Privacy Policy

At a glance

• Who and why: Neuver Oy processes contact, account, billing and usage data to provide Neuvise, answer enquiries and keep the Service secure. This notice also covers our website, marketing and demos.
• Legal bases: mainly our legitimate interests in providing a business service and our legal obligations; a contract when you personally are the customer or use a demo, and consent where stated in Section 3.
• Storage and recipients: our production databases and primary file storage are in Finland. Other providers may process data elsewhere, including outside the EU/EEA, with the safeguards described in Sections 5 and 6. Retention periods are in Section 4.
• Your choices and rights: contact privacy@neuvise.com about your data. You can object at any time to processing based on our legitimate interests. You can stop marketing, change your analytics choice under Cookie settings in the footer, and complain to the Data Protection Ombudsman. Section 7 explains your rights.

Your organisation's content is covered by the Data Processing Agreement (DPA). We process it on the organisation's instructions, including when it appears in support requests or logs. Its processing locations, access and deletion rules are set out in the DPA and the sub-processor register.

The sections below describe processing for Neuver Oy's own purposes. Subscriptions are currently offered to organisations; this notice will be updated before consumer subscriptions open.

1. Controller and contact

Neuver Oy, business ID 3500939-8, Papinpolku 10 A 1, 60200 Seinäjoki, Finland. Data protection matters: privacy@neuvise.com. Service support: support@neuvise.com. Invoicing: billing@neuvise.com.

If your question concerns content or accounts your organisation controls, contact its administrator; we help the organisation answer as the DPA requires. For processing we do for our own purposes, contact us directly.

2. Where the data comes from, and what is required

We receive personal data from you, from your organisation and its administrators, from the person who hands an order to you as signatory, from the identity provider your organisation uses (Microsoft sign-in), and from the operation of the website and the Service. For business outreach we may also use an organisation's own website or public business registers; we tell you the source on request and give you this notice at first contact.

To create an account or to conclude and manage an order we need the account identifiers and the organisation's contact and billing details; without them that step cannot be completed. Everything else, such as an enquiry message or marketing consent, is optional.

3. What we process, why, and on what legal basis

When you represent an organisation, our agreement is with that organisation, and we process your details on the basis of our legitimate interest in running and securing a business service. When you personally are the customer (for example as a sole trader), processing needed to fulfil the agreement is based on that agreement.

3.1 Website analytics and security

With your consent, our public pages use our own cookieless analytics to understand how the site is used. We record page visits and interactions (such as clicks and calculator settings), the page path and language, screen size group, country and referring site's name. We use a session identifier held in memory until the page is reloaded or closed, and a daily changing visitor identifier derived from your IP address and browser type. These are pseudonymous personal data. Analytics records contain neither your raw IP address nor the referring page's path.

Legal basis: consent. Analytics starts only after you choose Allow analytics in the cookie notice. You can withdraw consent under Cookie settings in the footer; further collection stops and unsent events are discarded. Retention: 13 months.

Our web servers, network edge and security controls also record connection data such as the IP address, the request and the browser type for security, troubleshooting and abuse prevention. Legal basis: our legitimate interest in a secure and reliable Service. Retention: technical logs expire within 90 days.

3.2 Enquiries, waitlists and support

When you send a contact form, a waitlist request, a support request or an email, we process your name, email address, organisation if given, and the correspondence, to answer and follow up. Legal basis: our legitimate interest in answering business enquiries and supporting customers; when you are personally about to become a customer, the steps taken at your request before an agreement. Retention: while the matter is open and up to two years after the last substantive contact; evidence of an agreement or a dispute follows Section 4. Asking to be told when a feature becomes available does not subscribe you to marketing.

3.3 Orders, agreements and acceptance records

When an organisation orders Neuvise we process its details (name, business ID, VAT ID, address) and the names, roles and email addresses of its contact person, billing contact and signatory. Online acceptance of an order also records the time, the IP address and browser of the person accepting, the links that were shown, and the exact versions and fingerprints of the documents accepted. An EU VAT ID given in an order is checked in the European Commission's VIES service, and the returned name and address are kept with the order. Order and confirmation documents are sent to the signatory and the contact person. Legal basis: our legitimate interest in managing the customer relationship and proving what was agreed, and our legal obligations for accounting. Retention: Section 4.

