Suunta.ai Privacy Notice
Introduction
Y4 Works Oy ("Suunta.ai", "we") provides the Suunta.ai service, an AI-assisted strategy service for organisations. This Privacy Notice explains how we process personal data for which we are the controller: the account data of users of the service, invoicing, information security, product analytics, communications, and sales and marketing.
Customer organisations submit their own content to the service, such as strategies, goals, documents and conversations. The customer organisation is the controller of this content, and we process it on the customer's behalf under a data processing agreement. For questions about such content, please contact the organisation whose service you use.
Controller: Y4 Works Oy, business ID 2978296-6, Kanavaranta 9, 00160 Helsinki, Finland, privacy@suunta.ai.
Data We Collect
1.1 Data You Provide
Account data
| Data | Required | Purpose |
|---|---|---|
| Email address | Yes | Account sign-in, communications |
| First and last name | Yes | Identification within the service and personalisation |
| Phone number | No | Optional contact detail |
| Password | Yes* | Authentication |
| Profile picture | No | Personalisation |
| Language setting | Yes | Localisation |
| Additional profile information, such as job title and team | No | Personalisation and organisational structure |
| Personal goals | No | Personal goal tracking; visible only to you unless you choose to share them |
*Users who sign in with single sign-on authenticate through an external identity provider, such as Google or Microsoft, and do not have a Suunta.ai password.
Organisation data. We ask for the organisation's name. The country and other basic information about the organisation, such as its industry, size, website and logo, may be completed from public sources or provided voluntarily. We use this information to manage the account and tailor the service.
Content submitted to the service. Customer organisations and their users submit content to the service, such as strategies, goals, metrics, tasks, documents and conversations with the AI. This content may include personal data, such as names and roles. The customer organisation is the controller of this content, and we process it on the customer's behalf. We do not use this content to train general-purpose AI models without the customer's consent.
1.2 Data Collected Automatically
Technical data
| Data | Purpose | Retention |
|---|---|---|
| IP address | Security, fraud prevention | 180 days in session data, 12 months in sign-in logs and 7 days in server logs |
| User agent (browser and device) | Security, session management | 180 days in session data and 12 months in sign-in logs |
| Sign-in timestamps | Security auditing | 12 months |
| Session data | Authentication state | For the validity of the session; basic session details 180 days |
| Failed sign-in attempts | Protection of sign-in | 12 months |
| Time zone | Displaying times; read from the browser | For the life of the account |
Usage data
| Data | Purpose | Retention |
|---|---|---|
| Service usage amounts, such as credit consumption | Invoicing, usage monitoring | 24 months |
| Activity logs (sign-ins and account security events) | Security and traceability | 12 months |
| Email delivery data | Ensuring delivery of messages | 12 months; after that we keep only a record that the message was sent, so it is not sent twice |
| Service usage events | Developing the service at organisation level; at person level only with your consent | 24 months |
1.3 Data Received from Third Parties
Single sign-on. If you sign in through an external identity provider, we receive the basic information needed for sign-in, such as your name, email address and profile picture.
When you are invited to the service, the person inviting you provides your email address and may provide your name and your role in the organisation.
When an organisation signs up, we retrieve basic public information about it, such as its business ID, registered location and headcount, from public sources such as the trade register and the organisation's website. This information is shown during sign-up for review.
Payment data. Our payment service provider processes your payment card details directly. We receive the information needed to manage the subscription, not your card details.
Integrations. If your organisation connects other services to the service, the content received from them forms part of the content the organisation has submitted to the service.
1.4 Sales and Marketing
We also process data about people who do not use the service, such as prospective customers, partners and their contact persons, people who contact us through our website, and subscribers to our newsletter.
| Data | Source | Purpose |
|---|---|---|
| Name, job title, organisation, work email and phone number | You, or public sources such as organisations' websites and LinkedIn | Communications, sales and customer relationship management |
| Communication history, such as messages and meetings | Our communications with you | Customer relationship management |
| Newsletter subscription and opens of marketing messages | You and the marketing tools we use | Marketing and its development |
We retain this data for as long as communication remains relevant, but no longer than 24 months from the last contact unless a customer relationship has been established. You may opt out of marketing at any time by replying to a message, using the unsubscribe link in a message or contacting privacy@suunta.ai.
How We Use Data
| Purpose | Legal basis (Article 6(1) GDPR) |
|---|---|
| Providing the service to users, such as account management and sign-in | Legitimate interest in performing the agreement with the customer organisation (f) |
| Service-related messages, such as verification codes and notifications | Legitimate interest (f) |
| Responding to support requests | Legitimate interest (f) |
| Completing basic organisation information from public sources during sign-up | Legitimate interest (f) |
| Invoicing and subscription management | Legal obligation (c) and legitimate interest (f) |
| Security, prevention of misuse and maintenance of logs | Legitimate interest (f) and legal obligation (c) |
| Developing the service using organisation-level usage data | Legitimate interest (f) |
| Person-level product analytics | Consent (a) |
| Sales and communications with organisations | Legitimate interest (f) |
| Newsletter and other consent-based marketing | Consent (a) |
| Compliance with legal obligations | Legal obligation (c) |
Where processing is based on legitimate interest, we have assessed that the processing is necessary and does not override your rights. You may object to such processing in accordance with Section 7.
