asks for the consent again. Calls need this consent, because a call cannot be held without processing what you say in it. You can withdraw it at any time in the app’s settings or on the Your account page (section 7); after that no new call starts until you give it again, and you can delete your transcripts at any time. The app asks you to confirm that you are 18 or older, with a switch of its own, already when you start using the app (section 9).

4. Recipients and processors

(Preliminary, to be reviewed before publication.)

We do not sell personal data and do not pass it on for anyone else’s marketing. Only those of our staff whose work requires it see account details in the admin panel; a call’s transcript can be opened only with a recorded reason, and every opening is recorded. The service is run with the help of the service providers below, each for the purpose named here. Each of them processes data on our behalf under a data processing agreement, except Google and Apple for sign-in and the app stores, where they are independent controllers. (Gap: that each agreement has been accepted must be confirmed before this policy takes effect.)

• Supabase runs the databases that hold your account, profile and settings, your calls and their transcripts, Ayveena’s memories, credits and purchases, and the feedback and reports you send, and it also handles the sign-in session. A separate database of the same kind holds the admin panel’s own records, such as requests about your data, whether sent with the form on the Your account page or to the contact in section 1. The databases run in the EU, in the eu-central-1 region (Frankfurt). Our contracting party is Supabase Pte. Ltd (Singapore), whose support may reach the data from outside the EU (section 5).
• Google is the sign-in provider of the Android app. You sign in with your Google account, and Google gives us your name, your email address and the identifier of your Google account. Google decides on its own what it does with the sign-in, under its own privacy policy.
• Apple is the sign-in provider of the iPhone app (Sign in with Apple). Apple gives us the identifier of your Apple Account and an email address, which is Apple’s private relay address if you chose to hide your own, and on the first sign-in the name you chose to share. Apple decides on its own what it does with the sign-in, under its own privacy policy.
• Vercel runs the app’s API server and this website. The API’s functions run in the fra1 region (Frankfurt). Vercel also records the addresses of visitors to the website in its own logs.
• Railway runs the call service, which opens the call session, follows it and stores the transcript, and the admin panel we use to answer requests about your data. Both run in the europe-west4 region (Amsterdam).
• OpenAI is the AI service of the call and of picking out memories, and it runs in the United States. During a call, your speech and Ayveena’s replies are processed by OpenAI’s service in real time. OpenAI does not keep a recording or the conversation after the call, because we do not turn its storage on; web searches are the exception (below). When Ayveena picks out the things you asked it to remember, the text is sent to OpenAI without storage, and the same service checks the text with automated moderation. The same moderation receives the display name you choose in the app before it is used, and after a call what you said in it, for the safety statistics (section 3); OpenAI stores neither. OpenAI does not use the data to train its models. OpenAI keeps logs for monitoring abuse of its service for up to 30 days, unless the law requires longer retention. During a call Ayveena can also look something up on the web when you ask about something current or checkable, such as the weather, a result or opening hours. Your question is then handed to a second OpenAI model, which writes a search query for OpenAI’s web search tool; the tool searches the web, and Ayveena tells you the answer. That search assistant is instructed to write the query without your name, contact details, health or other personal details, and to treat what the search finds only as information, never as instructions. So that local results such as the weather are for the right country, the search tool is also told the country your connection comes from, as our API server’s host Vercel works it out from your IP address; never a city or a more exact location. The same country is used when a call starts to check that the service is available in your country (section 2). We do not store the query separately: what you asked and what Ayveena tells you are part of the transcript like the rest of the call. The app shows the search’s source pages as links; if you open one, your browser connects to that website, which sees your IP address and handles it under its own privacy policy. OpenAI can store the search part of the call - the query, what the search found and the answer made from it - for up to 30 days under its own terms, because OpenAI handles searches under the data controls of its separate Responses service, and that storage cannot be turned off for a search made during a call. OpenAI does not use the data to train its models. (Gap: whether OpenAI’s search tool passes the query on to a search provider of its own has to be checked before this policy takes effect.)
• Google Cloud runs a separate watch that hangs up calls whose paid time has run out even when the call service is unavailable. It is a job in the europe-north1 region (Hamina, Finland) that reads each environment’s database every five minutes. It sees only the rows that say which calls are running and until when they are paid for, and it writes back the mark of a hangup and counts of what each pass did. It does not read transcripts, memories or profiles. The five-minute timer that starts it runs in the europe-west1 region and carries nothing about a call. Google Cloud also stores our own nightly backup copies of the databases (section 6), encrypted, in the europe-north1 region (Finland); each copy is deleted automatically after 29 days.
• Cloudflare runs the name service (DNS) of our domains and redirects our other domains (ayveena.fi, ayveenaai.com, ayveenaai.fi) to www.ayveena.com. When you open one of those addresses, Cloudflare sees your IP address and browser details for the redirect and keeps them in its logs for a short time. It does not see your use of the app or of www.ayveena.com, which do not pass through it.
• Mailgun (Sinch, Sweden) sends our email, in Mailgun’s EU region: alerts to our own administrators and, to users, notices about changes to the terms, this policy or the service (terms of service section 8), for which it handles the recipient’s email address.
• Google Workspace is our company email. If you write to us (for example privacy@data-takomo.fi or support@data-takomo.fi), your email address and your message with its attachments are kept on Google’s servers.
• The app store delivers the app and sells the credits and the subscription. On Android this is Google Play; for the iPhone app it will be the App Store. The store handles the payment as the seller and under its own privacy policy, and from a purchase we store the product, the quantity, the price, the currency, the store and the store’s order number. The store also tells us directly about purchases, refunds and changes to subscriptions; of each such message we store its identifier and kind, and the purchase is linked to your account by the random reference described in section 2. (Gap: payment through the store is not switched on in the service yet, so this paragraph has to be checked when it is.)
• Reserve providers. If we have to move our servers, databases or their backups quickly, for example because one of the providers above stops working or ends its service, we can move them to UpCloud (UpCloud Oy, Finland), Scaleway (Scaleway SAS, France) or Google Cloud, in their data centres in the EU (UpCloud in Germany or Finland; Scaleway in France, the Netherlands or Poland; Google Cloud in Finland or another EU region). The new provider then processes the same data as the one it replaces, for the same purpose and under a data processing agreement. Today none of them processes your data beyond what is said above; if we move, we update this policy.

