Privacy Notice — Doju services

Version: doju-en-v9 · in force from its publication on this page · Language: English (a Finnish translation, doju-fi-v9, is available at the same address with ?lang=fi).

1. Who we are

Doju Ltd, Business ID 2708306-1, Finland ("we"), operates the services described below. For the processing described in this notice we are the controller — we decide why and how the data is processed.

Contact for privacy matters: privacy@doju.org. If you are in the EU/EEA you may also complain to your national supervisory authority (in Finland, the Office of the Data Protection Ombudsman).

2. Which services this notice covers

Sections 3–6 concern the personal AI suite, where we are the controller; §3a concerns your platform account and profile, where we are the controller whichever service you use. Sections 7–8 concern everything else. Where your employer or practice is the controller (compliance training, workforce records, a practice's client records), it publishes its own notice to you and we act on its instructions.

Kauppahuone has its own notice, and this one does not cover it. Its participants are external natural persons with no other relationship to Doju, the controllership is split mid-service, and the retention periods are transaction-evidence periods that apply nowhere else — so folding it into the sections below would make both notices less accurate rather than more convenient. It is served to participants in the deal-room portal itself, at https://kauppahuone.laife.me/privacy.

3. Personal AI suite — what we process and why

If you are the person who signed up (the "seat holder"):