We do not:
- sell personal data
- use content submitted to the service for targeted advertising
- disclose data to data brokers
- use content submitted to the service to train general-purpose AI models without the customer's consent.
AI and Content Submitted to the Service
When you use the AI features of the service, your prompt and related content are sent to an AI provider to generate a response. Inputs may be screened automatically for misuse. From the screening we ourselves store only statistics without content or a user identifier. The AI provider's own abuse monitoring may, however, involve temporary retention of inputs as described in the subprocessor list. We select providers and their settings so that the content is not used to train their general-purpose models.
We store content of the AI features, such as conversation history and the search index of uploaded documents, to the extent required for the service to function. When a document is deleted from the service, it is no longer used and its search index is deleted. This content belongs to the customer organisation, and its processing is governed by the Data Processing Agreement.
When you talk with the AI in a workspace, summaries of the conversation are automatically added to the workspace's shared memory. The AI of all workspace members may use the summaries, and they may contain information mentioned in the conversation, including about other people. Decisions and other records are saved to the organisation's shared data only when you approve them. If you want to talk privately, use a conversation outside the workspace.
The AI may store things about you from conversations, such as your role or how you prefer answers, so that it can serve you better. You can see what has been stored in the service settings and delete it. It is also deleted when your account or your organisation is deleted.
Sharing of Data
4.1 Service Providers
| Recipient category | Purpose | Location |
|---|---|---|
| Cloud infrastructure providers | Operation of the service and data storage | EU/EEA |
| AI providers | AI processing | EU/EEA or United States |
| Payment service provider | Payment processing | EU/EEA or United States |
| Email service | Delivery of service-related messages | EU/EEA or United States |
| Analytics service | Product analytics with your consent | EU/EEA or United States |
| CRM and marketing tools | Sales, communications and marketing | EU/EEA or United States |
| Integration services | Connecting services that the organisation itself chooses to connect | EU/EEA or United States |
| Internal communication and support tools | Operational notifications and customer support | EU/EEA or United States |
The service providers used to deliver the service and their locations are listed at https://work.suunta.ai/legal/subprocessors.
4.2 Your Organisation
When you use the service through your organisation's account, your organisation's administrators and other users may, in accordance with their access rights, see for example your name, role and activity in the service.
4.3 Integrations Initiated by Your Organisation
Your organisation may connect third-party services of its choice to the service, such as communication and collaboration services, office software and automation services. Your organisation decides which integrations are used and what data is transferred through them, and is responsible for their use. Third-party services process data in accordance with their own terms and privacy notices, and we are not responsible for their processing of data.
4.4 Legal and Other Grounds
We may disclose data:
- as required by applicable law or legal proceedings
- to respond to lawful requests from authorities
- to protect our rights, security or property
- in connection with a corporate transaction, sale of business or business reorganisation.
4.5 With Your Consent
We may share data with others when you have given your explicit consent.
International Transfers
5.1 Processing Locations. Data is processed primarily within the EU/EEA. Some processing, such as AI processing, may take place outside it, for example in the United States.
5.2 Transfer Safeguards. Transfers outside the EEA are based on an adequacy decision of the European Commission or on standard contractual clauses approved by the European Commission, together with supplementary measures where necessary.
Data Retention
6.1 Retention Periods
| Data type | Retention period |
|---|---|
| User account data | For the life of the account |
| Deleted user accounts | Personal data is deleted or anonymised when the account is deleted |
| Basic organisation data | Until the organisation is deleted |
| Technical data and sign-in logs | As set out in the table in Section 1, at most 12 months |
| Usage amounts and usage events | 24 months |
| Activity logs (sign-ins and account security events) | 12 months |
| Change history of customer content | Part of the customer's data and kept for the term of the agreement; IP addresses and user agents attached to it are removed after 12 months |
| Deletion and consent records | For as long as they are needed to demonstrate compliance with legal obligations or to defend legal claims |
| Invoicing and accounting data | As required by the Finnish Accounting Act: vouchers for six years from the end of the calendar year in which the financial year ended, and accounting records and financial statements for ten years from the end of the financial year |
| Sales and marketing data | No longer than 24 months from the last contact unless a customer relationship has been established |
| Backups | Deleted automatically as part of the rotation, within 31 days at the latest |
Retention periods are maximum periods and are counted from when the data was created unless the table states otherwise. Sign-in rate limit data is deleted 30 days after the last attempt.
6.2 Deletion of an Account
When a user account is deleted:
- your personal data is deleted or anonymised
- your access to the service ends
- content you have produced for your organisation, such as goals and decisions, remains the organisation's data
- log data may be retained without a direct identifier until the end of its retention period.
