1. Introduction

Aivomaa Oy ("we", "our" or "company") is committed to protecting the privacy of our customers and website users. This Privacy Policy explains how we collect, use, store and protect your personal data in accordance with GDPR (EU 2016/679) and Finnish data protection legislation.

2. Data Controller

AI Powered Solutions is a service brand of Aivomaa Oy (Business ID 3592993-6), Helsinki, Finland.

3. What Data We Collect

3.1 Data You Provide Directly:

• Contact Information: Name, email address, phone number
• Company Information: Company name, business ID, industry
• Project Information: Service requests, project descriptions, communication with AI chatbot
• Payment Information: Billing details (we do not store credit card information)

3.2 Automatically Collected Data:

• Technical Data: IP address, browser type, device type, operating system
• Usage Data: Page view times, click data, visit duration
• Cookies: Analytics and functional cookies (see cookie policy)

3.3 AI Chatbot Interaction:

• Conversations with AI assistant
• Project requirements and budget estimates
• Feedback data (anonymously analyzed for service improvement)

4. How We Use Your Data

We use collected data for the following purposes:

Purpose	Legal Basis (GDPR)
Service delivery and customer support	Contract performance (Art. 6(1)(b))
Communication and sending offers	Legitimate interest (Art. 6(1)(f))
Billing and accounting	Legal obligation (Art. 6(1)(c))
Service development and analytics	Legitimate interest (Art. 6(1)(f))
Marketing communications (with consent)	Consent (Art. 6(1)(a))

5. Data Sharing

We do not sell, rent or trade your personal data to third parties for marketing purposes. We may share data in the following situations:

• Subcontractors: Hosting services, payment systems, CRM (all GDPR compliant)
• Legal Requirements: Authority requests to fulfill statutory obligations
• Business Transactions: If the company is sold or merged

6. Data Retention Period

• Customer Data: Duration of contract + 6 years (accounting obligation)
• Quote Requests: 2 years, unless converted to customer relationship
• Chatbot Conversations: 12 months (anonymously analyzed)
• Marketing Consents: Until withdrawn
• Analytics Data: 26 months (Google Analytics)

7. Data Location

Your data is primarily stored in the EU/EEA area. Some service providers (e.g., OpenAI) may be located outside the EU. In such cases, we ensure adequate protection by using:

• EU-approved Standard Contractual Clauses
• EU-US Data Privacy Framework certified services
• Anonymized or pseudonymized data

We do not use your data to train AI models. Any data sent to AI-processing providers outside the EU (e.g., OpenAI) is transferred under Standard Contractual Clauses (SCC) and a Data Processing Agreement (DPA), and is not stored long-term outside the EU.

8. Data Security Practices

We protect your data in the following ways:

• ✅ SSL/TLS encryption (HTTPS)
• ✅ Database encryption
• ✅ Firewall and DDoS protection
• ✅ Regular backups
• ✅ Limited staff access (need-to-know principle)
• ✅ Two-factor authentication in admin panel

9. Your Rights (GDPR)

You have the following rights regarding your personal data:

1. Right of access (Art. 15): You can request a copy of the data we store
2. Right to rectification (Art. 16): You can correct incorrect information
3. Right to erasure (Art. 17): "Right to be forgotten"
4. Right to restriction of processing (Art. 18): You can request suspension of data processing
5. Right to data portability (Art. 20): Receive data in machine-readable format
6. Right to object (Art. 21): You can object to profiling and direct marketing
7. Right to withdraw consent: At any time without affecting previously given consent

10. Cookies

We use cookies to improve user experience. You can manage cookies from your browser settings.

Cookies We Use:

• Essential: Session management, security
• Analytics: Google Analytics (anonymized IP)
• Functional: Language selection, chatbot preferences

11. Children's Privacy

Our service is intended for businesses. We do not knowingly collect personal information from individuals under 16 without parental consent.

12. Changes to Privacy Policy

We update this policy as needed. Significant changes will be announced via:

• Website (notification banner)
• Email to registered users

13. Right to Complain

If you believe we are not handling your personal data properly, you can file a complaint with:

14. Contact Information