• What: the content of the accounts you choose to connect — email bodies and metadata, files you grant access to, messages you forward, and — if you connect a Slack workspace — every message in the channels, private channels, direct messages and group messages you are a member of there, from the moment you connect (nothing earlier is imported). We compute mathematical representations (embeddings) of that content so you can search it in natural language.
• Why: to provide the product you asked for. Nothing more. We do not use your corpus to train models, we do not sell it, and we do not read it for advertising.
• Lawful basis: your consent, given when you accept your assistant's notice and connect a source or switch on a feature (a source, your journal, your vault, a brief across your places), and withdrawable at any time by switching it off or disconnecting. The features listed next, which start switched on, are different: they are part of the assistant you signed up for (Art. 6(1)(b)), and you can switch each one off. Switching a feature off stops us processing new material for it, but you can still read, reject or delete what is already there, delete a whole conversation, or switch a source off; it does not by itself delete what we already hold. To have that removed, use your own delete actions (for example removing a note, a conversation or a source; for Slack, removing the app in your Slack account), or ask us to delete your seat (§5).
• What starts switched on. As part of the assistant you signed up for, these start on in your own seat, and you can switch each one off in the app: a section about people in your morning brief, date ideas for time with your partner, gift ideas when you ask, seasons together, a weekly talk agenda, weekly summaries of the people in your life, and suggestions of things to remember about people, drawn from your own notes and meetings. Nothing about a person is saved from a suggestion until you accept it.
• Your journal, brief and vault. Notes you type or dictate, and transcripts of meetings you record, are filed as a record of your conversations: what was decided, what you promised and what others promised you, and dated observations you confirm. A daily brief lists today's meetings and open items. Your notes vault is a folder in your own OneDrive or SharePoint; we keep a working copy and an index, and our assistant only proposes changes there — you decide. Which calendars, mailboxes and folders we read is set by you under Sources; a calendar or mailbox someone shares with you brings their entries in too, so include it only if you need it.
• A brief across your places. If you also hold a seat at an organisation that uses our services, you can have its meetings and open items appear in your daily brief here — only if that organisation allows it and you tick it. Only titles, times and open items come over; they are deleted within 48 hours, and the organisation never sees your brief.
• Notifications. We send a short notification to your device when a meeting ends or your brief is ready. It carries no content; your device's push service (Apple, Google, Mozilla or Microsoft, depending on your browser) sees only that a notification was sent. We keep your device's subscription until you turn notifications off, set them up again on that device (the old one is replaced), the push service reports it gone (then deleted within 30 days), or your seat is deleted.
• Home. If you hold seats at more than one place, Home shows your own items from each place together. Each place is read with your access there, the combined view is shown to you and not stored, and no place learns about your other places. A place shows up on your Home only if its organisation allows it.
• Your people. Your contacts and what you choose to remember about them (how you know them, birthdays, interests, how they like to work). You can import your own earlier address book once; we keep only this kind of everyday information from it. You can add labels (for example "work" or "family") to people, notes and conversations to sort your own things.
• Where things are filed. We suggest where each new note, transcript or page belongs, show you where we filed it, and you can move it with one tap, then or later. Moving an item from a workplace to your own account needs your confirmation that it is yours and not your employer's business information; your employer's business content stays at the workplace.
• Notes from a work account. If you connect a work account, we first show only the titles of your notebooks and pages. We read a page only after you pick it and confirm it is your own. Connect a work account only where your employer allows it.
• Your voice. If you set it up, we keep a voiceprint of your own voice: a set of numbers made from a short sample, never the sample itself. We use it only to mark your own lines in your recordings. To do that, each other speaker's voice is compared with yours once and then forgotten; we keep no voiceprint of anyone else, and you can turn matching off for a recording. Basis: your explicit consent (Art. 9(2)(a)), given when you set it up; delete the voiceprint at any time to withdraw it.
• Your names and terms. A list of names, terms and spelling rules you keep, used only to get names and words right in your own transcripts.
• Your chats. If you connect a messaging app (WhatsApp, Telegram, Signal, Messenger or Instagram, or iMessage and SMS through our app on your Mac), we keep your conversations with the people you switch on, one person at a time; a group only if everyone in it is switched on. Conversations you have not switched on are not kept. Photos and voice messages in them are described and transcribed so you can search them, on our own systems or with an EU provider. From your chats the app suggests things to remember about people, which you accept or reject, and keeps a short summary of each relationship for you (and for an AI client of your own, if you choose that for a connection; see below). We never send messages for you, and we do not record when people read your messages. Connecting links our service to your messaging account as a device, which the messaging service's own terms may not allow.
• Your task lists. Only if you yourself connect Todoist or Apple Reminders: until then we read nothing from them and send nothing to them. Once connected, your own tasks are kept in step both ways between them and your seat. Items other people add to a list you share in Apple stay in Apple and on your Home; we do not send them to Todoist. Todoist processes your tasks in the United States under your own agreement with it. A follow-up task the app writes for you can name a person and a short topic (at most 80 characters, checked for sensitive content first; a sensitive topic is left out); it goes into your own list as your own to-do.
• Things to do and plans. You choose the cities you follow, each with optional dates for when you will be there ("where I am when"). We show you upcoming events in those cities from a shared list of public events that we collect once per city from public listings, a ticketing service and web search; that list holds nothing about you. We keep the cities you follow and the dates you give, your decisions on events (going, not for me) and what the app learns from them to rank events, and your plans: a title, dates, and the steps and recurring chores you group under them, shown on a timeline together with your commitments and recurring dates. This is part of the assistant you signed up for (Art. 6(1)(b)), and you can switch it off. If you add a city that is not on the list, the name you type is kept with a reference to your account, so that its search can be charged to your budget; it is visible only to you until we publish it for everyone, and the name is sent as a search word to a web search service. If your seat is deleted, a city that is still private is deleted with it, and a city we published stays without any link to you.
• Your own AI client. You can connect an AI client of your own choice (for example Claude or Mistral, or one you built yourself) to your seat with a token you create in the app after signing in with a second factor. You choose per token what it may do. By default a token covers your own planner: your cities and things to do, plans, timeline, commitments, and recurring dates and occasions (including people's birthdays you keep), and the Signals cards about plans and things to do. Only if you tick a statement when you create the token can it also read your chats, the people in your address book, your shared lists and the assistant's other cards (including your morning brief and relationship seasons), and edit people's details. We do not choose or know which AI you use and have no agreement with its provider; what the client and its provider do with what they read is between you and them. A token lasts at most 90 days, you can revoke it at any time, it stops when your sign-in is reset or re-issued, and it works only while you keep signing in (at least every 30 days). Matters we hold set aside, and categories that stay locked until the person has agreed, are not shown to it, and nothing derived from a partner's cycle is ever shown to it. Your chats are different: a token you gave the wider scope is shown your chats as they were written, including any sensitive matters in them. We keep a record of each token (its name, scope, dates and last use) and of what the client does in your seat, kept apart from what you do yourself.
• Pages and photos you send for reading. Pages and photos you send for reading are described by an EU-hosted AI model from Mistral AI (France). Mistral keeps them for up to 30 days to check for misuse, and may report suspected child abuse material to the authorities. The terms for what you may send are in your assistant's notice: no special categories of personal data about anyone. A photo marked sensitive is never sent to Mistral, and a document's reading stops once its note is marked sensitive. Files another person posts in a Slack channel you switched on are never sent for reading.
• Sensitive matters. A note about someone's health, beliefs or other sensitive matters is not kept as a fact about them: the app tells you. If the sentence came from your own notes, a meeting transcript or a record you imported, before the person agreed, we hold your sentence as you wrote it, set aside and unread, for up to 30 days so you can record their agreement, and then delete it; a sentence we recognise as being about a criminal offence by someone else is dropped. The one exception is information about another person that this person has agreed to themselves: we keep it only if you confirm to us that they have agreed and that you have told them they can withdraw. They can withdraw at any time by writing to us at the address in §1, saying whose workspace it is, and we then delete it. You can also take back your confirmation at any time, which deletes it too. If you also confirm they agreed to the assistant using it, the assistant sees only a general indication — for example which phase of their cycle they are in, never dates — to help you plan. This is processed in the EU. Chats are different: your chats are kept as they were written, including sensitive matters you or others mention, and we do not read them to look for such matters. By connecting a messaging app you agree that sensitive matters you write about yourself are kept there. When the app learns from your chats, sensitive information about another person is left out, unless that person has agreed as described above.
• Your control: You choose under Sources which calendars, mailboxes and folders we read beyond your first account's main calendar and mailbox, and you can switch each of those off at any time. The product does not yet have self-service buttons for disconnecting an account, exporting everything, or deleting your seat. Instead, write to us at the address in §1 and we will do it for you: disconnect any source, give you a copy of what your seat holds, or delete your seat entirely, which erases your corpus — see §5 on what that means for backups. We answer within one month.

