This privacy policy ("Policy") describes, as required by the EU General Data Protection Regulation (Regulation (EU) 2016/679 of the European Parliament and of the Council, "GDPR"), how we at Heppu AI Oy ("Controller", "we", "us", "our" and, as set out below, also "Processor") process the personal data ("Data") of natural persons ("Data Subject") and what rights the Data Subject has.
The Policy covers both the Data we collect as Controller and the Data we process under a data processing agreement ("DPA") between us and our customer companies ("Customer"). Where processing is based on a DPA, our Customer acts as the controller ("Client") and we act as Processor.
Controller and contact person
Heppu AI Oy (Business ID 3517137-9)
Keilaranta 16, 02150 Espoo, Finland
Questions about the processing of personal data and requests to exercise your rights are handled by:
Mika Jordanov
mika@heppu.ai
Legal basis for processing personal data
We process personal data primarily on the basis of the Data Subject's consent. We also process personal data to fulfil contractual obligations and on the basis of the legitimate interests of the Controller and the Client. Legitimate interest is the legal basis when we use Data for processing needs that are part of ordinary business operations. The marketing emails we send to people at companies are based on our legitimate interest in marketing our service to companies.
The service agreement between us and the Client ("Service Agreement") also counts as a contractual obligation. To deliver the service agreed in the Service Agreement, we process personal data either as Controller or as Processor, depending on whether the Data Subject is a representative of the Client or a customer or prospective customer of the Client.
Purpose of processing personal data
We process personal data lawfully and only for the specific purpose set out in this Policy.
Processing personal data is necessary
- to provide and market our services;
- to manage the customer relationship, including customer communication, marketing and invoicing;
- to market our service by email to people at companies;
- to fulfil and deliver the services agreed in the Service Agreement;
- to operate our website;
- to pursue the legitimate interests of the Controller and the Client; and
- to comply with legal obligations.
Data sources
We collect Data both automatically and from the Data Subject directly (for example through website forms and customer communication). We have the right to verify and supplement the data received from the Data Subject using publicly available sources such as the Finnish Trade Register.
For email marketing we get the names, work email addresses and job titles of people at companies from Vainu.io Software Oy's service, from the GetLeads service (getleads.io), from public LinkedIn profiles, from company websites and from other public sources, and from a colleague who tells us whom the matter belongs to. We also pick companies based on public job ads (Duunitori, LinkedIn and Työmarkkinatori) and public financial statements. From the ads we store only data about the company, such as the ad's title, the employer and the publication date.
Automatic data collection and processing is based on the use of our website and our other online services.
Under the Service Agreement and the DPA, we receive Data from the Client. The Client is responsible for what data is disclosed to us and what it is used for.
Cookies and website tracking
Our website uses the services, cookies and browser storage listed below. We run our own visitor analytics. It uses no cookies and does not store IP addresses, so it does not require consent. To measure advertising we use Google Ads, LinkedIn and Meta cookies, which we enable only with your consent. You can accept or reject marketing cookies in the cookie notice on the site, and change your choice with the Manage cookies link at the bottom of the page. If you accept marketing cookies, we share the email address and phone number you enter in a form with Google Ireland Limited in hashed form for conversion matching (enhanced conversions). In the same way, we share the email address you enter in a form with LinkedIn Ireland Unlimited Company in hashed form for ad targeting and measurement (enhanced matching).
This is how the visitor analytics works. When a page loads or you take a measured action on it, your browser sends our server the page address, the address of the previous page, the screen width and the name of the action. The server derives a visitor identifier from your IP address, your browser's identification string and a random key that changes every day and is deleted after a day. The identifier does not reveal the IP address, and visits by the same person cannot be linked across days. We do not store the IP address or the browser identification string. We store the page path, the arrival source, campaign parameters (utm parameters), whether the visitor came through an ad, the device class and the actions. We delete this data after 400 days.
