Skip to main content
Gosoft Connect
Book a demo
Privacy

Privacy notice - data processor

Published: Updated:

Contents (12)

1. Introduction

Gosoft Oy ("we", "Gosoft") provides Gosoft Connect: a button-led chat, an AI chat assistant, live chat, forms and popups, and conversion analytics that our customers ("Customer") embed on their own websites and offer to their visitors ("you"). Customers can also publish hosted forms (Q-Forms) on gosoft.fi. When you use these tools on a Customer's website or answer a Customer's Q-Form, Gosoft acts as a data processor and the Customer is the data controller who decides why your data is collected. This notice explains what we process on the Customer's behalf. The Customer's own privacy notice, usually linked on its website, tells you who the Customer is, why your data is processed and on what legal basis.

For data Gosoft collects as a controller, for example about visitors to our own site gosoft.fi or about our customer relationships, see our separate privacy notice for data controller. Gosoft is also itself the controller of the fingerprints it keeps of the AI chat's answers, including those given on a Customer's website, under Article 50(2) of the AI Act (EU) 2024/1689, so that anyone can check whether a text is AI-generated: see section 3 of that notice.

2. Cookies and browser storage

Gosoft Connect sets no cookies. It keeps some data in your browser's local storage and session storage instead (section 3). The rules on storing information on your device (in Finland, section 205 of the Act on Electronic Communications Services) apply to that storage in the same way as to cookies.

Some of this storage is needed for a chat or form you use. Some of it is not: the visitor identifier when it is used for analytics, and markers that stop a popup or a message from being shown again. Whether the Customer's site asks for your consent, and for what, is the Customer's decision as controller. Gosoft Connect has a setting for it, on by default for new workspaces: with it on, nothing is stored in your browser for analytics until you accept analytics on the Customer's consent banner, and until then visits are counted under a daily identifier (section 4). With it off, a visitor identifier is stored in your browser when the page loads.

3. Data kept in your browser

The widget stores the following in your browser, separately for each Customer site (the same browser on two different Customer sites is not linked):

  • A visitor record in local storage: a random visitor identifier (not your name), a security token, and a secret used to authenticate your own data requests (section 7). It is written when you first send a chat message, ask for a person or send a form; when you accept analytics; or, where the Customer does not wait for consent, when the page loads.
  • Your current conversation in local storage: the messages in your open chat and anything you typed into forms in the chat, so the thread survives a reload. It is written when you open the chat or, for a chat built into the page, when the page loads.
  • Small markers in local or session storage: that you closed a message or opened the chat, or that a popup, slide-in or chat message set to show once has already been shown. A "shown" marker is written when the item is shown, even if you do nothing. The markers hold no identifier.
  • A record of your analytics consent in local storage, only where the Customer asks for consent, written when you accept.
  • In session storage, the first page in that browser tab where the widget was loaded, so the Customer can see where a contact request came from. Where the Customer asks for consent, it is written only after you accept analytics.
  • In session storage, a preview key (__gc_<wid>_preview), only in a browser tab where a signed-in user of the Customer's portal has started a preview of the Customer's unpublished widgets. It is written when the preview starts and is gone when the tab is closed; the preview itself ends after 2 hours at the latest. Ordinary visitors never get it.

The visitor record and the conversation count as expired 30 minutes (by default; the Customer can set anything from 1 minute to 24 hours) after you leave the website, and they are removed the next time you visit it, or at once when you choose "Delete all my data" in the chat. While you keep a tab of the website open, the time does not run. The markers are removed together with an expired visitor record, or when you delete your data; if no visitor record is ever created, they stay until you clear your browser's storage. The consent record stays until you withdraw consent, delete your data or clear your browser's storage. Session storage is cleared when you close the tab. You can clear everything at any time in your browser's settings.

The widget also reads, but never writes, the choice recorded by the Customer's own consent tool (for example Cookiebot, OneTrust, Complianz or Google Consent Mode), in order to respect it, and, if the Customer has set it up so, a language setting that the Customer's own site keeps.