If you are someone the seat holder corresponds with (§4 explains why you are reading this):

• What: if you emailed, messaged, or shared a file with a seat holder, or posted in a Slack conversation (channel, direct or group message) a seat holder is a member of (including from another organisation in a shared channel), the content may be in their corpus, because they connected the account or workspace it arrived in. If you chat with a seat holder on a messaging app they connected (WhatsApp, Telegram, Signal, Messenger, Instagram, iMessage or SMS) and they switched you on, your messages to them and the photos and voice messages you sent may be in their archive; a group you are in is kept only if every member is switched on.
• Why: so the seat holder can search what was communicated to them. If they switched you on in a messaging app, the app may also suggest things for them to remember about you and keep a short summary of their relationship with you. That summary is an evaluation of the relationship: it is for the seat holder, who may also let an AI client of their own choice read it (see below); it is deleted after 24 months, and if you object we delete it and anything else we learned about you from these chats, and the assistant stops learning about you in that person's workspace. We do not use your content to train models, and no automated decision is made about you.
• Lawful basis: our legitimate interest (Art. 6(1)(f)) in providing a personal search tool over what was communicated to a user, balanced against your interests. The material is held in the seat of each person who connected the account or workspace it arrived in — for a Slack conversation, one copy per member who connected that workspace, never shared between them. Our staff and administrators cannot read it. The seat holder can see it, and may choose to let an AI client of their own read it, for the connections where they pick that; we do not choose that client, may not know which one it is, and send the material nowhere else. We cannot take back what such a client has already read; if you object, we delete what we derived about you and the assistant stops learning about you (§6).
• If you are in a seat holder's contacts: they may keep your name, how to reach you and everyday details they choose to remember (as in a phone's address book), possibly imported from their own earlier records. The basis and the fence are the same as above, and §4 and §6 apply. The assistant may propose facts about you from the seat holder's own notes and meetings; the seat holder accepts or rejects each one. If the seat holder connected a task list such as Todoist, the assistant may put your name and a short topic in the seat holder's own task list as a follow-up. If the seat holder connected an AI client of their own, it can see your birthday and other yearly dates they keep about you; with the wider scope it can see the rest of what they keep about you, as above. When the seat holder asks for the date of an occasion to be looked up, its title (which may name you) is sent as a search query to a web-search service. Information about your health or other sensitive matters is kept as a fact about you only with an agreement from you that the seat holder records; until then a sentence the seat holder wrote about it is set aside, unread, for up to 30 days and then deleted, and a sentence we recognise as being about a criminal offence of yours is dropped. You can withdraw your agreement, or object to any of this, by writing to our privacy contact (§1).
• If a seat holder met you or mentioned you: their journal may hold a note of the conversation — what was decided, what each side promised, and dated observations of their own. These are the seat holder's own notes, used to follow up with you and for nothing else; no automated decision is made about you. If the seat holder connected a task list such as Todoist, the assistant may put your name and a short topic in the seat holder's own task list as a follow-up. An AI client the seat holder connected can see these notes, including your name on a promise. The basis and the fence are the same as above, and §4 and §6 apply.