The site keeps a record in the browser's session storage of how you arrived: campaign parameters, the previous site's address, the first page, the ad click identifier (for example gclid) and a random session identifier. The record is removed when you close the tab. When you send a form or start a chat, we attach this record to your enquiry so we can see which marketing brings enquiries. If you accept marketing cookies, we keep the same record in the browser's local storage for 90 days, so a later visit is linked to the original source.
| Service or cookie | Provider | Purpose | Duration | Legal basis |
|---|---|---|---|---|
| Heppu visitor analytics | Heppu AI Oy (server: Hetzner Online GmbH, Helsinki, EU) | Counting visitors and measuring marketing. Uses no cookies and does not store IP addresses. The visitor identifier changes daily. | No cookie. Data deleted after 400 days. | Legitimate interest |
| heppu_attribution_session and heppu_context_id (browser session storage) | Heppu AI Oy | Remembers, for as long as the tab is open, how you arrived on the site, and attaches it to an enquiry you send. | Until the tab is closed | Legitimate interest |
| heppu_attribution (browser local storage) | Heppu AI Oy | Remembers the arrival source and ad click for later visits. Enabled only with consent. | 90 days | Consent |
| heppu_consent (cookie) | Heppu AI Oy | Remembers whether you accepted or rejected marketing cookies. | 12 months | Legitimate interest |
| Google Ads (_gcl_* cookies) | Google Ireland Limited (Ireland, EU; transfers to the United States under the EU-US Data Privacy Framework) | Measuring ad performance and conversions, and remarketing. Enabled only with consent; without consent, measurement is cookieless and anonymous (Consent Mode). | Up to 90 days | Consent |
| LinkedIn Insight Tag (including UserMatchHistory, bcookie, lidc, li_sugr) | LinkedIn Ireland Unlimited Company (Ireland, EU; transfers to the United States under the EU-US Data Privacy Framework) | Ad targeting and conversion measurement on LinkedIn, and remarketing. Loaded only with consent. | Up to 12 months | Consent |
| Meta Pixel (_fbp, _fbc) | Meta Platforms Ireland Limited (Ireland, EU; transfers to the United States under the EU-US Data Privacy Framework) | Ad targeting and conversion measurement on Facebook and Instagram, and remarketing. Loaded only with consent. | Up to 90 days | Consent |
| Cloudflare Turnstile | Cloudflare, Inc. (United States, EU-US Data Privacy Framework) | Protects the site's forms from bots and abuse. | Session | Legitimate interest (security) |
| Heppu chat widget | Heppu AI Oy | Enables the chat conversation on the page. Processes the data given in the conversation and how you arrived on the site. | Session | Legitimate interest (service operation) |
Marketing and sales tracking
We store enquiries sent through the website's forms, calls to our demo numbers and chat conversations in a marketing database. The database runs on our own server in Hetzner Online GmbH's data centre in Helsinki. We use it to find out which marketing channels and campaigns bring enquiries and sales.
The content of a form (name, email address, phone number and message) stays in the database for at most 7 days after we have moved it to our customer relationship management system (Pipedrive OÜ, Estonia, EU). After that the database keeps the company name, the arrival source and campaign data, and the email address and phone number in hashed form.
We complete the details of the enquiring company (business ID, industry, company form and municipality) from the Finnish Patent and Registration Office's open company data. We get the company's headcount and revenue from Vainu.io Software Oy's service.
When someone calls our demo number, our service records the caller's phone number, the length of the call and a summary of the conversation. In the marketing database we store the phone number only in hashed form. If the caller asks to be contacted, we move the phone number, the summary and any email address to our customer relationship management system.
If you have accepted marketing cookies, our server reports your enquiry (form, chat or call) to Google Ireland Limited, LinkedIn Ireland Unlimited Company and Meta Platforms Ireland Limited if your company is in our target group by size, and later reports it again if your enquiry becomes a sales opportunity or a sale. We send the ad click identifier, the hashed email address and phone number (to Meta only the hashed email address), the address of the web page where the enquiry was made, the time of the event and the value of the sale. These services use the data to measure advertising and to target ads, and keep it under their own terms. The legal basis is your consent. Meta transfers data to the United States under the EU–US Data Privacy Framework. If you rejected marketing cookies, we do not send this data.
Email marketing to companies
We send email to people at companies to tell them about our service. We send messages only to companies that could become our customers. We send them to work email addresses, and they concern the recipient's work. The processing is based on our legitimate interest in marketing our service to companies. We consider that this interest does not override the recipient's rights, because the messages concern only work and every message can be declined.
We get the recipient's name, work email address, job title and company details from Vainu.io Software Oy's service, from the GetLeads service (getleads.io), from the company's website and from other public sources. If the work email address is not known, we infer it from the name and the company's web domain and check before sending that the address is in use. Our first message tells you where we got your data.
