Privacy notice - data controller
Contents (16)
1. Data controller
Gosoft Oy is the data controller for the processing described in this notice and is responsible for it under the EU General Data Protection Regulation (GDPR) and the Finnish Data Protection Act (1050/2018).
Gosoft Oy (Business ID: 3454099-6) Punavuorenkatu 7 B 38, 00120 Helsinki, Finland
This notice covers the personal data Gosoft processes for its own purposes: the users of the Gosoft Connect portal and the contact persons of our customers and partners, people who contact us or subscribe to our newsletter, visitors to our own website gosoft.fi, and people who use our AI check.
When a customer uses Gosoft Connect on its own website, or publishes a hosted form (Q-Form) on gosoft.fi, the customer is the controller of the data its visitors and respondents give, and Gosoft processes that data on the customer's behalf. That processing is described in our privacy notice for data processor. Gosoft is, however, the controller of the fingerprints it keeps of AI answers, also when the answers were given on a customer's website (section 3).
2. Contact for privacy matters
privacy@gosoft.fi, or by post to the address above. Gosoft has not appointed a data protection officer.
3. Purposes, legal bases and retention
| Purpose | Personal data | Legal basis | Our legitimate interest | How long we keep it |
|---|---|---|---|---|
| Portal accounts and the service: creating and running your user account, signing you in, your organisation's workspaces and settings, and the notifications you switch on | Name, e-mail address, title and picture if you add them, password (stored only as an argon2id hash), role and organisations, language and display preferences, sign-in times, login sessions, push-notification subscriptions, invitations to the portal (e-mail address, role and who invited you), previews of your organisation's unpublished widgets that you start on its own website (the website's address, which widgets, the visitor identifier of that browser tab, and the start and end times) | Contract (Art. 6(1)(b)) where you are the customer yourself; otherwise legitimate interest (Art. 6(1)(f)) | Providing the service your organisation has ordered to the people it gives access | While you have access to an organisation in the portal. A login session ends after 30 days at the latest or, if it began with Google or Microsoft, at the latest 7 days after the provider last confirmed it, and is deleted 7 days after it ends. Each successful daily check (section 4) is a new confirmation from the provider, so a Google or Microsoft session has no fixed end while you keep using it. An invitation that is not accepted is deleted 30 days after it expires. A preview of unpublished widgets ends after 2 hours at the latest or when you end it, and its record is deleted a day later. A deleted organisation is removed for good after 30 days, together with the accounts that belong to no other organisation, or later, once a card subscription still running for it has ended or open billing on it is settled. A free organisation with no activity for 6 months gets a warning and is deleted 60 days later if it stays inactive. You can ask us to delete your account at any time. |
| Orders, billing and accounting | Your organisation's billing details (legal name, business ID, VAT number, address, billing e-mail, e-invoice address), the name of the person who placed an order, orders, invoices and payments. Card payments are made on Stripe's payment page; we do not see or store card numbers. | Contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)) under the Accounting Act (1336/1997) | - | Accounting records for the periods the Accounting Act sets (chapter 2, section 10): accounts and financial statements 10 years, vouchers 6 years, from the end of the financial year |
| Agreements and evidence: showing which Terms of Service and Data Processing Agreement each organisation accepted | The accepting person's name, role and user account, the time, the IP address, the language the agreement was shown in, and the version accepted | Legitimate interest (Art. 6(1)(f)) | Being able to show what was agreed, and establishing, exercising or defending legal claims | For as long as the agreement applies and 10 years after it ended, which covers the limitation periods under the Act on the Limitation of Debts (728/2003). These records are kept even after the organisation is deleted. |