6.3 Deletion of an Organisation
Deletion of an organisation may be preceded by a transition period during which the request can be cancelled. The organisation's data is then deleted. User accounts are retained, but their access to the organisation ends. A log entry of the deletion is retained.
6.4 Restoring from a Backup
If the service data has to be restored from a backup, we delete again from the restored data anything that had been deleted before the restore, before the service is reopened for use.
Your Rights
Under the GDPR, you have the following rights:
- the right of access to your data (Article 15)
- the right to rectification of your data (Article 16)
- the right to erasure of your data (Article 17)
- the right to restriction of processing (Article 18)
- the right to data portability (Article 20)
- the right to object to processing based on legitimate interest (Article 21); you may object to direct marketing at any time without giving reasons
- the right to withdraw your consent at any time.
You may exercise your rights in the settings of the service where the feature is available, or by contacting privacy@suunta.ai. We may ask you to verify your identity before handling a request. Requests concerning content submitted to the service by an organisation are handled by that organisation as the controller.
You also have the right to lodge a complaint with a supervisory authority. In Finland, the supervisory authority is:
Office of the Data Protection OmbudsmanVisiting address: Lintulahdenkuja 4, 00530 Helsinki, FinlandPostal address: P.O. Box 800, 00531 Helsinki, Finlandtietosuoja@om.fi+358 29 566 6700Cookies and Similar Technologies
8.1 Cookies We Use
| Cookie | Type | Purpose | Duration |
|---|---|---|---|
session | Strictly necessary | Sign-in and session security | Expires after 12 hours of inactivity, at most 30 days |
remember_token | Strictly necessary | Keeps you signed in if you choose Stay signed in | 30 days |
suunta_consent | Strictly necessary | Remembers your analytics choice (version, choice and time, no identifier) | 12 months |
crowd_submitted_<survey> | Strictly necessary | Prevents answering the same survey twice; set only when a survey is answered | 12 months |
ph_<project>_posthog | Analytics, only with consent | Pseudonymous product analytics (PostHog, EU) | 12 months |
In public surveys, we also prevent repeated answers from the same respondent by storing with the answer a hash derived from the IP address, from which the IP address cannot be read.
The analytics cookie is set only if you allow it. You may change your choice at any time: when signed in, under Settings → My account → Analytics, and otherwise through the Cookie settings link at the bottom of the sign-in page. When you withdraw consent, analytics cookies and browser storage are removed from your device.
Website. The Suunta.ai website (suunta.ai) is a separate site. If you allow analytics there, the PostHog cookie is set for the whole suunta.ai domain, so it is also valid in the app (work.suunta.ai) and a visit to the website and to the app by the same user can be linked pseudonymously. The website stores your consent choice in your browser's local storage, and the choice does not carry over to the app: in the app the choice is made separately. You can change the website choice from the Cookie settings link on the website.
8.2 Non-Essential Cookies
We use non-essential cookies and similar technologies only with your consent.
8.3 Local Storage
| Category | Examples | Basis |
|---|---|---|
| User interface settings | Sidebar state, display theme, time zone | Operation of the service you requested |
| Unfinished drafts and recent items | A message or survey answer you are writing before sending it, recently opened items | Operation of the service you requested |
| Temporary cache | Conversation messages for the duration of the browser session | Operation of the service you requested |
| Analytics | PostHog product analytics and Suunta.ai's own person-level usage analytics | Consent |
| Website consent choice | Analytics choice, version and time (no identifier) | Remembering your choice |
Locally stored data is kept only on your device. You can delete it in your browser settings.
8.4 Third-Party Content
The service may load content from third parties, for example from the payment service provider during payment. These may set their own cookies in accordance with their own privacy practices.
Security
9.1 Technical Measures
- Encryption of data in transit and at rest
- Secure storage of passwords
- Session security
- Access control and segregation of organisations' data
9.2 Organisational Measures
- Confidentiality obligations for personnel
- Information security guidance
- Incident handling procedures
- Assessment and development of security measures
9.3 Your Responsibility
- Keep your password safe
- Use a strong, unique password
- Report suspicious activity immediately
- Sign out on shared devices
Children
Suunta.ai is a service intended for organisations and is not directed at children. An organisation may grant access to the service to a person aged at least 15 who acts in a role for the organisation, such as in an employment or elected position. We do not knowingly process personal data of children under 15. If we learn that the service is being used by a child under 15, we will delete the data of their account.
Changes to This Notice
We may update this Privacy Notice. We will notify you of material changes by email or in the service before they take effect.
Contact Details
For privacy questions and to exercise your rights: Y4 Works Oy (Suunta.ai), privacy@suunta.ai. This is our contact point for privacy matters. For general enquiries: team@suunta.ai.
Automated Decision-Making
We do not make automated decisions that produce legal effects concerning you or similarly significantly affect you. The AI features provide suggestions and analyses, but decisions are always made by people.