Aistin – Privacy Policy

Effective from: September 22, 2026

This privacy policy describes how personal data is processed in connection with the Aistin service.

1. Data Controller

The Aistin service is provided by:

SMUW AI Oy

Business ID 3640665-1

Sinimäentie 10 B

02630 Espoo

Finland

SMUW AI Oy also uses the registered auxiliary trade name Albert Aistin for the Aistin business.

Email: support@aistin.ai

Hereinafter in this privacy policy, the service is referred to as Aistin and the service provider as SMUW AI Oy.

SMUW AI Oy acts as the data controller for personal data that we process to provide the Aistin service, manage user accounts and customer relationships, for billing, security, and our own service administration.

When a business customer stores information about their own customers, employees, or other individuals in Aistin, the business customer generally acts as the data controller for this data and SMUW AI Oy as the data processor on behalf of the customer.

When necessary, personal data processing is governed by a separate data processing agreement.

2. What Information We Process

We may process the following personal data depending on how Aistin is used.

User and Account Information

This may include:

name
email address
profile picture
company and organization
user role and permissions
login and authentication information
service-related user settings.

Information Stored in Aistin by Companies

Aistin can store, for example:

CRM data
customer and contact information
documents
notes
emails
calendar information
website content
sales and customer relationship information
instructions and conversations given to the Albert AI assistant by the user.

The customer or user storing this information in Aistin is responsible for the content and legality of this data.

Usage and Technical Information

We may collect information about service usage, such as:

IP address
browser and device technical information
login times
service activity logs
error and security logs
information about features used.

This information is used to maintain service functionality, security, and technical quality.

Billing and Customer Information

We may process, for example:

company billing information
billing addresses
subscription and license information
payment status.

Payment card information may be processed through a separate payment service provider, in which case Aistin does not store actual card information in its own systems.

3. How Personal Data Is Used

We process personal data for the following purposes:

providing the Aistin service
user identification and login
implementing features chosen by the customer
operating CRM, documents, email, calendar, and other tools
implementing the Albert AI assistant and other AI functions
executing automations requested by the user
customer service
billing and contract management
service security
preventing misuse
resolving technical issues
developing service functionality and usability
fulfilling legal obligations.

We do not sell users' personal data.

We do not use customers' Google, Microsoft, or other private content for targeted advertising.

4. Legal Bases for Processing

The legal basis for processing depends on the data being processed and the purpose of use.

Processing may be based on:

performance of a contract relating to Aistin
the data controller's legitimate interest, such as maintaining security, service functionality, and customer relationships
user consent, for example when connecting certain third-party services
legal obligation, for example regarding accounting-related information.

Users may withdraw consent-based processing for the future at any time.

5. Google Connections

Users can optionally connect their Google account or certain Google Workspace services to Aistin.

Depending on the features activated by the user, Aistin may request access to, for example:

basic information from the user's Google account
Google Calendar
Gmail
Google Drive
other Google services separately approved by the user.

Aistin only requests permissions that are necessary for the feature activated by the user.

Calendar Information

If a user connects Google Calendar, Aistin may process calendar information, for example, to:

display the user's calendar in Aistin
check free time
book meetings
create, modify, or cancel meetings at the user's request.

Email Information

If a user connects Gmail, Aistin may, depending on the features activated by the user, process, for example:

senders and recipients
message subjects
message content
attachments
other message-related information.

Information may be used, for example, to:

display emails as part of customer relationships
connect messages to CRM data
create email drafts
summarize messages
send messages requested by the user
implement other email features activated by the user.

Google Drive Information

If a user connects Google Drive, Aistin only processes files and metadata needed by the functions activated by the user.

Use of Google Workspace API Data

Aistin's use of data obtained from Google Workspace API interfaces complies with the Google API Services User Data Policy and its Limited Use requirements.

Google Workspace data is used only to implement functions requested by the user and visible in Aistin's user interface.

Google Workspace data is not:

sold
used for targeted advertising
transferred for data broker activities
used for creditworthiness assessment
used to train general-purpose AI or machine learning models.

Information may only be transferred to service providers to the extent necessary to implement Aistin features requested by the user, ensure security, or as required by law.

SMUW AI Oy staff do not normally read users' Google Workspace content. Personal access to content may be permitted only, for example:

at the user's explicit request or consent in a customer support situation
to investigate a security issue
to prevent misuse
based on law or regulatory order.