5. Transfers outside the EU/EEA

(Preliminary, to be reviewed before publication.)

The databases, the servers and the hangup watch listed in section 4 run in the EU, and the email goes through Mailgun’s EU region. The companies behind those services are not all European, and using an American company’s service can mean that personal data is transferred to the United States or can be reached from there even when the servers are in Europe.

Of the companies in section 4, OpenAI, Vercel, Railway, Cloudflare and Google (the sign-in, Google Cloud, Google Workspace and Google Play) are United States companies, and so is Apple (the iPhone app’s sign-in, and the App Store when the app is published there). The processing by OpenAI’s service happens in the United States. Mailgun belongs to a Swedish group. Of the reserve providers, UpCloud is a Finnish company and Scaleway a French one.

A transfer outside the EU/EEA needs a lawful basis. We rely on these:

• The EU-US Data Privacy Framework, on whose list are Vercel Inc., Railway Corporation, Google LLC, Cloudflare, Inc. and Mailgun Technologies, Inc.; their data processing agreements also contain the European Commission’s standard contractual clauses (2021/914) as a fallback.
• The European Commission’s standard contractual clauses (2021/914): OpenAI (our contracting party is OpenAI Ireland Limited, which transfers the data to OpenAI OpCo, LLC in the United States) and Supabase (our contracting party is Supabase Pte. Ltd, Singapore).
• Apple uses standard contractual clauses for its own transfers, as an independent controller.

You can get a copy of the standard contractual clauses from the contact in section 1. (Gap: these facts were checked on the companies’ own pages and on the framework’s list on 13 October 2026; that each agreement has been accepted must be confirmed before this policy takes effect.)

6. Retention

(Preliminary, to be reviewed before publication.)