| Security and audit: protecting the service, preventing abuse, investigating errors, and recording who has accessed customer personal data in the portal | Portal users: the audit log (who, what kind of data, which workspace, when, IP address), password-reset requests (with IP address), e-mail confirmation requests, error reports (page path, user account, browser type). Visitors to gosoft.fi and portal users: the IP address, held in memory to limit the number of requests; the web server's error log, which can record an IP address when a request fails | Legitimate interest (Art. 6(1)(f)) | Keeping the service and our customers' data secure, and being able to show customers and authorities who accessed their data | Password-reset and e-mail confirmation requests: 7 days. Web-server error log: 14 days. Error reports: at the latest 90 days after the error last occurred. Audit log: 3 years after the access, also after a customer relationship has ended, so that access can still be shown. |
| Customer support and service messages | Your messages to us (e-mail, chat, phone notes); your questions to Kollega, the portal assistant, and its answers; e-mails we send about your account, orders, invoices and changes to the service | Contract (Art. 6(1)(b)) or legitimate interest (Art. 6(1)(f)) | Answering questions and informing the users of the service about matters that concern it | Kollega conversations: until you clear them, or your account or the workspace is deleted. Support e-mails: as long as they are needed for the customer relationship and for handling any claims. |
| Newsletter and marketing by e-mail | E-mail address, name if given, language, the lists you are on, when and how you gave or withdrew consent, sending and bounce records | Consent (Art. 6(1)(a)) for the newsletter and the marketing list. Product updates to the portal users of our customers: legitimate interest (Art. 6(1)(f)) | Telling the users of our service about new features and major changes in it | Until you unsubscribe. A sign-up that is never confirmed is deleted 7 days after its 48-hour confirmation link expires. After an unsubscribe or a bounce, the address stays on our suppression list so that we do not e-mail it again. |
| Contact and sales: answering contact, demo and partner requests and making offers | What you write in a form or chat on gosoft.fi or in an e-mail to us: name, e-mail, phone, organisation, message, and the page the request was sent from | Steps at your request before a contract (Art. 6(1)(b)) or legitimate interest (Art. 6(1)(f)) | Answering requests and offering our services to organisations that have shown interest | On gosoft.fi, as in section 12. In our e-mail, as long as the request or the customer relationship needs it. |
| Reports of illegal content and abuse | The reporter's name and e-mail address, the report and our correspondence about it | Legal obligation (Art. 6(1)(c)) under the Digital Services Act (EU) 2022/2065; otherwise legitimate interest (Art. 6(1)(f)) | Keeping the service free of illegal content and abuse | As long as the report and any dispute about our decision need it |
| Marking AI-generated text: keeping fingerprints of the AI chat's answers, on gosoft.fi and on our customers' websites, of Kollega's answers, of the proposals of Build from your site and of the FAQ drafts, so that anyone can check at https://connect.gosoft.fi/api/ai-check whether a text matches one of them; limiting the number of checks | AI answer fingerprints: codes computed from the sentences of each answer or draft, not the text (section 4), with the workspace, the feature that wrote the text, the time and, for an answer in the chat or from Kollega, the answer's identifier. Users of the check: the IP address, held in memory to limit the number of checks, and the web server's error log, which can record it when a request fails; the text you check is never stored or logged | Legitimate interest (Art. 6(1)(f)) | Making the AI's answers and drafts detectable as AI-generated, which Article 50(2) of the AI Act (EU) 2024/1689 requires of us as the provider, with a free check open to everyone, and preventing misuse of the check | Fingerprints are deleted with what they mark: those of a chat answer with its conversation (on gosoft.fi 90 days after its last activity, or when you delete your data in the chat, section 12; on a customer's website when the conversation is deleted, under the customer's retention settings or on request), those of a Kollega answer with the Kollega conversation, and those of Build from your site proposals and FAQ drafts with the workspace. The IP address: in memory at most a few minutes after the last check; in the web server's error log 14 days. |
| Visitors to gosoft.fi: the chat, forms and analytics on our website | See section 12 | See section 12 | See section 12 | See section 12 |
| Preventing misuse of free offers | A salted hash of the website addresses and e-mail addresses that have already used a free offer | Legitimate interest (Art. 6(1)(f)) | Preventing the same organisation from using a free offer repeatedly | 12 months |
4. Personal data we process
The data is listed per purpose in section 3 and, for visitors to gosoft.fi, in section 12. We do not ask for special categories of personal data or personal identity codes.
