EFFECTIVE FROM 4 NOVEMBER 2026

Privacy Policy

This privacy policy explains how personal data is processed in connection with the Aistin service.

1. Data controller


The Aistin service is provided by:


SMUW AI Oy
Business ID 3640665-1
Sinimäentie 10 B
02630 Espoo
Finland


In its Aistin business, SMUW AI Oy also uses the registered auxiliary business name Albert Aistin.


Email: support@aistin.ai


In this privacy policy, the service is referred to as Aistin and the service provider as SMUW AI Oy.


SMUW AI Oy acts as the data controller for the personal data we process to provide the Aistin service, to manage user accounts and customer relationships, and for billing, security and our own service administration.


When a business customer stores data about its own customers, employees or other individuals in Aistin, the business customer is usually the controller of that data and SMUW AI Oy acts as a data processor on the customer's behalf.


Where necessary, the processing of personal data is agreed in a separate data processing agreement.



2. What data we process


Depending on how Aistin is used, we may process the following personal data.


User and account data


This may include:


  • name

  • email address

  • profile picture

  • company and organisation

  • user role and access rights

  • login and authentication data

  • user settings related to the service.


Data a company stores in Aistin


The following may be stored in Aistin, for example:


  • CRM data

  • details of customers and contact persons

  • documents

  • notes

  • emails

  • calendar data

  • website content

  • information related to sales and customer relationships

  • instructions and conversations the user has with the Albert AI assistant.


The customer or user who stores this data in Aistin is responsible for its content and lawfulness.


Usage and technical data


We may collect data about the use of the service, for example:


  • IP address

  • technical information about the browser and device

  • login times

  • service operation logs

  • error and security logs

  • information about the features used.


This data is used to maintain the operation, security and technical quality of the service.


Billing and customer data


We may process, for example:


  • a company's billing details

  • billing addresses

  • subscription and licence details

  • payment status.


Payment card data may be processed through a separate payment service provider, in which case Aistin does not store the actual card data in its own systems.



3. What personal data is used for


We process personal data for the following purposes:


  • providing the Aistin service

  • identifying and logging in users

  • delivering the features the customer has chosen

  • operating the CRM, documents, email, calendar and other tools

  • delivering the Albert AI assistant and other AI features

  • running automations the user has requested

  • customer service

  • billing and managing the contractual relationship

  • security of the service

  • preventing misuse

  • investigating technical problems

  • improving the operation and usability of the service

  • fulfilling statutory obligations.


We do not sell users' personal data.


We do not use customers' Google, Microsoft or other private content for ad targeting.



4. Legal bases for processing


The legal basis for processing depends on the data being processed and the purpose.


Processing may be based on:


  • the performance of the agreement concerning Aistin

  • the controller's legitimate interest, such as maintaining security, the operation of the service and the customer relationship

  • the user's consent, for example when connecting certain external services

  • a legal obligation, for example in respect of accounting records.


The user may withdraw consent-based processing for the future at any time.



5. Google connections


The user may choose to connect their Google account or certain Google Workspace services to Aistin.


Depending on the features the user enables, Aistin may request access to, for example:


  • basic information of the user's Google account

  • Google Calendar

  • Gmail

  • Google Drive

  • other Google services the user has separately approved.


Aistin only requests the permissions needed by the feature the user has enabled.


Calendar data


If the user connects Google Calendar, Aistin may process calendar data, for example:


  • to show the user's calendar in Aistin

  • to check availability

  • to book meetings

  • to create, change or cancel meetings at the user's request.


Email data


If the user connects Gmail, Aistin may, depending on the features the user has enabled, process for example:


  • senders and recipients

  • message subjects

  • message content

  • attachments

  • other information related to messages.


The data may be used, for example:


  • to show emails as part of a customer relationship

  • to link messages to CRM data

  • to suggest reply drafts inside Aistin

  • to summarise messages

  • to send a message the user has requested

  • to deliver other email features the user has enabled.

Aistin reads Gmail messages and sends only the messages the user requests. Aistin does not change, move or delete messages in Gmail, and does not create drafts in Gmail.


Google Drive data


If the user connects Google Drive, Aistin only processes the files and metadata needed by the features the user has chosen:

  • File import: the user picks files in Google's own file picker, and Aistin copies them into the user's Documents library.

  • Folder sync: when the user links a Drive folder, Aistin reads the files in that folder and its subfolders and keeps a read-only copy in Aistin. The sync is one way, from Drive to Aistin.

Aistin never edits, moves or deletes anything in the user's Google Drive. The user can stop syncing at any time. If copied files are linked to a knowledge base, the Albert AI assistant can use them as a source.


Use of Google Workspace API data


Aistin's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.


Google Workspace data is used only to deliver features the user has requested and that are visible in the Aistin user interface.


Google Workspace data is not:


  • sold

  • used for targeted advertising

  • transferred to data brokers

  • used to determine creditworthiness

  • used to train general-purpose AI or machine learning models.


Data may be shared with service providers only to the extent necessary to deliver the Aistin feature the user has requested, to ensure security, or as required by law.


