Privacy policy

FINSA Technologies Oy, business ID 3509563-6, Finland.

For data protection matters, contact: support@finsa.ai. No postal address is published, because there are no premises; everything is handled by email.

The site has no visitor tracking, no analytics and no advertising pixels. The only form is the contact form inside the chatbot (section 5). Pages are not personalised, and browsing them leaves no record with us.

Five things are processed, and each is described below in its own section: the messages you write to the chatbot (section 5), your IP address, briefly, to prevent misuse of the chatbot (section 5), an enquiry you leave through the chatbot’s form (sections 5 and 7), the times demo pages are opened and the number of messages written on them (section 7), and the conversations written to the bot on demo pages (section 7).

In addition, we process information about companies we send a demo to on our own initiative: section 4 covers how we contact them by email and by phone, and section 7 what is kept of the demo and its sale, and for how long.

The site is static: every visitor receives the same pre-built page. The provider that runs the server logs technical data, such as the IP address and the browser identifier, in the usual way, for network operation and security. These logs are not used to track visitors and are not combined with any other data.

The site sets no cookies on visitors. That is also why there is no cookie banner — there would be nothing to consent to.

One thing is stored in your browser, and only for the duration of your visit: the fact that you have closed the chatbot’s speech bubble, so that it does not appear again. It is kept in the browser’s sessionStorage. It is not a cookie or an identifier, it is not sent with requests and never leaves your device, and it disappears by itself when you close the tab.

Nothing remains in your browser after your visit. The site does not remember you next time, and does not try to.

The site has one cookie, and it does not concern visitors: the site’s administrator signs in at /admin, and signing in stores a session cookie. It is set only for the /admin path, so your browser never stores or sends it on these pages. The cookie contains no personal data, is not used for tracking, and is strictly necessary for signing in — a cookie of that kind does not require consent.

The site’s contact buttons open your email program. The message therefore travels from your own email to ours — the site does not pass it on and does not see its content.

Once you have sent a message, we process the information in it to reply to you and to manage any customer relationship that follows. The legal basis is legitimate interest before a contract, and the contract after one. Emails are kept for as long as handling the matter and our accounting obligations require.

We also contact companies ourselves. We build a demo for a company (section 7) and send an email about it to the person named as a contact on the company’s own website, or whose role the matter concerns. The address comes from the company’s public website; we do not buy addresses or look for them elsewhere. We may also phone the company on a number it has published on its own website. This is direct marketing aimed at a business, and the legal basis is legitimate interest: offering a service to a company we judge would benefit from it.

You can object to being contacted at any time by replying to the message, by saying so on the phone, or by writing to support@finsa.ai. After an objection we will not contact you again. So that the objection holds, we keep the address on a do-not-contact list — that is the only thing kept because of it. The emails themselves are kept as described above, and the sales information about the demo as set out in section 7.

The site has a chatbot that can be used in two modes. In decision-tree mode it shows only answers written in advance and sends nothing anywhere. In AI mode, the message you write is sent to the API of Anthropic PBC to produce an answer.

Anthropic acts as a processor on our behalf. We send it only the content of the conversation — not your name, your email address, your IP address or any other identifier. Anthropic does not use content sent through its API to train its models.

We do not store conversations. A conversation exists only in your browser’s memory and disappears when you close the tab. Our server passes the message on and forgets it straight away: the message is never written to our database or to a log file. This applies to this site’s own chatbot. The bot on demo pages is an exception, described in section 7. The legal basis is legitimate interest: providing the site’s functions to the person using it.

The chat also has a contact form, and it is an exception to the above. When you want a quote, or the bot cannot answer, it may offer a short form: you write what it is about and how to reach you, and you send it yourself. The message and contact details you send through the form are stored in our database and emailed to us, so that we can contact you — unlike the conversation, the form exists for exactly that. No conversation, IP address or cookie is stored with the enquiry. The legal basis is legitimate interest before a contract: responding to an enquiry. The enquiry is deleted at the latest 12 months after it was made, and immediately if you ask. The email is delivered by Scaleway SAS (France), which processes it on our behalf within the EU.