If you sign in to the Gosoft Connect portal with Google or Microsoft, we receive from that provider your name, your e-mail address, whether the provider has confirmed the address, and an account identifier; from Microsoft also your organisation's directory identifier, and from Google, for a Google Workspace account, your organisation's domain. The provider also sends details that we use only to check the sign-in and do not keep, such as the time you signed in, how you last signed in to Google (for example whether with 2-Step Verification), whether a Microsoft account is a guest or personal account, and Google's link to your profile picture. We store the account identifier, the Microsoft directory identifier, the Google Workspace domain, the address the provider gave when the sign-in was linked and the one it gave last, how and when the link was made and when it was last used, so that we can recognise you when you sign in, and for each session that it began with Google or Microsoft and when the provider last confirmed it. Gosoft staff can sign in with Google only with Gosoft's own Google Workspace account and 2-Step Verification: for a staff member's session we also record that it met these conditions, and when a staff member links Google by typing their password, we keep the account identifier, the address and the domain until the right password has been typed. If it is not typed within 10 minutes, nothing is linked and these details are deleted in our next hourly clean-up. If you accept an invitation or a workspace hand-off with Google or Microsoft and have no account yet, the name from the provider becomes your account's name. If the provider's confirmation is what confirms your account's address (a new account made that way, or an unconfirmed account taken over by the holder of its address), the account records which provider confirmed it. Sign-in events (a sign-in method linked or removed, an unconfirmed account taken over by the holder of its address, a Google or Microsoft session ended by the daily check or because the account belongs to Gosoft staff) are kept in our audit log for at most 12 months and are deleted with your account. We receive no password and no access to your e-mail, files or calendar.
The provider learns that you signed in to Gosoft Connect and processes that under its own privacy terms. When you accept an invitation or a workspace hand-off with Google or Microsoft, we send the provider the invited address as a sign-in hint, so that it can offer the right account. While you stay signed in, we check with the provider about once a day that your account is still active; with that check we send, as a sign-in hint, your account identifier to Google and to Microsoft the address it gave last. You can remove the link on your profile page; we then keep only the account identifier (for Microsoft with the directory identifier) and the time of the removal, until your account is deleted, so that it is not linked again automatically.
An AI answer fingerprint (section 3) is a code, not text. It is computed for each sentence of six words or more in an answer of the AI chat or of Kollega, a proposal of Build from your site or a FAQ draft, and is the first 8 bytes of a SHA-256 hash of the sentence's words. The whole text gets one more code, and an answer in the chat or from Kollega one computed from its identifier. A fingerprint does not contain the sentence: a sentence can be matched to it only by computing the code again from the same words, which is what the check does. Left out are sentences that contain an e-mail address, a phone number, a web address, a number of five or more digits or a name the person gave in the conversation, or that repeat six or more words in a row from the person's own messages; when a sentence is left out for one of these reasons, the whole text gets no code either. Sentences that quote the company's own texts are left out too, and for Kollega, Build from your site and the FAQ drafts, sentences that quote the material the text was written from. These details are recognised automatically, so some can be missed: for example a name written in an unusual way or one that the company's own texts also use, a web address written without https:// or www. and without a path, or a number written in groups, such as 123 456. What you send to the check, a text or an answer's identifier, is used only to look it up among the fingerprints; for an identifier the check also gives the day the answer was given. Neither what you send nor the result of the check is ever stored or logged.
We keep the fingerprints and offer the check on the basis of our legitimate interest (section 3), which we have weighed against your rights. Fingerprints are the least intrusive way we have to make the answers detectable: a fingerprint is a short code from which the text cannot be read back, sentences with the details above are left out, the fingerprints are deleted with what they mark, and the check tells whether a text matches, which feature wrote it and, for an answer's identifier, the day, but never shows a text, a workspace or a conversation. You can object to this processing at privacy@gosoft.fi (section 11); we then weigh your objection against our duty under Article 50(2) of the AI Act.
Your name, e-mail address and organisation are needed to create an account and to conclude the agreement, and billing details are needed for a paid plan. Everything else is voluntary.
5. Sources of data
We obtain personal data mainly from you: when you register, use the portal, order, fill in a form or chat on our website, subscribe to our newsletter or contact us. We also receive it from your organisation, for example when a colleague invites you to the portal or your organisation orders the service, and from a partner agency that manages your organisation's workspace. If you sign in to the Gosoft Connect portal with Google or Microsoft, we also receive the data described in section 4 from that provider. We may check business details in public sources, such as the Finnish Trade Register and your organisation's website. Security and error data comes from our own systems. The fingerprints of AI answers are computed in our own systems from the answers and drafts they mark (section 4).