SMUW AI Oy staff do not normally read the user's Google Workspace content. Human access to content may be allowed only, for example:


  • at the user's explicit request or with their consent in a customer support situation

  • to investigate a security issue

  • to prevent misuse

  • on the basis of law or an order from an authority.



6. Microsoft connections


The user may choose to connect their Microsoft account or Microsoft 365 services to Aistin.


Depending on the features in use, Aistin may process, for example:


  • basic information of the user's Microsoft account

  • Outlook calendar data

  • email data

  • Microsoft 365 data the user has separately allowed.


The data is used only to deliver features the user has enabled, such as:


  • showing the calendar

  • checking availability

  • booking meetings

  • handling emails

  • creating email drafts

  • linking CRM data to communication.


Aistin does not use Microsoft 365 content for targeted advertising or to train general-purpose AI models.



7. AI services


Aistin includes AI-based features, including the Albert AI assistant.


When the user asks Albert to process information, Aistin may send the content needed to carry out the request to an external AI service provider.


Such content may include, for example:


  • a question the user has written

  • a document the user has selected

  • CRM data

  • email content

  • calendar data

  • other information needed for the task the user has requested.


Data is sent only to the extent required to carry out the feature the user has requested.


Aistin does not use customers' private content to train general-purpose AI models, nor does it disclose content to third parties for such purposes.


Aistin may use one or more AI service providers. Providers may change as the service evolves, provided that data is processed in accordance with this privacy policy and applicable data protection legislation.



8. Automations and Albert


Aistin may prepare or carry out tasks based on rules defined by the user.


Albert may, for example:


  • analyse information

  • create drafts

  • suggest actions

  • combine information from different Aistin features

  • carry out actions the user has specifically enabled.


Aistin aims to design material external actions so that the user retains appropriate control over the actions the service takes.



9. Sharing data with service providers


SMUW AI Oy uses external service providers to deliver the Aistin service.


These may include, for example:


  • cloud service providers

  • database and storage services

  • email services

  • payment services

  • analytics and monitoring services

  • AI service providers

  • Google and Microsoft, when the user connects their services.


Service providers may process personal data only to the extent necessary to perform their tasks.


We do not sell customers' personal data to outside parties.



10. International data transfers


We aim to process data primarily within the European Economic Area.


However, some of the service providers we use may process data outside the EU or EEA.


If personal data is transferred outside the EEA, we use safeguards in accordance with applicable law, such as:


  • an adequacy decision of the European Commission

  • the EU Standard Contractual Clauses

  • other transfer mechanisms permitted under the GDPR.



11. Data retention


We keep personal data only for as long as it is needed for the purpose for which it was collected.


Data related to user accounts and the customer relationship is generally kept for the duration of the customer relationship.


Data that must be kept by law, such as accounting records, may be kept for the period required by law.


Data the customer stores in Aistin remains available to the customer for as long as the customer keeps it in the service.


Deleted data may remain in technical backups for the duration of their normal backup cycle.



12. Removing a Google or Microsoft connection


The user may stop using a Google or Microsoft connection at any time.


Depending on the features of the service, the connection can be removed:


  • in Aistin's settings

  • in the Google account's permission settings

  • in the Microsoft account's permission settings.


Once the connection is removed, Aistin no longer uses it to fetch new data.


Aistin deletes or revokes the OAuth permissions it holds when they are no longer needed.


If data previously fetched from a Google or Microsoft service has, at the user's request, been saved as part of Aistin's CRM, a document or other content, that copy may remain in Aistin until the user or the customer's organisation deletes it.



13. Deleting your account and data


A user or an organisation's administrator can request deletion of a user account or related personal data by contacting:


support@aistin.ai


We delete the data from active systems without undue delay, unless there is a statutory or other justified reason to keep it.


Data in technical backups is removed as part of the normal backup cycle.



14. Security


We use technical and organisational measures to protect personal data.


These may include, for example:


  • encrypted HTTPS connections

  • restricted access rights

  • user authentication

  • system logging and monitoring

  • protection of access credentials and OAuth tokens

  • regular maintenance of infrastructure and software.


However, no system operating on the internet can guarantee complete security.



15. Rights of the data subject


Under applicable data protection legislation, the user may have the right to:


  • receive information about the processing of their personal data

  • access data concerning them

  • request correction of inaccurate data

  • request erasure of data

  • request restriction of processing

  • object to certain processing

  • receive their data in a portable format in certain situations

  • withdraw consent

  • lodge a complaint with a data protection authority.


In Finland, the supervisory authority is the Office of the Data Protection Ombudsman.



16. Cookies and analytics


Aistin may use cookies that are strictly necessary for the operation of the service.


If we use other analytics or marketing cookies, we will ask for the user's consent where required.



17. Changes to this privacy policy


We may update this privacy policy as the service, legislation or processing practices change.


The current version is published at:


https://www.aistin.ai/en/privacy-policy


Significant changes may also be announced in the service or by email.



18. Contact details


Questions and requests concerning data protection:


SMUW AI Oy
Auxiliary business name Albert Aistin
Business ID 3640665-1
Sinimäentie 10 B
02630 Espoo
Finland


support@aistin.ai