We may also get your name, job title and LinkedIn profile address from your public LinkedIn profile. We fetch profiles through the Apify service (Apify Technologies s.r.o., Czech Republic), which processes the data on our behalf. From a profile we use only the name, the current job title, the profile address and the location. Apify may also process the data outside the EU and the EEA, and in that case the transfer is based on standard contractual clauses approved by the European Commission.
We may pick a company because it is advertising a customer service job in a public job ad. We follow ads on Duunitori, LinkedIn and Työmarkkinatori. From an ad we use only data about the company, such as the ad's title, the employer and the publication date, and never the details of the ad's contact person.
We may also pick a company because its headcount has grown according to its public financial statements. We get headcounts from Vainu.io Software Oy's service.
We may also send you a message because you recently started in a role responsible for customer service. We get the start date of the role from the GetLeads service (getleads.io).
If a colleague of yours replies to our message and tells us that the matter belongs to you, we may send you a message. In that case we get your name and role, and sometimes your email address, from your colleague. If they do not give the address, we get it from the GetLeads service or infer it from your name and the company's web domain and check before sending that the address is in use. We may also ask the company's customer service who the matter belongs to. The processing is based on the same legitimate interest as the rest of our email marketing.
We send the messages with the Instantly service (Foo Monk LLC, United States), which processes the data on our behalf. Instantly stores the recipient's details, the messages sent, the replies, and whether a link in a message was clicked. The transfer of data to the United States is based on standard contractual clauses approved by the European Commission.
When you reply to our message, we use AI to help us. We send the text of your reply, your first name, your company's name and our previous message to Anthropic's AI service (Anthropic Ireland, Limited). Anthropic processes the data on our behalf in the United States under standard contractual clauses approved by the European Commission and does not use it to train its AI. The AI classifies the reply and writes a short summary of it and a draft answer. The summary is stored in our customer relationship management system and in our sales team's internal messaging channel. Based on the category, the system may for example stop the messages if you ask us to, or remind the salesperson to get back to you at the time you suggested. The salesperson reviews the draft and sends the answer themselves. No message is sent to you automatically. We do not store the text of your reply, the summary or the draft in our marketing database. Anthropic deletes the data within 30 days. The processing is based on our legitimate interest in answering you quickly.
In our marketing database we store the recipient's email address only in hashed form, their job title, the data source, the company's web domain, the campaign, and whether the recipient replied, was interested or opted out. If we send a message because of a new role, we also store the job title and the start date of the role with the company's data, without a name. If the data came from a colleague's referral, we also store the fact of the referral, the company's web domain and your role as your colleague described it. We do not store names or the content of messages or replies in the database. We do, however, store the category the AI gave the reply, such as interested or not now, and what was done based on the reply. The name and email address of a referred person are kept only in the email service and in the customer relationship management system. We delete the original data of message events from the database after 7 days. We do not send the data of email marketing recipients to Google or LinkedIn.
If you reply with interest or book a meeting, we move your name, email address and company details to our customer relationship management system (Pipedrive OÜ, Estonia, EU), and one of our salespeople will contact you.
We delete a recipient's data from Instantly 12 months after the last message, or 12 months after it was added if no message was sent, unless the recipient has asked to be contacted or their company has become a customer. Other retention periods are described under Retention period.
You have the right to object at any time to the processing of your data for direct marketing. You can opt out by replying to the message, for example with "no thanks" ("ei kiitos"), by using your email program's unsubscribe link, or by writing to mika@heppu.ai. We add your email address to a block list and send you no further marketing messages. Your other rights are described under Rights of the data subject.
Personal data we process
We process the personal data needed to manage the customer relationship and to fulfil the obligations related to it. This includes:
- Identification and contact details (such as name, phone number, postal address, date of birth or personal identity code, email, and details about the customer company, including the details of a sole trader);
- Data related to electronic direct marketing (such as subscription details, consents and opt-outs);
- Data of email marketing recipients (such as name, work email address, job title, LinkedIn profile address, start date of the role, company, messages sent, replies and opt-outs);
- Data related to website visitor tracking (such as pages viewed, arrival source, campaign data and the ad click identifier; the visitor analytics does not store IP addresses);
- Data from calls to our demo numbers and from chat conversations on the site (such as the phone number, the length of the call and a summary of the conversation);
- Data the customer gives voluntarily, such as customer feedback;
Personal data processed under the Service Agreement and the DPA may also include the following Data:
- details of property being registered (for example a vehicle registration number or property details)
Disclosure and transfer of personal data to third parties
As a rule, Data is not disclosed to outside parties. Data (such as customer feedback) may, however, be published as agreed with the customer.
