Privacy Policy

1. Data controller

The data controller is Insinööritoimisto Loikkanen Oy (business ID 3600045-9), referred to here as “Tuttu”. Privacy contact: Ilpo Loikkanen, [email protected].

This policy covers the Tuttu for Business service and the website business.tuttu.ai. The service is intended for business use (B2B).

2. Two roles: controller and processor

Tuttu processes personal data in two distinct roles, which should be kept separate:

• As a controller, Tuttu processes its business customers' data: account users' contact details, billing data, and technical data about use of the service. This processing is described in this policy.
• As a processor, Tuttu processes the data of the business customer's callers and message senders on the business customer's behalf and on its instructions. Here the business customer is the controller and is responsible for its own data protection obligations towards its callers. The terms governing this processing, the processor's obligations, and the full list of sub-processors are set out in a separate data processing agreement (GDPR Article 28).

3. What personal data we process

• Account and user data: email address, name (if the login source provides it), the user's role, and the owner's phone number verified during onboarding (used for call forwarding, test calls, and notifications). Login is passwordless. We do not store passwords.
• Billing data: company name, business ID, VAT number, and address for the receipt. We do not process or store payment card details ourselves: payment is handled by our payment provider Stripe on its own checkout page.
• Content you enter (the knowledge base): your business description, services, policies, and other material the assistant uses, which may contain personal data (for example employees' names or contact details). You are responsible for the lawfulness of the content you enter.
• Call and message data: the caller's phone number (when transmitted), the content of calls and text messages as text transcripts, keypad-entered numbers, messages and callback requests left by callers, appointment bookings (name, phone number, email, and appointment time, when calendar booking is enabled), and the call duration and other technical metrics. We process this data as a processor on the business customer's behalf.
• Technical data: server logs, usage and error data, and API usage cost-tracking (service name, model, and number of units processed, not message content).

We do not record call audio. Call audio is streamed in real time to the speech-recognition provider (OpenAI) and is not recorded or stored by us. The provider may retain API data for a limited period (currently up to 30 days) for abuse monitoring before deleting it. Only the text transcript is retained permanently.

4. Where the data comes from

• Directly from you when you register, fill in details, or use the service.
• From callers and message senders during calls and text messages.
• From public business registries, such as the Finnish Business Information System (PRH / Tax Administration YTJ) and the Estonian e-Business Register, when you look up your company by business ID or name (public open data).
• From the login provider WorkOS (email and name) and from optional Google sign-in.

5. Purposes and legal bases

The legal bases for processing are those set out in Article 6 of the GDPR:

• Providing the service and managing the customer relationship: performance of a contract (GDPR Article 6(1)(b)).
• Billing and accounting: legal obligation (Article 6(1)(c); accounting law).
• Developing the service, security, and preventing misuse: legitimate interest (Article 6(1)(f)).
• Processing of caller data is carried out on the business customer's behalf on the legal basis determined by that customer; see the data processing agreement.

6. AI and automated decision-making

The service answers calls and messages using AI. Callers are told at the start of each call that they are speaking with an AI. This satisfies the transparency obligation in Article 50(1) of the AI Act (Regulation (EU) 2024/1689).

The service does not make automated decisions producing legal or similarly significant effects on data subjects within the meaning of Article 22 of the GDPR. The AI relays messages, answers questions, and records callback requests; the actual decisions are made by the business customer.

AI may occasionally interpret or phrase things inaccurately. Critical information should be verified separately.

7. Special categories of data

We do not request or intentionally collect special categories of personal data within the meaning of Article 9 of the GDPR (such as health data). A caller may nonetheless volunteer such information during a call, in which case it ends up in the transcript. We recommend not configuring the assistant to collect sensitive data.

8. Recipients and processors

We use the following subcontractors (data processors) to provide the service. There is a data processing agreement with each, and they process data only to provide the service:

The primary place of storage is application servers and a database located in Finland (within the EU/EEA). We may also disclose data to authorities where required by law.

If you connect your own Google account for booking, appointments are synced to a dedicated booking calendar in your own Google account; Google then processes that data also as your own service provider under your agreement with Google.

9. Transfers outside the EU/EEA

Some of the processors listed above process data outside the EU/EEA, in particular in the United States. Transfers are based on the safeguards in Articles 44-46 of the GDPR: for processors certified under the EU-US Data Privacy Framework, the European Commission's adequacy decision (10 July 2023), and otherwise the European Commission's standard contractual clauses (SCCs).

10. Retention

• Account, knowledge base, call, and message data are retained for as long as the customer relationship is active.
• When an account is deleted, it is suspended immediately and all account data is permanently deleted after 14 days (an internal safety buffer in case of recovery).
• Billing and accounting records are retained for the period required by accounting law (generally 6 years).
• Call state is held in the server cache (Redis) only for the duration of the call with a short expiry; it is not retained permanently.

11. Your rights

As our business customer you have the rights under the GDPR: the right to access your data (Article 15), rectify inaccurate data (Article 16), erase data (Article 17), restrict processing (Article 18), data portability (Article 20), and object to processing (Article 21). Requests should be sent to [email protected].

If you called a business customer's number, that business is the controller. Address requests about your data to it first; we will forward requests to it as the processor.

You also have the right to lodge a complaint with the supervisory authority (GDPR Article 77). In Finland the supervisory authority is the Office of the Data Protection Ombudsman, tietosuoja.fi.

12. Data security

We protect data with technical and organisational measures. Traffic is encrypted in transit, per-customer access is isolated with database row-level security, and access to production systems is restricted.

13. Cookies and tracking

Browser local storage is used for functional purposes, such as remembering the language selection and the login session. These are strictly necessary and require no separate consent.

If you give consent in the cookie banner, the site additionally loads the Meta (Facebook) tracking pixel, used to measure advertising performance. Meta Platforms Ireland Ltd. then processes the data as described in its own terms. Without consent the pixel is never loaded, and your choice does not affect how the site works. You can withdraw consent by clearing your browser's local storage or by contacting [email protected].

14. Direct marketing to prospective customers

We send postal direct marketing (such as postcards) to Finnish businesses that are not yet our customers. For this purpose we process the company's name, business ID, line of business, and public address. For sole traders these details may constitute personal data (the entrepreneur's name and address).

The data comes from the Finnish Business Information System (PRH / Tax Administration YTJ; public open data). The legal basis is legitimate interest (GDPR Article 6(1)(f); business-to-business direct marketing). We use Print.one (Netherlands, within the EU/EEA) as a processor for printing and delivering the cards.

You may object to direct marketing at any time (GDPR Article 21) by emailing [email protected], after which we will not mail that company again. Marketing data is not used for other purposes and is deleted when no longer needed.

15. Changes to this policy

We update this policy as needed. We will announce material changes in the service or by email.

Sources and legislation

• General Data Protection Regulation (GDPR): Regulation (EU) 2016/679 of the European Parliament and of the Council
• AI Act, Article 50: Regulation (EU) 2024/1689 (transparency obligations)
• Finnish Data Protection Act 1050/2018: National law complementing the GDPR
• EU-US Data Privacy Framework: Commission Implementing Decision (EU) 2023/1795 of 10 July 2023
• Standard contractual clauses (SCCs): Commission Implementing Decision (EU) 2021/914
• Office of the Data Protection Ombudsman: Finnish supervisory authority