6. Recipients
| Recipient | What for | Where the data is processed |
|---|---|---|
| Other users of your organisation, and for a partner agency's users the client organisation whose data they open | Members of your organisation see your name, e-mail address and role. An organisation's admins can retrieve the log of access to its data: who opened what, when and from which IP address | EU/EEA |
| Hetzner Online GmbH (Germany) | Servers, database, file storage and backups for gosoft.fi and Gosoft Connect | Finland (Helsinki); backups in Germany (Falkenstein) |
| OpenAI Ireland Ltd (Ireland) | The AI chat on gosoft.fi and the moderation of its messages, the summary of a chat in which you sent a form or your contact details, and the portal's AI features (Kollega, translations and drafts) | Also outside the EEA, including the United States (section 7) |
| Google Workspace by Google (Ireland) | Our e-mail: messages to and from our addresses, contact requests delivered to us, and returned e-mails that could not be delivered | Also outside the EEA, including the United States (section 7) |
| Stripe Payments Europe, Limited (Ireland) | Card payments, when you pay by card | Also outside the EEA, including the United States (section 7) |
| Procountor | Invoicing and bookkeeping | EU/EEA |
| Browser push services of Apple, Google, Microsoft and Mozilla | Notifications to portal users who switch them on | The content is encrypted end to end; the services see only a delivery address and the time |
| Debt collection agencies | Only if an invoice is left unpaid | Finland |
| Authorities | Only when the law requires us to disclose data | Finland |
If you sign in to the Gosoft Connect portal with Google or Microsoft, we send that provider the sign-in hints described in section 4.
Anyone who uses the AI check learns whether a text matches a fingerprint and which feature wrote the matching text and, for an answer's identifier, the day the answer was given (section 4).
We do not sell personal data or disclose it for others' marketing.
7. Transfers outside the EU or EEA
Hetzner keeps our data in Finland and Germany. OpenAI, Google and Stripe are established in Ireland, but they, their affiliates and their own sub-processors may process data in the United States and other countries outside the EEA. The data processing terms we have with each of them require every such transfer to rely on the European Commission's Standard Contractual Clauses or on an adequacy decision of the Commission, such as the one for the EU-US Data Privacy Framework where the recipient in the United States is certified under it. You can ask for a copy of the safeguards at privacy@gosoft.fi.
8. Principles of register protection
We protect personal data with technical and organisational measures: access limited to named persons, passwords stored as argon2id hashes, TLS for web connections, encrypted backups, and an audit log of access to customer data in the portal. Our security page describes the measures in detail, including their limits. The people at Gosoft who handle personal data are bound by confidentiality.
9. Data-retention period
We keep personal data only for the periods in sections 3 and 12. Where the law requires longer retention, as the Accounting Act does for accounting records, we keep the data for that period. Data deleted from the live service remains in our encrypted backups until they are rotated out, normally about 30 days later.
10. Right of access and right to rectification
You have the right to know whether we process your personal data, to get a copy of it, and to have inaccurate data corrected. Portal users can correct most of their own details in the portal.
11. Other rights related to the processing of personal data
You have the right to have your personal data erased, to restrict its processing and to object to processing based on our legitimate interest. You can object at any time to the use of your data for direct marketing, and we then stop it. Where processing is based on your consent, you can withdraw it at any time, without affecting the processing before the withdrawal. Where processing is based on your consent or on a contract and is automated, you have the right to receive your data in a machine-readable format (data portability).
Send requests to privacy@gosoft.fi. We answer within one month, as the GDPR requires. We may ask you to confirm your identity first.
12. Visitors who use the chat and widgets on our website
Our own website (gosoft.fi) runs Gosoft Connect, the same chat, AI assistant and forms we provide to our customers. When you use them here, Gosoft Oy is the data controller. Hosted Q-Form pages on gosoft.fi are the exception: they belong to the customer that published the form (section 1).