Anthropic, however, does not forget a message in the same second as we do. Under Anthropic’s own procedure, messages sent to its API and their answers are deleted from its systems within 30 days. If automated monitoring flags a message as violating Anthropic’s usage policy, the message and the answer may be kept for up to two years, and the classification data the monitoring produces for up to seven years. We cannot influence this. This information was checked on 16 August 2026 against the terms Anthropic publishes.

So that nobody can load the bot without limit, the server keeps count of how many messages have been sent from one IP address in the last ten minutes. The address stays in the server’s memory for about a quarter of an hour at most and then disappears by itself; it is not written to disk, not combined with the content of messages and not used for anything else. The legal basis is legitimate interest: preventing misuse of the service.

Anthropic is located in the United States, so this is a transfer outside the EU. The transfer is based on the standard contractual clauses approved by the European Commission. If you do not want your message to go there, use decision-tree mode or contact us by email.

We do not sell data or disclose it to third parties for marketing. Email and server infrastructure are services we buy, and their providers process data on our behalf under contract.

The server is located in the EU. If data is transferred outside the EU, the transfer is based on the standard contractual clauses approved by the European Commission.

We build demonstration versions of a chatbot for companies, each at its own address of the form /demo/… (in English, /en/demo/…). A page is meant for the company it was made for, and it is not indexed by search engines.

A demo’s knowledge base is built from the company’s own public website. We fetch the pages the same way anybody does with a browser and store up to 60,000 characters of text from them, so that the bot can answer about that particular company. The text may contain personal data the company has itself published on its website — for example employees’ names, job titles, email addresses and phone numbers. We do not look elsewhere for anything that goes into a demo’s knowledge base. The public company information added to the sales information is described below.

The legal basis is legitimate interest: direct marketing to a company we judge would benefit from the service. Because the data has been obtained from someone other than the data subject, this section also serves as the notice required by Article 14 of the General Data Protection Regulation. We do not send a separate notice to every person mentioned on the pages, because it would require disproportionate effort — which is why it is stated publicly here. If you are mentioned on such a website and do not want your details in a demo, we will remove the demo or the information you ask about immediately: support@finsa.ai.

A demo page records when it is opened and counts how many messages are written to the bot. We compare the times of the opens with the times our own emails were sent: that tells us whether it is worth contacting the company again and which of our messages led to the page being opened. Only the time of an open is stored — no per-visitor data, no cookie and no IP address. No individual visitor can be told apart from the opens. The demo page’s chatbot is subject to the same brief misuse prevention as in section 5. The legal basis is legitimate interest in marketing.

Conversations on demo pages are stored from 8 September 2026. When you write to a demo page’s AI chatbot, your message and the bot’s answer are stored in our database. We use the stored conversations only for analytics: we read what the bot is asked and how it answers, so that we can improve it. The storing applies only to demo pages — it does not apply to this site’s own chatbot, whose conversations are still not stored (section 5). Nothing is stored in decision-tree mode.

No IP address, cookie, identifier or any other information about who wrote a message is stored with the conversation. The conversation is not linked to a person, and it is not used for marketing, profiling or training language models. The content of a message is, however, exactly what you wrote — so do not write your name, contact details or other personal data to the bot. The legal basis is legitimate interest: developing the product. The bot’s answers are deleted with the demo (below). The questions are kept after that as part of the sales information (below), because they show what a bot built from the company’s website is asked; email addresses and phone numbers are removed from the questions automatically before they are kept. On request, we delete a conversation sooner. In AI mode, the message also passes through Anthropic’s API on the same terms as in section 5.

A demo’s chat may have a contact form. If the company the demo was made for has given an address for it, the bot may offer a short form: you write what it is about and how to reach you, and you send it yourself. The message and contact details you send through the form are emailed to that company, with a copy to us, and stored in our database so that the enquiry is not lost if the email does not get through, and so that it can be deleted on request. The company processes the enquiry it receives as a controller in its own right. We keep our own copy for following up on enquiries for up to 12 months after it was made, and delete it immediately if you ask. No conversation, IP address or cookie is stored with the enquiry. The legal basis is legitimate interest: passing an enquiry on to the company it is meant for. The email is delivered by Scaleway SAS (France) on our behalf within the EU.