3a. Your platform account and profile — where we are the controller in every service

When you hold a seat at an organisation or a practice that uses our services, that organisation is the controller of what you do for it and we are its processor. A few things sit above any one organisation, and for those we are the controller. (If you take part in a deal room, the deal room's own notice applies to you there; a profile you set there is kept on the same terms as below.)

• Your person record and profile. One record for you as a person, above your seats: an identifier and dates only, plus what you choose to add — a display name, a language and a profile photo. Every field is optional and set only by you. We re-encode a photo to a small image and strip its metadata (location and camera data); we only ever display it, never use it to recognise anyone. You choose who sees it: only you, the colleagues at the place where you added it, or the colleagues at every place where you hold a seat. Until you choose, a photo you add is visible to the colleagues at the place where you added it.
• Links between your places. If you work at more than one place, you can prove that your seats are one person — you accept an invitation while signed in and confirm with a fresh code from your authenticator app — and then sign in once, switch between places and see one calendar of your own work. We keep a record of each link: which seat was linked, when, which sign-in factor you proved, how the link was made, and when and how it was closed. A place sees only its own seat; it never learns where else you work, or how many other places there are. Once linked, your login at your first place is the one you use everywhere. A link closes by itself when your login at that place ends — the place deactivates it or re-issues it, or, where you sign in through your organisation's own sign-in provider, that provider withdraws your access — when your seat at that place is erased, and when your person record is erased. There is no self-service "unlink" button: if you want a link closed for any other reason, write to us at the address in §1 and we close it (see "Your rights" below). Your login at your first place may be a Google or Microsoft personal account linked to your account there (see the next item); it reaches your other places only as each place's own sign-in setting allows.
• Signing in with a Google or Microsoft account. A practice may let its staff sign in with their own Google or Microsoft personal account. The link between that account and your staff account is processed for your practice, which is its controller; we are its processor there, and your practice's staff privacy notice describes it. Google and Microsoft act as independent controllers under their own privacy policies.
• Sign-in security record. When anyone signs in to our services, including with a Google or Microsoft account, we keep a sign-in security record — the time, the method, the outcome, and for a refused attempt only a pseudonymous identifier — for 24 months, on our legitimate interest in keeping the service secure (Art. 6(1)(f), Recital 49).
• Your platform consents. Three, all optional and all yours to withdraw at any time. The first: whether your own profile and usage may be included in de-identified statistics for developing the service; we do not produce such statistics yet, and none will include you without this consent. The second: optional browser analytics (below). The third: whether the places where you work may see when you are busy at each other — the classes booked there and any calendar you have connected there — as plain "busy" intervals, so that one place does not book you over another's class; each place sees only that you are busy at that time — never which place, which class or anything else — and sees nothing while the switch is off. You switch it on and off on your profile page; switching it off stops the sharing at once. Only adults can give any of them, and none is ever a condition of using the service. Before we record the first, we check whether a place where you hold a seat has recorded your login address as the address of one of its clients who is under 18 (never a guardian's address). If it has, we refuse the consent. We run this check as that place's processor, on its instruction, to protect its young clients. It gives only a yes or no answer, and nothing about it is kept.
• Records of how the service is used ("Service Data"). Which features, workflows and AI tools ran, when, for how long and whether they failed, and any 1–5 rating you choose to give when we ask for feedback — under a pseudonymous identifier for your seat, never your content. We collect these on our own servers from what the service does for you anyway, and they are analysed with our analytics provider (see "Who sees it"). They are personal data for us, and we never call them anonymous. We do not collect them about deal-room participants (see the Kauppahuone notice). The rating is not offered to people under 18.
• Optional browser analytics. Only if you switch it on (it is off unless you do): a small analytics program in your browser also reports which screens and controls you use, so we can see where the service is hard to use. It stores nothing on your device beyond the open page, never records your screen and never sends your content. You switch it on and off in your consent settings (the profile page in the workspace app, the consent-settings page in the training portal, the account page in the deal-room portal). When you switch it off we stop, and what it collected is deleted within 30 days. We do not offer it to a login that a practice set up for a young client on their guardian's behalf: the switch asks you to confirm that yours is not one, and we also refuse it where a place has recorded your login address as its client under 18.