- What we store. If you chat with us or send a form, we store the conversation and its messages, what you send through a form (including uploaded files), and the contact details you leave for us to get back to you, with the page they were sent from. When you send a form or your contact details in the chat, an AI-written summary of the conversation can be stored with them for our sales team. The summary sets out what you asked for, the details and concerns you mentioned and a suggested next step for our team. This assessment of what you need is profiling based on our legitimate interest, and you can object to it at any time at privacy@gosoft.fi. Contact requests are also delivered to our e-mail. Legal basis: steps at your request before a contract, or our legitimate interest in answering and serving the people who contact us (Art. 6(1)(b) and (f)).
- Analytics. We count page views, clicks, time on page and conversions to see how our website is used (legitimate interest, Art. 6(1)(f)). gosoft.fi does not ask for consent for analytics, and our analytics does not store anything on your device. Our server derives a daily identifier from the website, your IP address and your browser's user-agent string, with a key that is replaced and deleted every day. Visits on the same day can be linked to each other; visits on different days cannot. Under that identifier we keep the page address (without its query string, except campaign tags), the referring website, the language, the device type and, for a click, which button or option was clicked. This data is pseudonymous, not anonymous. Your IP address and user-agent string are not stored.
- Your IP address. We do not store it with your chat, form or analytics data. It is used in memory to limit abusive traffic and to derive the daily identifier above. A request that fails can leave it in the web server's error log, which is kept for 14 days.
- AI replies. To answer you, the AI chat sends your message, the recent conversation and relevant content from our knowledge base to our processor OpenAI Ireland Ltd, and the messages and answers to OpenAI's moderation service, which screens them for harmful content. OpenAI may process the data outside the EEA (section 7). Under OpenAI's API terms, it does not use the data to train its models and may keep it for up to 30 days to detect abuse. The chat marks the assistant as an AI. Searching our knowledge base runs on our own servers. We use no third-party advertising or analytics trackers, and automated visitor profiling is off.
- AI marks. The AI assistant's answers are marked in a machine-readable way as AI-generated, and we keep fingerprints of their sentences (sections 3 and 4). Anyone can check at https://connect.gosoft.fi/api/ai-check, linked in the chat's privacy menu ("Check if a text is AI-generated"), whether a text matches an answer the assistant gave. The fingerprints contain no text and are deleted with the conversation.
- Live chat. If you ask for a person, our staff answer you in the portal. They can get a notification with the start of your message through their browser's push service (Apple, Google, Microsoft or Mozilla), encrypted end to end so that the service cannot read it.
- Retention. Conversations and messages: 90 days from the last activity. Form submissions and uploaded files: 90 days from when they were sent. Contact details you left in the AI chat, and analytics events: 365 days. A contact request delivered to our e-mail: as in section 3 (contact and sales). AI usage records (model, token counts and cost, no message content) lose their link to your conversation when the conversation is deleted.
- Your rights. In the chat's privacy menu you can download ("Download my data") or delete ("Delete all my data") the data linked to the identifier your browser holds now, authenticated by a secret kept in your browser. The fingerprints of the AI's answers (codes, section 4) are not in the download; they are deleted with the conversation. Deleting there does not reach an earlier visit made under an identifier that has since expired, the copy of a contact request in our e-mail, or the copies OpenAI keeps to detect abuse. For those, or if you have cleared your browser, e-mail privacy@gosoft.fi and we handle your request manually. The rights in sections 10 and 11 apply.