4. Data we store on our servers

On the Customer's behalf we may store:

  • Conversations and messages: the text you exchange with the chat, the AI assistant or the Customer's staff in live chat. This is free text and may contain anything you choose to type, including contact details or other personal information.
  • Form submissions: what you enter into forms, including any files you upload (kept on our servers, separate from the database), the page and referring website from which you sent them, the first page where the widget loaded in that tab (section 3), the answers you chose in the chat before the form, and your browser's user-agent string. The answers may also be e-mailed, with any files, to addresses the Customer has confirmed; e-mail is encrypted in transit only where the receiving mail server supports it. On the free tier, the answers to a hosted Q-Form are sent by e-mail and are not kept in our database (Terms of Service, Annex 1).
  • Leads: contact details (name, e-mail, phone, message) you leave in the AI chat so that the Customer can follow up.
  • Bookings: if a form books a time in the Customer's calendar, the time and a title with your name or e-mail address, which may also be written to the Customer's own calendar.
  • AI-written summaries: a running summary of a long conversation; a summary of the conversation when you send a form or contact details in the chat (on unless the Customer switches it off); and, only where the Customer switches them on, a classification of the conversation and reports that summarise many conversations (the knowledge-gap report and the conversation digest), which may quote or paraphrase what visitors asked.
  • A visitor profile: only if it has been switched on (it is off); see section 8.
  • Analytics events: page views, clicks, time on page and conversions, with the page address (without its query string, except campaign tags), the referring website, the language, the device type and, for a click, which button or option was clicked. They are linked either to the visitor identifier in your browser or, where the Customer asks for consent and you have not given it, to a daily identifier our server derives from the site, your IP address and your browser's user-agent string with a key that is replaced and deleted every day. The daily identifier links your visits on the same day, not across days. Both kinds are pseudonymous, not anonymous.
  • AI usage records: for each AI reply, the model, token counts and cost. These contain no message content (section 6).
  • Technical error reports: if the widget fails to load, the website's host name and your browser's user-agent string, with no identifier; kept for 90 days.

We do not store your IP address with your conversations, form answers or analytics. It is used in memory to limit abusive traffic and, on sites that wait for your consent, to derive the daily identifier above. The address itself is never written to our analytics or conversation records. A request that fails can leave it in the web server's error log, which is kept for 14 days.

5. AI processing and sub-processors

When you use the AI chat, your message, the recent conversation and relevant content from the Customer's own knowledge base are sent to OpenAI Ireland Ltd, our sub-processor, to write the answer and, in a long conversation, a running summary. Your messages and the assistant's answers are also checked by OpenAI's moderation service for harmful content, unless moderation has been switched off for the Customer's site. Where they are in use, OpenAI also receives the conversation content that these features need: the summary made when you send a form or contact details in the chat, and, only if the Customer switches them on, conversation classification with the knowledge-gap report built from it, the conversation digest, AI steps in the Customer's automations (which can include form answers) and visitor profiles (section 8). Gosoft chooses the model. The chat marks the AI assistant as an AI system.

OpenAI is established in Ireland, but it may transfer the data to its affiliates and its own sub-processors in the United States and other countries outside the EEA. The data processing addendum we have executed with OpenAI requires each such transfer to rely on the European Commission's Standard Contractual Clauses or on an adequacy decision of the Commission. Under OpenAI's API terms, the data is not used to train OpenAI's models, and OpenAI may keep it for up to 30 days to detect abuse.

Searching and ranking the Customer's knowledge base runs on our own servers; no third party is involved in that step. We add no third-party advertising or analytics trackers (no advertising pixels, no session replay). A font the Customer chooses may be loaded from the font provider's server, which then sees your IP address. Our primary data store is in the EU/EEA, with our hosting provider in Finland and Germany. The current list of our sub-processors is in our Data Processing Agreement and on our security page. Our e-mail runs on Google Workspace, provided by Google: a message you send to privacy@gosoft.fi, and a report that an e-mail sent by the Service, such as a form answer, could not be delivered, which can contain part of that e-mail, reach Google. Google may transfer them outside the EEA, and its data processing terms with us likewise require each such transfer to rely on the Standard Contractual Clauses or on an adequacy decision of the Commission, such as the one for the EU-US Data Privacy Framework where the recipient is certified under it.

Services the Customer connects. If the Customer connects Gosoft Connect to services of its own choice, for example Slack, Microsoft Teams, HubSpot, Pipedrive, a webhook, a CalDAV calendar or its own Google Analytics, we send the data the Customer has selected there on the Customer's instruction. Those are the Customer's recipients, not our sub-processors. Notification e-mails and push notifications to the Customer's staff can also carry parts of what you sent; a push notification travels through the staff member's browser push service (Apple, Google, Microsoft or Mozilla), encrypted end to end so that the service cannot read it.