Data may be disclosed to our partners to the extent necessary to perform a contract, or on the basis of our or the Client's legitimate interest. In these cases our partners process the Data on behalf of the controller.
To deliver our service we use sub-processors. When we do, we are responsible for making sure that the sub-processors also follow the Client's instructions.
We may transfer Data for the following purposes:
- to deliver the AI service: the list of sub-processors we use is available at https://heppu.ai/gdpr
- to our partners who process the Data in order to provide their own services (for example accounting, IT systems, banking, insurance);
- with the Data Subject's consent, to the parties the consent concerns; and
- to authorities or legal advisers where disclosure is necessary under the law or on the basis of our legitimate interest.
Transfer of personal data to third countries
To deliver our service we use external service providers, some of which may be located outside the EU and the European Economic Area. We have made sure that these service providers comply with the GDPR.
Protection of personal data
Data is protected with appropriate technical and organisational safeguards. Everyone who processes personal data has committed to keeping the Data Subjects' Data confidential and to processing it only for the purpose set out in this Policy.
Retention period
As Controller, we keep Data for as long as it is needed for the purpose it was collected for. Data collected for a Service Agreement is deleted one year after the end of the calendar year in which the Service Agreement ended, unless the law requires otherwise.
The retention periods of the marketing database are given under Marketing and sales tracking. We delete visitor analytics data after 400 days.
We delete an email marketing recipient's data from Instantly 12 months after the last message, or 12 months after it was added if no message was sent, unless the recipient has asked to be contacted or their company has become a customer. We delete the hashed data in the marketing database after 24 months. We delete the record of a colleague's referral after 12 months. We keep an email address on the block list for as long as needed to keep the opt-out in force.
Law or other regulation may require a longer retention period (for example the retention periods under the Finnish Accounting Act 1336/1997).
When we act as Processor, we process data according to the Client's instructions, in the Client's system or through integrations with the Client's systems. The Client retains data according to its own practice.
Profiling and automated decision-making
Data is not used for profiling or for other automated decision-making.
Profiling means automated processing of Data that evaluates a person's personal characteristics.
Rights of the data subject
Under the GDPR, the Data Subject has:
The right of access:
The Data Subject has the right to confirmation of whether Data concerning them is being processed and, if it is, the right to a copy of their Data;
The right to rectification:
The Data Subject has the right to request that inaccurate or incorrect Data concerning them is corrected. The Data Subject also has the right to have incomplete Data completed by providing the necessary additional information;
The right to erasure:
The Data Subject has the right to request the erasure of Data concerning them if
- the Data is no longer needed for the purposes for which it was collected; or
- the Data has been processed unlawfully.
The right to restriction of processing:
The Data Subject has the right to restrict the processing of Data concerning them if
- the Data Subject contests the accuracy of their Data;
- the processing is unlawful and the Data Subject opposes the erasure of their Data and asks for its use to be restricted instead; or
- the Controller no longer needs the Data for the original purposes of the processing, but the Data Subject needs it to establish, exercise or defend a legal claim.
The right to data portability:
The Data Subject has the right to receive the Data concerning them, which they have provided themselves, in a structured, commonly used and machine-readable format, and the right to transfer that Data to another controller.
The right to object:
The Data Subject has the right to object to the processing of their Data when the processing is based on our legitimate interest. The Data Subject may object to direct marketing at any time, and we then stop processing the Data for direct marketing;
The right to lodge a complaint with a supervisory authority:
The national supervisory authority for personal data matters in Finland is the Office of the Data Protection Ombudsman, which operates in connection with the Ministry of Justice. The Data Subject has the right to bring a matter concerning their Data before the supervisory authority if they consider the processing of the Data to be unlawful.
The Controller responds to a request concerning the Data Subject's rights within one month of receiving it. For specific reasons, the response time may be extended by up to two months.
The Controller is not obliged to carry out all measures requested by the Data Subject. In that case we inform the Data Subject of the reasons for the refusal without delay and at the latest within one month.
Changes to our privacy practices and to this policy
We develop our operations continuously, so we may change and update our privacy practices from time to time. Changes may also follow from changes in legislation.
If the changes introduce new purposes for processing Data or otherwise change the Policy materially, we will announce the changes on our website and, where necessary, ask for consent. The date of the latest update is shown at the top of this page.
This is an English translation of the Finnish privacy policy. If the two versions differ, the Finnish version applies.