Privacy Policy

Last updated: 22 October 2026

1. Data Controller

Tahvo Solutions (business ID 2415227-9), Tiporaitti 9, 33250 Tampere, Finland, asiakaspalvelu@tahvosolutions.fi ('we', 'us'). We are the controller for our own customers' accounts (the people who use the dashboard), billing, the newsletter and this website. For the chat conversations on our customers' websites, the business that uses the chat is the controller and we process the data on its behalf as a processor (see the DPA). Questions about such a conversation should go first to that business; we help it answer.

2. Data We Collect

Account data: name and email address of the people who use the dashboard, business name, website address and settings. Conversation data: visitor messages, AI responses, timestamps, language and a one-way hash of the IP address (pseudonymised, used only to prevent abuse). Contact and request data that a visitor chooses to give in the chat: for example name, email address, phone number, quote, booking or order details and files the visitor attaches. For businesses with several locations, the approximate city of the visitor's network may be given to the AI to suggest the nearest location; it is not stored. Usage data: message counts, feature usage. Security data: sign-in events, two-factor authentication settings and an audit log of administrator actions. Payment data: processed by Stripe; we do not store card details.

3. Purpose of Processing

Account data: to provide the Service, authenticate users, send service communications. Conversation data: to answer visitors from the business's own website and knowledge base, to help the business improve its answers and to show the business its own analytics. No AI model is trained on the conversations. Usage data: for billing and service improvement. Security data: to protect accounts and the Service and to investigate misuse.

4. Legal Basis (GDPR Article 6)

Contract performance (Art. 6(1)(b)): processing necessary to provide the Service. Legal obligation (Art. 6(1)(c)): accounting and tax records. Legitimate interest (Art. 6(1)(f)): service improvement, security and fraud prevention. Consent (Art. 6(1)(a)): marketing communications and analytics (opt-in only). Giving account data is necessary to use the Service: without it we cannot create an account. For chat conversations, the business that uses the chat decides the legal basis as the controller.

5. Data Storage and Security

Data is stored in Europe: the database runs in London (United Kingdom, covered by the EU's adequacy decision) and the service runs on European servers in the same region. Data is encrypted in transit (TLS) and at rest. Each business's data is tenant-isolated. We keep access logs, an audit log of administrator actions and security monitoring.

6. Data Retention

Conversations: kept 90 days on Starter, 180 days on Pro and 365 days on Business (30 days without a plan), then deleted automatically. Account data: until the account is deleted. Accounts without a plan that are not used for 90 days are deleted 14 days after an email warning. When an account is deleted, its data is deleted at once; backups are overwritten within 14 days. AI Act interaction logs: kept at most 5 years and deleted together with the account. Requests and files a visitor gives in the chat are kept and deleted together with the conversation. Billing records are kept as long as Finnish accounting law requires (usually 6 years after the end of the financial year).

7. Data Sharing and Sub-processors

We do not sell personal data. We use these sub-processors: Supabase (database and login, London), Vercel (hosting), Anthropic (AI processing of chat messages, USA), Resend (email delivery) and Stripe (payments). Anthropic does not train its models on our data and, under its commercial terms, deletes API inputs and outputs within 30 days. Transfers outside the EU/EEA rely on the EU–US Data Privacy Framework or standard contractual clauses. The full list with purposes and locations is in our Data Processing Agreement (/dpa); we give 30 days' notice before adding a sub-processor. We disclose data to authorities only when the law requires it. Services that a business connects itself (for example its own CRM or online shop) are chosen and controlled by that business.

8. Your Rights (GDPR)

You have the right to: access your data and get a copy of it; have inaccurate data corrected; have your data erased; restrict processing; data portability (export your data); object to processing based on legitimate interest; withdraw your consent at any time without affecting earlier processing. We reply within one month. If a request concerns a chat conversation on a business's website, we pass it to that business and help it answer. You also have the right to lodge a complaint with a supervisory authority; in Finland this is the Office of the Data Protection Ombudsman (tietosuoja.fi). Contact: asiakaspalvelu@tahvosolutions.fi

9. AI-Specific Disclosures (EU AI Act)

Our chatbot is an AI system based on large language models. The chat tells visitors that they are talking to an AI (EU AI Act, Article 50). The bot makes no decisions with legal or similarly significant effects: bookings, quotes and orders are requests that the business confirms, and the visitor can ask for a person at any time. Interaction logs are kept so the business can review them. The Service makes no automated decisions within the meaning of GDPR Article 22.

10. Cookies & Local Storage

When you first visit we show a consent banner. Necessary storage (your login session, your language choice, your consent choice and, in the chat widget, a random conversation ID) works without consent because the service cannot function without it; it lives in your browser's local storage and is sent only to our own servers. Analytics stays off unless you allow it. If you allow it, our own anonymous counter records which public page you viewed, which website you came from (the site name only, never the full address) and whether your visit continued beyond the first page. It uses a marker that lives only in your browser tab (session storage) and is erased when the tab closes; no visitor ID, IP address or browser details are sent or stored, and the server only adds one to a daily total. We use no advertising or tracking cookies and no third-party analytics. If you switch analytics off, counting stops immediately. You can change your choice at any time with the "Cookies" link in the footer.

11. Changes

We notify customers of material changes by email 30 days in advance. The date at the top of this page shows when the policy was last updated.

If you subscribe to our newsletter we store your email address, chosen language, the time and wording of your consent, and whether you confirmed. We use a double opt-in: nothing is sent until you click the confirmation link. Legal basis: your consent (GDPR Art. 6(1)(a)); you can withdraw it at any time with the unsubscribe link in every email, after which we send nothing more. Unconfirmed signups are deleted after 30 days. Unsubscribed addresses are kept only as a suppression record so we do not email you again. Emails are sent through Resend (email delivery) and the monthly text is drafted with AI from our own product information and reviewed by us before sending. We never put your address into the AI.

Aggregate statistics

We count how many conversations the service handles and how many requests (quotes, callbacks, bookings) it captures, across all customers, to show how Tahvo is doing (for example on our website) and to run the service. These are counts only: no message content, names or contact details are included, and no figure identifies a single business or person. The "time saved" figure is an estimate calculated from these counts and is labelled as such. On our own website we also count, without cookies, IP addresses or any personal data, how many visits arrive from AI assistants (such as ChatGPT or Perplexity) and how often automated crawlers fetch our public llms.txt file.

Contact

Tahvo Solutions (business ID 2415227-9), Tiporaitti 9, 33250 Tampere, Finland. Data protection: asiakaspalvelu@tahvosolutions.fi