6. Retention

The Customer (the controller) sets the retention periods with three settings, each from 1 to 365 days: one for conversations, messages, visitor profiles, form submissions and uploaded files; one for leads and the name or e-mail address in a booking's title; and one for analytics events. By default:

  • Conversations, messages and visitor profiles: 90 days from your last activity. Form submissions and uploaded files: 90 days from when you sent them.
  • Leads: 365 days. The name or e-mail address in a booking's title is cleared 365 days after the booked time, on the same setting.
  • Analytics events: 365 days.
  • Test entries: leads and conversations made while a user of the Customer's portal previews unpublished widgets on the Customer's site are marked as tests and deleted after 14 days, whatever the settings above. They never reach the Customer's notifications, automations or reports.

After these periods the data is deleted automatically, once a day. AI usage records (model, token counts and cost, no message content) lose their link to your conversation when the conversation is deleted, and are then kept as accounting records that no longer relate to you. Where the Customer uses them, the knowledge-gap report is replaced each time it is rebuilt and is otherwise kept, like conversation digests, until the Customer's workspace is deleted; the Customer can also have a report or digest deleted at any time on request. A report that an e-mail sent by the Service could not be delivered is deleted from our mailbox at Google at the latest 30 days after it arrives. Deleted data remains in our encrypted backups until they are rotated out, normally about 30 days later.

7. Your rights - access and erasure

You can exercise the main rights directly from the chat's privacy menu:

  • Access (Art. 15): "Download my data" returns what is linked to the visitor identifier your browser holds now on that Customer's site: your conversations and messages, form submissions, leads, bookings, profile (if any), and the most recent 500 analytics events (older ones on request through the Customer).
  • Erasure (Art. 17): "Delete all my data" deletes, for that Customer's site, the conversations and messages, form submissions and uploaded files, leads, visitor profile, analytics and the name in bookings that are linked to that identifier, and clears what the widget keeps in your browser, including the consent record.

Both requests are authenticated by a secret kept in your browser, so another visitor cannot make them in your name. The secret is not protected from scripts that run on the Customer's own website (section 9). The privacy menu is in the chat; a form on its own has no such menu.

What the chat's privacy menu cannot reach: data from an earlier visit, kept under an identifier that expired when you had been away (30 minutes by default) or that you removed by clearing your browser storage; copies already sent to the Customer, for example notification e-mails or entries in the Customer's own systems; reports already built from many conversations (section 4); and the copies OpenAI keeps to detect abuse. In those cases, contact the Customer, the company that runs the website where you used the chat. The Customer is the controller and decides on your request; Gosoft, as its processor, acts on the Customer's instructions. You can also write to privacy@gosoft.fi and we will pass your request to the Customer. Data that is only pseudonymous to us, such as analytics keyed to an identifier, can often be found only with that identifier; without it we may be unable to tell which records are yours.

You also have the right to rectification and restriction of processing and, where the GDPR's conditions are met, to object to processing and to data portability. Direct these to the Customer (the controller); where you contact Gosoft (privacy@gosoft.fi), we forward your request to the Customer and act on its instructions.

8. Automated visitor profiling (optional, off)

Gosoft Connect includes a feature that builds an automated profile of a visitor from the chat conversation. It uses an OpenAI model to infer fields such as name, contact details, company, role, interests, language and likely intent, and writes a short summary for the Customer's sales or support team. This is profiling. The feature is off for every site, and Customers cannot switch it on in the portal. If it is ever switched on for a site, that is done on the Customer's instruction: the Customer decides whether and why to use it and is responsible for it as controller, including for assessing whether Articles 22 and 35 GDPR apply. A profile is kept on the same 90-day default as conversations and is deleted by "Delete all my data".

9. Security

We apply technical and organisational measures to protect personal data; our security page describes them. Note that data kept in your browser's local storage is readable by any script running on the Customer's own website (it is not a protected store); the per-visitor erasure secret is stored on our servers only as a one-way hash, never in plain text.

10. Supervisory authority

You have the right to lodge a complaint with the data protection authority of the EU country where you live or work or where you think your rights were infringed. In Finland it is the Office of the Data Protection Ombudsman (tietosuoja.fi). Where necessary, we cooperate with the data protection authorities.

11. Changes to this notice

We may update this notice, for example after legal or product changes. The current version is always published here, with the date of the latest update.

12. Contact

Gosoft Oy, Punavuorenkatu 7 B 38, 00120 Helsinki, Finland - privacy@gosoft.fi