Why, and on what legal basis. Your profile and the links between your places: our legitimate interest and yours in a recognisable colleague and one sign-in across places (Art. 6(1)(f)), at your own initiative; where you are yourself our customer, the contract (Art. 6(1)(b)). The link records: the security of the service (Art. 6(1)(f), Recital 49). The statistics consent: your consent (Art. 6(1)(a)); keeping the record of it: our duty to show you gave it (Art. 6(1)(f) with Art. 7(1)). The busy-sharing switch: your consent (Art. 6(1)(a)), kept on the same terms. Service Data: our legitimate interest in operating, securing and improving the service (Art. 6(1)(f)). Optional browser analytics: your consent (Art. 6(1)(a)); the law requires it because the program runs on your device (Act on Electronic Communications Services 917/2014, §205).

Your right to object. You may object at any time to Service Data being used for analytics (Art. 21). Use the objection control in your consent settings — the profile page in the workspace app, or the consent-settings page in the training portal — or write to the privacy contact in §1 (this is the route if you take part in a deal room, where there is no such control): we then stop using your seat's records for analytics, delete those already collected within 30 days, and keep only what the service's security requires. Withdrawing the statistics consent does not stop Service Data — the two are separate.

Who sees it. You; your colleagues, as described above; no AI service. Service Data and optional browser analytics are held for us by our analytics provider PostHog Inc., as our processor, on servers in Frankfurt, Germany; PostHog may access them from the United States under the EU-US Data Privacy Framework, with the EU standard contractual clauses as a fallback. No other third party receives them, and your organisation sees only totals for the whole organisation, never figures about you. We host everything else in the EU (Hetzner, Germany and Finland) and keep an encrypted copy of our backups with Dropbox, Inc. in the United States under the EU standard contractual clauses, with encryption as the supplementary measure — the key never leaves us.

How long. Your profile, photo and consent record are kept while you hold any seat or deal-room identity with us, and deleted when the last one is erased; if you still hold another, they stay for it. The person record then remains only as an identifier and dates. A link record — identifiers, dates, factor names and how it was made or closed — is kept while the link is open and deleted 12 months after the link is closed, whichever of the events above closed it. Service Data about your seat, optional browser analytics, and ratings you give: our analytics provider PostHog keeps these events for up to 7 years, a fixed retention of the PostHog plan that we cannot shorten. We delete them earlier, within 30 days, when you object (Art. 21), withdraw your browser-analytics consent, or ask us to erase them (Art. 17); and when your organisation's workspace is closed after its contract ends, we delete the events recorded for it. Deleted information may persist in our encrypted backups for up to approximately 400 days; a restore re-applies every recorded deletion.