• Call transcripts: 30 days after the call.
• The IP address recorded with a call: 30 days after the call.
• Fetches on the Your account page: for each one only the user id, the time and the IP address, for 30 days, so you can see when your data was fetched and fetches can be limited. They also go with the account.
• Request counters for the limits (your account id or the hash of your IP address, and the number of requests): only until the counting window ends (a minute or an hour), at most a day; daily totals without either, 90 days.
• OpenAI’s abuse-monitoring logs of calls and of picking out memories: up to 30 days under OpenAI’s own terms. OpenAI keeps no recordings of calls.
• The web searches made during a call (the query, what the search found and the answer made from it): OpenAI can store them for up to 30 days under its own terms (section 4).
• Ayveena’s memories: only facts you explicitly asked Ayveena to remember during a call, at most five from one call and at most ten at a time. Each fact is deleted at most 30 days after it was saved. Facts are checked by automated moderation before they are saved. They are not shown in the app, but you can see and delete them on the Your account page (section 7).
• Call start details (Ayveena’s instructions stored in the call’s settings: memories, display name, the items you own, your local date and time, and for web search the country): deleted when the call ends, and an unused call reservation one hour after it expires.
• Call records (times, length, credits, why it ended, scene and mood, the moderation stop and the OpenAI call identifier): for as long as the account exists, and deleted with it.
• Notice acknowledgements in the app: for as long as the account exists. Delivery records of notices sent by email: 3 years, so we can show that we gave notice, also after the account is deleted.
• An email address on the tester list: until we remove it from the list. (Gap: how long the list is kept, and removing the address when the account is deleted, are still to be decided.)
• Records of actions on your account and of staff access to your details: (Gap: the retention is still to be decided; after the account is deleted the records no longer link to it, but the reason and who acted remain.)
• The Apple sign-in token used to revoke the link with Apple: for as long as the account exists; after deletion only until Apple confirms the revocation, at most 30 days.
• Unfinished credit orders: cancelled after 21 days, and orders that did not lead to a purchase are deleted after 30 days.
• Sign-in: a session ends if the app is not used for 90 days. A sign-in on the Your account page lasts only in that browser tab and ends when you close it. The page uses no cookies.
• Profile, settings, credits and owned items: for as long as the account exists.
• Feedback and reports you send in the app or on the Your account page: 12 months, and deleted with the account.
• A request about your data, sent with the form on the Your account page or to the contact in section 1, and what we record to handle it (a request sent with the form moves from the app’s database to the admin panel within minutes and is deleted from the app’s database 30 days after the move): 12 months after the request is closed, everything that names anyone is emptied, leaving only the kind of request and the dates; that stripped record is deleted 3 years after the request was closed.
• Consents you give in the app or withdraw in the app or on the Your account page, and your confirmation that you are 18 or older: kept as a record for as long as the account exists, so that we can show what you agreed to or confirmed and when, and deleted with the account.
• Backups of the databases: our database provider keeps daily backups for 7 days, and our own copy outside it (Google Cloud, Finland) is deleted after at most 30 days. Backups are used only to restore the service.
• The identifier of a deleted account and the time of deletion: 30 days, only to delete the account again if a backup has to be restored (section 8).
• Service logs, which can contain your account identifier and IP address: at most one day at Vercel (the API and this website), 7 days at Supabase (the databases and sign-in), 30 days at Railway (the call service and the admin panel), 30 days in Google Cloud (the hangup watch and the backup job) and 5 days at Mailgun (email delivery events; message content 1 day). These are the providers’ retention periods on the plans we use.
• Purchase records: as required by the Finnish Accounting Act (vouchers 6 years and the books 10 years from the end of the financial year), also after the account is deleted.
• Refund cases (when we refund unused credits after closing an account, terms section 6): your email address, your account’s identifier, the purchases refunded and how and when the refund was paid, for 6 years from the end of the financial year (1 April - 31 March) in which the case ended, as bookkeeping records. We never keep bank account or card numbers.
• After the account is deleted only a count of what was deleted remains (calls, transcript lines, memories, items and purchases), with no link to you; the anonymous daily counts of the safety check are kept for 400 days.

7. Your rights

Under the GDPR you have the right to access your data, to have it corrected or erased, to restrict its processing, to receive it in a machine-readable form, to object to processing based on our legitimate interest, and to withdraw a consent you have given. Using these rights is free.

You can use most of them yourself on the Your account page, signed in the same way as in the app: with Google for the Android app’s account and with Apple for the iPhone app’s account:

• Access: see everything we keep about you: your profile, Ayveena’s memories, your calls and their transcripts, items, credit purchases and when you signed in. The feedback, reports and requests you have sent and the history of the consents you have given and withdrawn are included in the download.
• Portability: download all your data as one machine-readable file (JSON).
• Rectification and erasure: delete one memory, all memories or one call’s transcript. The call’s time, length and credits are kept for bookkeeping. Your name and speech language can be changed in the app’s settings. Transcripts are made automatically by speech recognition and may contain errors; a wrong transcript can be deleted, or you can ask for it to be corrected with the form described below.
• Withdrawing consent: the consent to processing sensitive information you mention in calls (section 3) can be withdrawn at any time in the app’s settings or on the Your account page. Calls need this consent, so after withdrawing it you cannot start a call until you give it again; processing that took place before the withdrawal stays lawful. Withdrawing also deletes the transcripts of your past calls at once (a call still in progress keeps its transcript until it is deleted later).
• Deleting your account: see section 8.

You can use these rights also while your account is suspended.

Other requests, such as correcting something the page cannot correct, restricting processing or objecting to it, are made with the form on the same page, signed in. Without an account, or if you cannot sign in, send them to the contact in section 1. We answer within one month of receiving the request; if the request is complex, we may extend this by two months and tell you why within the first month. A request sent from the signed-in page needs no further proof of identity; for a request by email we may ask you to confirm that the account is yours. If you think we process your data unlawfully, you can also complain to the supervisory authority (section 11).