13. Cookies and other storage in your browser
The rules on storing information in your browser and reading it (in Finland, section 205 of the Act on Electronic Communications Services, 917/2014) cover cookies and every other technique, such as local storage and session storage. This is what gosoft.fi and our portal store:
| Where | What is stored | Why | When it is written | How long it stays |
|---|---|---|---|---|
| gosoft.fi | gc_banner_dismissed (session storage) |
That you closed the bar announcing a new blog post | When you close the bar | Until you close the tab |
| gosoft.fi, the chat | Visitor record __gc_visitor_… (local storage): a random visitor identifier, a security token and a secret that authenticates your own data requests |
To keep your conversation and form answers yours | When you first send a chat message, ask for a person or send a form | Counts as expired 30 minutes after you leave the website; removed on your next visit, or at once when you delete your data |
| gosoft.fi, the chat | Your open conversation (local storage) | So the conversation survives a page reload | When you open the chat; on a page where the chat is built into the page, such as our About us page, when that page loads | As the visitor record |
| gosoft.fi, the chat | Markers (local storage) that you closed a greeting or opened the chat. They hold no identifier. | So that a greeting you closed, or the greetings of a chat you have opened, are not shown again | When you close a greeting or open the chat | Removed when a visitor record is created or found expired, or when you delete your data; otherwise until you clear your browser's storage |
| Portal (connect.gosoft.fi) | portal_session cookie (HttpOnly, Secure) |
Keeps you signed in | When you sign in; after a sign-in with Google or Microsoft, also at each successful daily check | 30 days at the most, or until you sign out. After a sign-in with Google or Microsoft, the limit is 7 days after the provider last confirmed your session, and each successful daily check starts those 7 days again (section 3) |
| Portal (connect.gosoft.fi) | __Host-gc_sso cookie (HttpOnly, Secure): a random value, your language and, if you came from an invitation link, a workspace hand-off link or an e-mail confirmation link, that link's code |
So that only the browser that started a sign-in with Google or Microsoft can complete it, and the portal can answer in your language and take you back to that link | When the portal sends you to Google or Microsoft: to sign in, to link the sign-in on your profile page, to accept an invitation or a workspace hand-off, and for the daily check; for Gosoft staff also when Google sends you back and the portal asks for your password to link Google | Until the provider sends you back to the portal or, at the password step for Gosoft staff, until you have typed the password, 10 minutes at the most |
| Portal (connect.gosoft.fi) | __gc_portal_sso_recheck_lock and __gc_portal_sso_recheck_last (local storage): a lock while one tab runs the daily check, and when the check last started. __gc_portal_sso_recheck_tab (session storage): when this tab last started it. Only times and random values |
So that the daily check with Google or Microsoft (section 4) runs in one tab at a time and not more often than needed | When the daily check starts | The lock: until the check is over. The time of the last check: until you clear your browser's storage. Session storage: until you close the tab |
| Portal (connect.gosoft.fi) | __gc_portal_signin_notice and __gc_portal_sso_logout (session storage): why your Google or Microsoft session was ended, or that you signed out of one. __gc_portal_sso_drift_… (local storage): that your profile page has already told you that your address at Google or Microsoft differs from your address in the portal; made of hashes, it does not contain your address |
So that the login page can tell you why your session ended, or that you are still signed in to Google or Microsoft on this device, and so that your profile page tells you about a changed address only once | When your Google or Microsoft session is ended or you sign out of it; when your profile page tells you about a changed address | Session storage: until the login page has shown them, at the latest until you close the tab. Local storage: until you are signed out of the portal in this browser |
| Portal (connect.gosoft.fi) | Theme, language, sidebar, help and sound preferences, and when a live chat sound last played (local storage); markers that you have already been taken to your start page or have just completed a card payment, and unsaved preview drafts (session storage); a service worker | Your portal settings, and push notifications if you switch them on | When you use these features | Until you change them or clear your browser's storage |
| Your organisation's website, in a preview you start from the portal | __gc_<wid>_preview (session storage): the preview's key |
So that this browser tab shows your organisation's unpublished widgets | When the preview starts | Until you close the tab; the preview itself ends after 2 hours at the most |
We do not ask for consent for this storage: it serves the chat, the forms and the portal you use, and the markers record only that you closed a greeting or opened the chat. None of it follows you to other websites, and nothing in it is shared with third parties. What a hosted Q-Form page on gosoft.fi stores depends on the settings of the customer that published the form; see the privacy notice for data processor.
14. Automated decisions
We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR). The AI features write answers and summaries; people at Gosoft decide how to act on them.
15. Right to lodge a complaint
If you consider that the processing of your personal data infringes the GDPR, you have the right to lodge a complaint with a supervisory authority, in particular in the EU country where you live or work or where the infringement took place. In Finland the authority is the Office of the Data Protection Ombudsman (tietosuoja.fi).
16. Changes to this notice
We update this notice when our processing changes. The date at the top shows the latest update. We tell our customers in advance about a change that reduces the protection of their data, as our Terms of Service describe.