Your rights. You can see and change your profile and your consents yourself on your profile page, remove your photo at any time, and ask us at the address in §1 for a copy of the link records or anything else in this section. The link records have no self-service control of their own: to have a link closed, or to object to it (Art. 21) on grounds relating to your particular situation, write to the address in §1 — we close the record unless we show compelling legitimate grounds that override your interests, and the closed record is then deleted after 12 months. The rights in §6 apply.

3b. Our business contacts (CRM) and AI meeting assistance — where we are the controller

If you correspond with us, meet with us, or otherwise deal with us in a business capacity — as a contact at a partner, a vendor, a colleague at another organisation, or a professional contact — we may hold your name, business email address, your organisation and your role, and records of our business dealings with you (e.g. meeting notes, follow-up dates), in our own customer-relationship (CRM) system.

Why, and on what legal basis. Maintaining and developing our business relationships is our legitimate interest (Art. 6(1)(f)) — the ordinary purpose of a business CRM. We do not use your details to build a profile of you beyond your business role, and we make no automated decision about you from them.

AI meeting assistance. If a Doju colleague uses our AI meeting assistant, your name, the subject of the meeting, and — if they choose to use it — a debrief of the meeting may be processed by our AI provider, AWS, hosted in the EU, to help draft correspondence or prepare a follow-up. The AI-drafted follow-up itself is seen only by the colleague who met with you. If they choose to save a note or a follow-up date from it, that note or date is recorded in our CRM against your contact record, where it is visible to Doju staff who use the CRM and shown as recorded by that colleague. A to-do the colleague creates from the follow-up is created in that colleague's own task list, not in our CRM. None of this is ever used to train any model.

Meeting records and relationship notes. A Doju colleague who meets or corresponds with you may keep a record of the conversation in our assistant: what was decided, commitments either way, and dated, factual observations about working with you — so they can follow up. A meeting is transcribed only if you were told it was being recorded, and the transcript is deleted 24 months after the meeting. The record is seen by that colleague; a follow-up they create goes into their own task list.

Who sees it. Our own staff who use the CRM (for a saved note or follow-up date); the colleague who met with you (for the AI draft and any to-do); our AI provider as above; the colleague's own Microsoft To Do list for a to-do they create. We host it in the EU (Hetzner, Germany and Finland) and keep an encrypted copy of our backups with Dropbox, Inc. in the United States under the EU standard contractual clauses, with encryption as the supplementary measure — the key never leaves us.

How long. For as long as our business relationship with you continues, and for up to six years after it ends.

Your rights. The rights in §6 apply. You have the right to object (Art. 21) to our processing of your business contact details at any time, separately from any other right. If you object, we stop using your details in AI meeting assistance — the assistant withholds your name — unless we have compelling legitimate grounds that override your interests. Separately from any objection, the assistant refuses to process a colleague's note that hints at special-category information about anyone. The objection does not stop a colleague recording an ordinary business note that happens to mention you by name in our CRM; it is an objection to AI processing of your details, not to our CRM record of our own dealings. You may lodge a complaint with a supervisory authority — in Finland, the Office of the Data Protection Ombudsman (tietosuoja.fi), per Art. 77.

How you are pointed to this notice. Email that our systems send on Doju's behalf to someone outside Doju — platform mail such as sign-in links and notices — ends with a link to this notice, added automatically by the product; it does not depend on anyone remembering to put it in a signature. Mail that a customer organisation sends in its own name through the product links to that organisation's own privacy notice instead. (A message a colleague writes and sends entirely by hand, outside the product, carries whatever that colleague's own signature says.)

If you received this notice's information individually rather than by finding it here — for example because your details were added from a business meeting or imported from an earlier record of ours — that individual delivery discharges the same duty this section describes; see §4.

3c. Seller data for tax reporting, and our payment-provider account — where we are the controller

If you are the responsible person of a practice or other business that takes bookings from the public through our public sign-up function, a tax law makes us a "reporting platform operator", and we hold three records about you or your business in our own right. (Your clients' data are not part of this section: the practice is the controller of those, and we act on its instructions.)