8. Deleting your account

You can delete your account at any time in the app’s settings, or without the app on the Your account page. On the page, deleting needs a sign-in within the last 10 minutes, so that nobody else can delete the account from a browser left open. An account cannot be deleted during a call; end the call first. The deletion is immediate and permanent and cannot be undone. A suspended account can be deleted too.

When an account is deleted, we delete:

• your sign-in account and sessions, your profile and settings;
• Ayveena’s memories, your call transcripts and the call records that name you;
• your consents, owned items, credit balance and unused credits (they lapse, or are refunded, as described in the terms of service);
• the feedback and reports you have sent, and requests about your data still waiting to be handled in the app’s database.

If you signed in with Apple, we also ask Apple to revoke the link between your Apple Account and Ayveena. If you delete your Apple Account at Apple, we delete your Ayveena account too; if you remove Ayveena’s link in your Apple Account settings, you are signed out of the app.

What remains:

• Purchase records, without a link to you, for as long as the Finnish Accounting Act requires (section 6).
• Counts of what was deleted (calls, transcript lines, memories, items and purchases), with no link to you.
• Delivery records of notices sent by email for 3 years (section 6).
• Records of actions on your account, with no link to the account (section 6).
• The tester list: if your email address is on it, it stays until we remove it (section 6).
• The identifier of the deleted account and the time of deletion, for 30 days, kept apart from everything else and used only to delete the account again if a backup made before the deletion ever has to be restored. After 30 days no backup contains the account, and the identifier is removed.
• A request about your data that we are handling or have handled is kept as section 6 describes, because it is also the record that we answered in time.
• If we close an account because the terms of service were broken, the closure is recorded with its reason and time but without your details. If unused bought credits are refunded, the refund case keeps your email address and your account’s identifier for the time given in section 6.

Nothing else about your email address is kept than the above (a request about your data and the tester list), and signing in again later creates a new, empty account.

We can also close an account ourselves when the terms of service allow it (terms, section 6). The data is then deleted in the same way, except that we refund the price of the unused credits you bought: if the app store cannot refund them, we contact you before the closure to agree how. We tell you the reason for a closure when you ask for it.

What a deletion does not reach at once. Some copies are held outside our databases, or are removed on their own schedule:

• OpenAI keeps its abuse-monitoring logs of calls and of picking out memories for up to 30 days, and it can store the web searches made during calls for up to 30 days (section 4).
• Our database provider’s backups still contain the deleted data until each backup expires. The backups are used for nothing but restoring the service; if one is ever restored, the accounts deleted since are deleted again. Our database provider’s backups expire after 7 days and our own copies after at most 30 days (section 6).
• Our servers’ service logs can contain your account identifier and IP address for between one and 30 days, depending on the service (section 6).
• The app store keeps its own records of your purchases, and Google or Apple their own records of your sign-ins, under their own privacy policies. Deleting your Ayveena account does not delete your Google account, your Apple Account or your purchase history in the store; you manage those with Google, Apple or the store.
• Messages you have exchanged with us by email are kept only as long as handling the matter needs.

You can also delete transcripts and memories yourself at any time without deleting the account (section 7).

9. Children

Ayveena is intended only for adults aged 18 and over, as the terms of service say. When you start using the app after signing in, the app asks you to confirm that you are 18 or older, with a switch that is off until you turn it on. Nothing in the app can be used before this confirmation (not the shop, your own room, the settings or calls), and the app asks for it every time it starts until you have given it; no call starts without it. At the same step you can also, if you wish, give the consent to processing sensitive information in calls (section 3). We record that you confirmed your age and when (only your user id, the version of the text and the time); the record is kept with the account like your consents (section 6) and cannot be withdrawn. We do not otherwise check your age. We do not knowingly collect personal data of anyone under 18. If we find out that an account belongs to someone under 18, we delete the account and its data as described in section 8. A parent or guardian who believes that a child has created an account can contact us at the address in section 1.

10. Changes to this policy

The date from which this version is in effect is shown at the top of the policy.

• Small changes, such as clarifications, new contact details or a service provider replaced by another one doing the same job, are published here with a new date.
• Before a material change takes effect, such as a new purpose, a new kind of data, a new recipient or a new transfer outside the EU/EEA, we notify you in the app and by email at least 30 days in advance, in the same way as changes to the terms of service.
• If a change would need your consent, we do not start the new processing until you have given it.

Earlier versions of this policy are listed at the end of this page.

11. Complaints

You have the right to lodge a complaint with the supervisory authority. In Finland this is the Data Protection Ombudsman.