A demo page uses the company’s own name, logo and colour to show what the bot would look like on its website. The page was not made by the company or in cooperation with it, and the page says so. We remove a demo immediately on request — a message to support@finsa.ai is enough.

A demo is deleted at the latest 90 days after it was created. Demos created before 26 September 2026 are deleted 30 days after they were created, as the email about them said. The deletion covers the demo page, the text read from the company’s website, the decision-tree bot’s conversation tree, the demo’s appearance and the bot’s answers. The deletion is final: this data disappears from the database, and neither the page nor its content is kept.

Sales information is kept after the demo is deleted. It consists of the company’s name and web address, the contact person’s name and work email address, the phone number the company has published on its website, the dates the demo was created and sent, the dates of follow-ups and calls, when replies arrived, the time of every open, the number of opens and messages, when the latest message was written, the size of the demo as numbers (how many pages were read and how many points the conversation tree has), the questions written to the bot as described above, and the outcome: whether a sale was made or not.

We add publicly available information about the company to the sales information: its industry, company form and founding year from the open data of the Finnish Patent and Registration Office, and measurements of its website — how many pages and how much text it has, its publishing platform, its language versions, whether it already has a chatbot and how many named people it mentions. Of those people we keep only the number, never names or addresses. We classify the subject lines and content of our own sales emails with Anthropic’s API, on the same terms as in section 5.

We use the sales information to follow up on sales and to judge what works in our outreach. The legal basis is legitimate interest in business-to-business sales. Sales information is deleted at the latest 24 months after our last contact with the company, and immediately if the company or the contact person asks (section 4). Deleted sales information may leave behind only quarterly totals — for example how many demos were sent and how many were opened — from which no company or person can be identified.

Sales information is also kept for demos created before 19 September 2026. An earlier version of this policy said that no figures or conversations would be kept for them. If you are the contact person for such a demo and do not want the information kept, we delete it immediately — a message to support@finsa.ai is enough.

This policy covers only this website. The chatbots we build for our customers run on the customer’s own website, and the controller of the data processed in them is the customer.

When we deliver a bot, we make a separate data processing agreement with the customer, which sets out what data is processed, how long it is kept and which subcontractors are used.

You have the right to know whether we process data about you, to receive a copy of it, to have inaccurate data corrected, to ask for data to be erased, to restrict processing and to object to it. You can also withdraw any consent you have given at any time.

Send requests to support@finsa.ai. We reply within a month. In practice, the data that can be linked to you is your email correspondence with us, an enquiry you left through the chatbot’s form (sections 5 and 7) and, if you are your company’s contact person, the sales information described in section 7. Conversations with this site’s chatbot are not stored, and the figures on demo pages do not tell who opened a page. A conversation stored on a demo page cannot be linked to you either, so if you want one deleted, tell us in your request which demo page you wrote on and roughly when, and we will delete those messages.

If you believe we are processing your data unlawfully, you can lodge a complaint with the Office of the Data Protection Ombudsman (tietosuojavaltuutetun toimisto) in Finland.

If the site changes so that it starts to process data differently from what is described here, we will update this policy before the change is introduced. The top of the page states when the policy was last updated and which version it is.

Version history, substantive changes:

• 1.8 (26 September 2026): sales information also for demos created before 19 September 2026; public company information added to sales information; contact by phone; the time of every demo page open; demos created from 26 September 2026 are kept for 90 days.
• 1.7 (26 September 2026): the chat’s contact form.
• 1.6 (18 September 2026): sales information kept after a demo is deleted; our contact with companies.
• 1.5 (7 September 2026): conversations on demo pages stored from 8 September 2026.
• 1.4 (17 August 2026): the administrator’s sign-in cookie.
• 1.3 (16 August 2026): a demo’s knowledge base and retention period; Anthropic’s retention period.
• 1.2 (14 August 2026): brief processing of IP addresses to prevent misuse.

You will find our contact details on the contact page.