What we hold. (1) Seller identification data that we collect from you for tax reporting: for a company, its name, address, Business ID, VAT number and any permanent establishment; for a sole trader, your name, address, date of birth, personal identity code (used as your tax identification number) and VAT number; and the identifier of the financial account the payments go to, where we have it. (2) A platform sales ledger: for each booking made through public sign-up, its amount, date, the practice and a booking identifier. The ledger holds no information about the person who booked. (3) Our own account with our payment provider, Stripe, through which we connect your practice's payment account: we hold the identifiers that link the two accounts. We never receive a card or bank account number, and we never hold your funds or your clients' funds.

Why, and on what legal basis. Collecting the seller data and reporting the ledger to the tax authority is a legal obligation on us under the Act on the reporting obligation of digital platform economy operators in the field of taxation (1267/2022, sections 4–6): Art. 6(1)(c). We use the data for nothing else. Holding the payment-provider account identifiers is necessary to connect your practice's payment account at your request: Art. 6(1)(b). We make no automated decision about you from either.

Where it comes from, and whether you must give it. From you, when you set up public sign-up. The law requires us to hold the seller data before a seller is paid through the platform, so we cannot switch public sign-up on without it.

Who receives it. The Finnish Tax Administration, in our annual return due by 31 January, and through it the tax authority of the seller's state of residence. Stripe, for the account connection. Our staff who prepare the return, and our hosting provider (EU). Your personal identity code is kept in our secrets vault and is read only to prepare the return.

Transfers outside the EU. Our payment provider may transfer data outside the EU under its own safeguards, which its privacy notice describes. Our own backups are covered by §8.

How long. The seller data and the ledger: at least six years from the end of the reportable period they concern (section 16 of the Act), then we delete them. The payment-provider account identifiers: while your practice keeps its payment account connected to ours.

Your rights. The rights in §6 apply. We cannot erase seller data or ledger rows before the legal retention period has run, because the law requires us to keep them. You may lodge a complaint with the Office of the Data Protection Ombudsman (tietosuoja.fi).

3d. Support requests to us — where we are the controller

If you raise a support request with us — through the support desk in your hub, or by e-mail — we keep the request: your name and work e-mail address, your organisation, what you write, any files you attach and our replies.

Why, and on what legal basis. To give your organisation the support our contract with it includes (Art. 6(1)(b)), and to keep a record of what we did for it (Art. 6(1)(f)). If you are not writing for a customer, to answer your enquiry (Art. 6(1)(f)).

AI assistance. We may use AI to help handle a request — for example to draft a reply that a member of our staff reviews and sends, to summarise a request or to sort it. This uses our AI provider, AWS, hosted in the EU, and is never used to train any model. Your organisation can agree with us that a request is not processed this way.

Who sees it. Our support staff; the administrators of your organisation who raise or follow requests with us; our AI provider as above. Hosting and backups as in §8.

How long. While your organisation is our customer, and 36 months after its contract with us ends. If you are not writing for a customer, three years after the request is closed. For a request that authorised us to act on your organisation's behalf, we keep a record of what was authorised, without the text, files or names, for 10 years.

Your rights. The rights in §6 apply.

4. Why you may not have heard from us directly (Art. 14)

If you corresponded with a seat holder, posted in a Slack conversation (channel, direct or group message) they are a member of, or are in a seat holder's contacts, we hold your data without having collected it from you. Article 14 GDPR ordinarily requires us to contact you and say so.

We rely on the Art. 14(5)(b) exemption — notification would involve disproportionate effort — and we have recorded a written determination explaining why. In short: we have no reliable way to contact most correspondents (a Slack conversation can have many members, and reaching them would mean listing all of them), and attempting to would require us to process more of your data (extracting and validating contact details from message content) than the service itself does. For a seat holder's contacts, we have no relationship with you and do not write to you; writing to a person's friends, family and acquaintances about their private address book would itself intrude on them and on the seat holder.

Art. 14(5)(b) requires us to protect your interests by other means instead. This notice is that measure — it is public, so a correspondent who wants to know what we do can find out without us having to profile them to reach them. You can also exercise the rights in §6.

