1.Scope
This policy explains how Tuumo Oy (Tuumo, we) handles personal data as a controller: the data of people who create an account, are invited to a workspace, contact us or send us feedback, and of our customers' billing contacts.
The events that a customer's product sends to Tuumo, and what members do with them in a workspace, we process on the customer's behalf. That processing is covered by the data processing agreement, and the customer is its controller.
2.Controller and contact
The controller is Tuumo Oy (business ID 3361053-4), Samoilijantie 3 A 1, 70200 Kuopio, Finland. Questions about this policy and requests about your data go to support@tuumo.fi. We have not appointed a data protection officer.
3.Controller or processor
We are the controller of the data we need to run the service and the customer relationship: accounts, sign-ins, workspace memberships, emails, support, feedback and invoicing.
We are the processor of a workspace's events, query results and exports, and the query history. The customer decides what its product sends and how long it is kept, and requests about that data go to the customer first.
4.The data we process
- Account: your name, email address and password (stored only as a salted hash), or the identity Google or GitHub confirms when you sign in with one of them
- Workspaces: the workspaces you belong to, your role and plan, your credit usage, the invitations you send or receive, the AI tools you connect and the API keys you create (their names; a key's secret is stored only as a hash)
- Sign-ins and security: your signed-in sessions, and the audit log of sign-ins, failed sign-ins (with the email address that was typed) and admin actions, with the IP address and browser they came from
- Email: the messages the service sends you and their delivery records
- Support and feedback: what you write to us, and the feedback you send from the app with your account and workspace (it is also emailed to our support address)
- Invoicing: the company, its billing contact and the plans and invoices
The website itself collects nothing about you: it sets no cookies and runs no analytics or third-party scripts.
5.Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Creating and running your account, signing you in, workspaces and invitations | Contract with you; when you use Tuumo for your employer or are invited, our legitimate interest in providing the service the customer ordered |
| Emails the service needs: sign-up codes, password resets, email changes and invitations | As above |
| Support, and handling the feedback you send from the app | Contract; legitimate interest in improving the service |
| Security: the audit log of sign-ins and admin actions, rate limits and preventing misuse | Legitimate interest in keeping the service and its customers' data safe |
| Plans, credit usage, invoicing and bookkeeping | Contract with the customer; our legitimate interest in contacting its billing contact; legal obligation (accounting law) |
Where we rely on legitimate interest, you may object to the processing on grounds relating to your particular situation. An account needs a name and an email address; without them we cannot provide the service.
6.Where the data comes from
From you, when you sign up, use the service or contact us; from the colleague who invites you to a workspace (your email address); from Google or GitHub, when you choose to sign in with them; and from the service itself, such as sign-ins and delivery records.
7.Recipients and processors
We never sell personal data. These companies process it for us:
- UpCloud Oy (Finland): hosting, storage and backups, in Helsinki with database backups in Frankfurt, Germany
- Scaleway SAS (France): sending the service's email
- Proton AG (Switzerland): our support mailbox, which receives what you write to us and the feedback sent from the app
The members of a workspace see each other's names and email addresses. If you sign in with Google or GitHub, that company confirms who you are under its own privacy policy; it gets no access to your workspace. We disclose data to authorities only when the law requires it.
8.Transfers outside the EU and EEA
We keep and process your data in the EU, with one exception: our support mailbox is at Proton in Switzerland, which the European Commission has found to protect personal data adequately, so messages to support and feedback are kept there. Signing in with Google or GitHub is your choice, and those companies may process your sign-in outside the EU under their own terms.
9.How long we keep it
| Data | Kept |
|---|---|
| Your account | While you have it. A deleted account can be restored for 30 days; then its personal details are removed |
| Signed-in sessions | 30 days with Remember me, otherwise 24 hours or until the browser closes |
| Your name on a workspace's query history after you leave it | 90 days, then it reads "former member" |
| Invitations | 12 months after they are used or expire |
| The audit log (sign-ins and admin actions) | 24 months |
| Email delivery records at Scaleway | Sender, recipient, subject and status, for as long as our sending domain is registered with Scaleway; the message itself only until it is delivered |
| Feedback and support messages | As long as needed to handle them |
| Invoices and bookkeeping | As long as Finnish accounting law requires (generally six years, some ten) |
Database backups are kept for about 15 days, so removed data is gone from them within that time.
10.Your rights
You have the right to access your data, to have it corrected or erased, to restrict or object to its processing, and to receive the data you gave us in a machine-readable form. You can change your name, email address and sign-in methods on your account page, and delete your account there.
Send other requests to support@tuumo.fi. We answer within a month, and may ask you to confirm who you are. Requests about a workspace's events go to the company whose workspace it is.
11.Automated decisions
We make no decisions about you by automated means that have legal or similar effects.
12.Security
Connections are encrypted, passwords and API keys are stored only as hashes, access follows each member's role, and admin actions are logged. Security and privacy describes the measures. We report a personal data breach to the Data Protection Ombudsman and to you when the law requires it.
13.Cookies and local storage
The app uses only the cookies it needs to work: one that keeps you signed in, and a short-lived one that protects a sign-in with Google or GitHub. It remembers your theme and last workspace in your browser's local storage. The website uses no cookies; the theme you choose there is kept in local storage. There are no tracking or advertising cookies, and the fonts are served from our own servers.
14.Complaints
If you think we handle your data unlawfully, you can complain to the Office of the Data Protection Ombudsman in Finland (tietosuoja.fi) or to the authority of the EU country where you live or work.
15.Changes
We update this policy when the service or the law changes. The current version is always on this page, with the date it was last changed at the top; we tell account holders about material changes by email.