Privacy policy

1. Controller

• Urho AI Solutions Oy, business ID 3570794-6
• Address: Volsinniementie 11, 08700 Lohja, Finland
• Privacy contact: Lassi Saarela, CEO, lassi.saarela@urhoai.com

2. What we process and why

Website visitors. Our hosting processes technical data such as IP address and browser details to serve and protect the site. We measure traffic in aggregate without cookies (see section 7). Basis: legitimate interest in running and improving the site.

Enquiries. When you email us, we process your name, email address, company and message to reply to you. Basis: legitimate interest in responding, and pre-contract steps if the conversation leads to an engagement.

Business sales and marketing. We contact companies our services may suit. We process the contact person's name, role, company, work email, public phone number and where the contact details came from. Basis: legitimate interest in marketing our services to businesses. You can object at any time.

Clients and partners. We process client contact details, contract and invoicing data, and work-related communication. Basis: performance of a contract and bookkeeping obligations under Finnish law.

3. Where the data comes from

Mostly directly from you. For sales, we collect contact details from public sources such as company websites, the Finnish Business Information System (YTJ) and LinkedIn. Our first message tells you where we found your details.

4. Recipients and service providers

We do not sell or share personal data for marketing. We use these providers, which process data on our behalf under contract:

• Vercel Inc.: website hosting and visitor analytics (United States)
• Zoho Corporation: email (EU data centre)
• Hostinger International: server for our tools (Lithuania, EU)
• Microsoft (Teams, GitHub): online meetings, version control and backups
• Anthropic and OpenAI: AI services for drafting and analysis
• Our accountant: bookkeeping and invoicing

5. Transfers outside the EU/EEA

Some providers are based in the United States. Transfers rely on the European Commission's adequacy decision (EU-US Data Privacy Framework) or the Commission's standard contractual clauses.

6. Retention

• Enquiries that do not lead to an engagement: 24 months after last contact
• Sales contact details, if you do not reply: 12 months after last contact
• Suppression list: if you opt out, we keep your email address and the date so we never contact you again
• Client data: for the contract period; bookkeeping records 6 to 10 years as Finnish law requires
• Server logs and analytics: provider default; analytics in aggregate only

7. Cookies and analytics

Our site does not store cookies or other data on your device, so we do not ask for cookie consent. For visitor statistics we use Vercel Web Analytics, which uses no cookies and does not identify individual visitors. Data is aggregated, and the session identifier is discarded within 24 hours. On the workflow check (/check) we record only the result in aggregate, not your answers or any personal data.

8. Your rights

You can ask for access to your data, correction, erasure, restriction of processing or data portability. You can object to processing based on legitimate interest, and you can always refuse direct marketing. Send requests to lassi.saarela@urhoai.com. We reply within one month.

You have the right to lodge a complaint with the supervisory authority: the Office of the Data Protection Ombudsman, tietosuoja.fi.

9. Automated decisions

We make no decisions about you with legal or similarly significant effects based solely on automated processing. A person reviews every AI-assisted draft.

10. Security

Access to data is restricted, servers use key-based authentication, and we use only providers with appropriate security practices. Client personal data is never stored in version control.

11. When we process data for a client

If a client gives us personal data to carry out an engagement, the client is the controller and we process the data on its instructions under a written data processing agreement. The client's own privacy policy then describes the processing in more detail.

12. Changes

We update this policy when our practices change. The date at the top shows the latest version.