3.4 Accounts, security and usage

For every user account we process the name, email address, interface language, organisation and role, the password in hashed form or the identifier of the Microsoft account, a profile picture you upload or Microsoft supplies, the time of the last sign-in, and session and device data for the browsers you sign in from. Security and activity records carry the actor, time, action, IP address and browser type. Failed sign-in attempts are counted per email address and IP address for one hour. Usage metering records how much each user and organisation uses the metered features so that the plan's allowances can be applied and we can follow the cost of the service; exceeding an allowance pauses the feature and never charges automatically. Legal basis: our legitimate interest in delivering and securing the business service, and the agreement where you personally are the customer. Activity records kept on the customer's instructions belong to the customer under the DPA. Retention: Section 4.

3.5 Invoicing

We process billing details, invoices and payment status to invoice and to keep the books. Invoices are issued through our accounting software, SimplBooks (Section 5), and delivered as e-invoices through its e-invoicing operator when the customer has given an e-invoice address, otherwise by email. Card payment is not offered yet; the payment provider will be named here before it is. Legal basis: our legal obligations under the Accounting Act and our legitimate interest in administering payments. Retention: Section 4.

3.6 Service notices and marketing

We send administrators the messages the agreement requires: security notices, changes to the agreement documents or sub-processors, invoices and reminders, and availability information. Legal basis: our legitimate interest in keeping customers informed, or the agreement where you personally are the customer; these messages cannot be opted out of while the agreement runs.

Product news and sales messages are marketing, also when sent to an existing customer's administrator. We send electronic marketing only where Finnish law allows it: to a named work address only when the message relates to the person's work duties, otherwise with consent. Legal basis: our legitimate interest in relevant business marketing, or consent. Every message names Neuver Oy and gives a free way to stop further marketing, including by replying. You can object at any time and withdraw consent at any time; we then keep only the minimum needed to honour that choice. Retention: until you object to the processing or withdraw your consent, and at most two years after our last substantive contact with you.

3.7 Demo and operational diagnostics

The demo is for test data only. Depending on the demo you identify yourself with a display name or with your name and email address. During the demo we process the content you enter, activity, usage and connection records to run the demo and protect it from abuse. The AI features send your prompts and the content they need to the providers listed in the sub-processor register (Section 5); the demo terms describe the demo's lifecycle. Legal basis: the Demo Terms you accepted; protecting the demo from abuse is our legitimate interest. A business trial with real data runs under the Trial Terms and the DPA.

Operational alerts about failures in the Service may name an organisation, a user or an email address so that we can find the problem, and go to our internal alerting channel. We may use AI-assisted diagnostics on a short excerpt of the relevant logs, with passwords and keys removed. The log analysis and log search in our administration tools use AI only at endpoints in the EU. Legal basis: our legitimate interest in a secure and reliable Service. Retention: at most 90 days in our systems; AI provider retention periods are listed in the sub-processor register.

4. How long we keep data

Data	Retention
Website analytics events	13 months
Technical logs and operational alerts	at most 90 days, automatic expiry
Failed sign-in counters	1 hour
Enquiries and support correspondence	while open and up to 2 years after the last substantive contact
Accounts and activity records	the term of the organisation's agreement and its retrieval period; then deleted with the organisation's data (Subscription Terms Section 19, DPA Section 10)
Usage and cost counts	kept as statistics; once the accounts are deleted, the counts no longer identify anyone
Orders, acceptance records, order documents	the term of the agreement and up to 10 years after it, as evidence for claims; we remove what is no longer needed earlier
Accounting vouchers and correspondence on business transactions	6 years from the end of the year in which the financial year ended (Accounting Act)
Financial statements and ledgers	10 years from the end of the financial year (Accounting Act)
Demo accounts, demo content and activity records	a link demo: until sign-out or the end of the demo period; a registered demo account: 90 days after it was last used; the account's content and activity records go with it. Usage counts are kept as statistics; the name linked to them is removed 90 days after the account is deleted
Marketing contacts	until you object or withdraw consent, at most 2 years after the last substantive contact
Marketing objection record	the minimum needed to honour the objection

We retain agreement evidence for possible legal claims and delete unnecessary records earlier. Statutory accounting periods are listed separately above. A legal obligation or an actual claim may require longer retention of specific records; access is restricted and the records are deleted when the reason ends.