6. Microsoft Connections

Users can optionally connect their Microsoft account or Microsoft 365 services to Aistin.

Depending on the features in use, Aistin may process, for example:

basic information from the user's Microsoft account
Outlook calendar information
email information
Microsoft 365 data separately permitted by the user.

Information is used only to implement functions activated by the user, such as:

displaying calendar
checking free time
booking meetings
processing emails
creating email drafts
connecting CRM data to communications.

Aistin does not use Microsoft 365 content for targeted advertising or to train general-purpose AI models.

7. AI Services

Aistin includes AI-based functions, including the Albert AI assistant.

When a user requests Albert to process information, Aistin may send content necessary to fulfill the request to a third-party AI service provider.

Such content may include, for example:

the question written by the user
a document selected by the user
CRM data
email content
calendar information
other information necessary for the task requested by the user.

Information is sent only to the extent required to implement the function requested by the user.

Aistin does not use customers' private content to train general-purpose AI models and does not transfer content to third parties for such purposes.

Aistin may use one or more AI service providers. Providers may be changed as the service evolves, provided that data processing complies with this privacy policy and applicable data protection legislation.

8. Automations and Albert

Aistin may prepare or execute tasks based on rules defined by the user.

Albert may, for example:

analyze data
create drafts
suggest actions
combine information from different Aistin features
execute functions separately activated by the user.

Aistin aims to design significant external actions so that the user maintains appropriate control over actions taken by the service.

9. Sharing Information With Service Providers

SMUW AI Oy uses third-party service providers to implement the Aistin service.

These may include, for example:

cloud service providers
database and storage services
email services
payment services
analytics and monitoring services
AI service providers
Google and Microsoft when users connect their services.

Service providers may process personal data only to the extent necessary to perform their tasks.

We do not sell customers' personal data to third parties.

10. International Data Transfers

We aim to process data primarily within the European Economic Area.

However, some of our service providers may process data outside the EU or EEA.

If personal data is transferred outside the EEA, we use safeguards in accordance with applicable legislation, such as:

European Commission adequacy decisions
EU standard contractual clauses
other transfer mechanisms permitted by GDPR.

11. Data Retention

We retain personal data only as long as necessary for the purpose for which it was collected.

Information related to user accounts and customer relationships is generally retained for the duration of the customer relationship.

Legally required information, such as accounting records, may be retained for the period required by law.

Data stored in Aistin by customers is retained in the customer's use as long as the customer keeps it in the service.

Deleted data may remain in technical backups for the duration of their normal backup cycle.

12. Removing Google and Microsoft Connections

Users can stop using Google or Microsoft connections at any time.

Depending on service features, the connection can be disconnected through:

Aistin settings
Google account permission settings
Microsoft account permission settings.

When a connection is removed, Aistin will no longer use that connection to retrieve new information.

Aistin removes or invalidates OAuth permissions in its possession when they are no longer needed.

If data previously retrieved from Google or Microsoft services has been stored as part of Aistin's CRM, document, or other content at the user's request, this copy may remain in Aistin until the user or the customer's organization deletes it.

13. Deleting Accounts and Data

A user or organization administrator can request deletion of a user account or related personal data by contacting:

support@aistin.ai

We will delete data from active systems without undue delay, unless there is a legal or other justified reason to retain the data.

Data in technical backups will be removed during the normal backup cycle.

14. Security

We use technical and organizational safeguards to protect personal data.

These may include, for example:

encrypted HTTPS connection
restricted access rights
user authentication
system logging and monitoring
protection of access credentials and OAuth tokens
regular maintenance of infrastructure and software.

However, no system operating on the internet can guarantee complete security.

15. Data Subject Rights

Under applicable data protection legislation, users may have the right to:

receive information about the processing of their personal data
access data concerning them
request correction of inaccurate data
request deletion of data
request restriction of processing
object to certain processing
receive data in a portable format in certain situations
withdraw consent
file a complaint with a data protection authority.

In Finland, the supervisory authority is the Office of the Data Protection Ombudsman.

16. Cookies and Analytics

Aistin may use cookies that are necessary for the operation of the service.

If we use other analytics or marketing-related cookies, we will request user consent when necessary.

17. Changes to the Privacy Policy

We may update this privacy policy as the service, legislation, or processing practices change.

The current version will be published at:

https://www.aistin.ai/en/privacy-policy

Significant changes may also be announced in the service or by email.

18. Contact Information