5. How long we keep it, and what deletion actually means

• While your seat is active: your corpus is kept until you delete it. We do not impose a separate expiry.
• Journal and brief: transcripts of meetings and voice notes you record are deleted 24 months after the meeting; the notes made from them stay until you delete them. A brief from another place is deleted within 48 hours. When you delete your seat, your journal and our working copy of your vault are erased within 30 days; the vault in your own storage is yours and stays. If your sign-in is set up again (for example after a password or two-factor reset), entries from before are hidden from the account, not deleted, until an administrator confirms it is still you.
• Your people, labels, names and terms, and your voiceprint: kept until you delete them or your seat is deleted. Deleting the voiceprint removes it from our live systems at once.
• Chats and task lists: your chats, with their photos and voice messages, and your tasks are kept until you delete them or your seat is deleted. The summary of each relationship made from your chats is deleted 24 months after it is made.
• Things to do, plans and AI-client tokens: the cities you follow, your event decisions, your plans and their steps are kept until you delete them or your seat is deleted. The record of an AI-client token is deleted 30 days after it expires or is revoked, and with your seat; when the sign-in it belongs to is removed first, its name is removed at once and the rest of the record 30 days later.
• When you ask us to disconnect a source, remove our Slack app from your Slack account, or delete your seat: the content, its embeddings, and the stored credential are erased from our live systems.
• A legal hold: if the law requires us to keep a seat's data, or it is needed for a legal claim, we place a legal hold on the seat. While the hold lasts nothing in the seat is erased, even if you ask us to or delete it yourself, and the deletion periods above pause; when the hold ends they run again. A refused deletion says it is held, and you can ask us why at privacy@doju.org. If you disconnect a source or withdraw a consent you recorded, or someone objects, while the hold lasts, we stop using that data at once and delete it when the hold ends; if you disconnect a source here and reconnect it before then, we keep it.
• Backups — stated honestly: encrypted backups are retained on a rolling schedule for disaster recovery. Erased content persists in those backups for up to approximately 400 days, and a restore re-applies every recorded deletion. A file you delete, or the files of a seat that is closed, are removed from our live systems at once and stay only in those encrypted backups until they age out.

6. Your rights

You can ask us to: give you a copy of your data (access), correct it, delete it, restrict or object to how we use it, and receive it in a portable format. Where processing rests on your consent you can withdraw it at any time.

For the personal AI suite specifically: a seat holder's rights cover their own data. You can ask for an export of everything or for deletion of everything. You cannot use these rights to remove a third party's data from your own corpus on their behalf — those rights belong to that person.

If you are a correspondent, not a seat holder — someone whose message or document a seat holder's own corpus contains — you can contact us directly at the address in §1 to exercise your own rights. We will respond to every such request. Because the content was communicated to the seat holder, the likely outcome for an erasure or objection request is a documented refusal: we weigh your request against the seat holder's own legitimate interest in keeping what was communicated to them (GDPR Art. 17(1) / Art. 21(1)), and that interest ordinarily outweighs it. A refusal is a reasoned answer, not silence, and we will tell you why.

If you are in a seat holder's contacts and object to the assistant learning about you, we honour it: we delete what the assistant has learned about you and it stops learning about you in that person's workspace. We keep a minimal record of your objection, never what you wrote, so that it keeps working.

Contact privacy@doju.org. We respond within one month.

7. WhistleBlower reporters

If you make a report through a WhistleBlower channel we host: the organisation you reported to is the controller; we process on its instructions. Your report is stored pseudonymously and access is restricted to that organisation's designated case handlers. Reporter confidentiality is protected under the EU Whistleblower Directive and the Finnish Whistleblower Protection Act (1171/2022) — including from us. Rights requests about your report go to the organisation; we will support it in answering.

8. Where the data is, and who else touches it

Our systems run on EU infrastructure. Some services we depend on (listed with their transfer safeguards in our subprocessor inventory) are outside the EEA; where they are, transfers rely on Standard Contractual Clauses or another Chapter V mechanism. The current list of subprocessors is available on request.

9. Changes

We will update this notice when the processing changes, and record the version above. Material changes affecting you will be communicated where we have a means of reaching you.