Deletion from live systems and expiry of copies are separate steps. Database backups expire within 14 days after live deletion.

5. Who receives personal data

We do not sell personal data. We share it with the providers below, which process it on our behalf under data processing agreements, and with authorities when the law requires. An accountant, an authority or an identity provider may also be a controller for its own statutory purposes.

Recipient	What for, and where
Hetzner Online GmbH	the servers that run the Service and its databases, Helsinki, Finland
UpCloud Oy	primary file storage and encrypted database backups, Finland
Cloudflare, Inc.	network traffic and protection against denial-of-service attacks; global network
Microsoft Ireland Operations Ltd.	our email (Microsoft 365) and Microsoft sign-in where your organisation uses it; EU Data Boundary with Microsoft's documented exceptions
SimplBooks Oy	accounting and invoicing: billing contacts and transaction records; Helsinki, Finland
Providers in the sub-processor register	in a demo, the content you enter and your prompts, so that the demo's AI features work; for our own operations, the log excerpts for the diagnostics described in Section 3.7; processing locations and provider retention periods are listed in the register. Your organisation's content is covered by the DPA.

6. Transfers outside the EU and the EEA

Our production databases, primary file storage and database backups are in Finland. Other providers listed in Section 5 may process data elsewhere, including outside the EU/EEA. Cloudflare's network may process connection data outside the EU under the EU-U.S. Data Privacy Framework and the European Commission's Standard Contractual Clauses; Microsoft's support transfers follow the safeguards in its data processing agreement. AI requests made in a demo, and AI-assisted diagnostics, may use providers that process requests in the United States, as listed in the sub-processor register.

For transfers outside the EU/EEA we rely on an adequacy decision or the Standard Contractual Clauses, with supplementary measures where needed. Ask privacy@neuvise.com for a copy of the safeguards.

7. Your rights and complaints

You have the right to access your personal data and receive a copy, to have inaccurate data corrected, to request erasure or restriction, and to object to processing based on our legitimate interest. Where automated processing is based on consent or a contract, you also have the right to receive the data you have given us in a machine-readable format. Direct marketing stops when you object. Consent can be withdrawn at any time without affecting the lawfulness of earlier processing.

Write to privacy@neuvise.com. We may ask you to confirm your identity in a proportionate way, for example by writing from the address of your account. We answer within one month; if a request is complex we tell you within that month if we need up to two months more. If we cannot grant a request, we explain why.

You may complain to the Office of the Data Protection Ombudsman in Finland (Tietosuojavaltuutetun toimisto, tietosuoja.fi, PO Box 800, 00531 Helsinki) or to another competent supervisory authority. Requests about content your organisation controls go to your organisation; we help it respond under the DPA.

8. Security and automated processing

We protect personal data by encrypting connections and stored data, restricting staff access, using multi-factor authentication for staff access and supporting multi-factor authentication for users through Microsoft sign-in. We also use security logs and encrypted backups. Our security page describes the measures in more detail.

We make no decisions about you by automated means that have legal or similarly significant effects. The Service applies automatic security and usage limits; contact support if you think one is wrong. AI features are presented as AI.

9. Children

Neuvise is intended for organisations and is not directed at children. You must be at least 18 years old to use the demo.

10. Cookies and local storage

Signing in sets the cookies needed to keep you signed in, protect the session and keep track of the conversation you have open. Your browser also stores a device key that ties your session to the device, and the interface keeps your preferences (language, layout, your analytics choice) and temporary caches in your browser's local storage. Identity and infrastructure providers may set storage their sign-in and security functions require. We use no advertising trackers. The analytics of Section 3.1 uses no cookies and starts only with your consent in the cookie notice.

11. Changes

Every published version carries a version number and an effective date and appears on the Legal page at neuvise.com/legal with its fingerprint. Earlier versions are available on request. We tell administrators about changes that affect them.