Privacy Policy
Effective date: 01.05.2026
Last updated: 01.05.2026
Changelog
| Version | Effective date | Changes |
|---|---|---|
| 1.0 | 01.05.2026 | First published version. |
This Privacy Policy explains how Karinja Oy (“Supplier”, “we”, “us”, or “our”) processes personal data relating to our website visitors, business contacts, account administrators, support contacts, and users of our business services.
1. Controller
The controller for the personal data described in this Privacy Policy is:
Karinja Oy, Espoo/Finland, 3613878-1, privacy@karinja.ai
We are established in Finland, and our processing of personal data is governed by the EU General Data Protection Regulation (“GDPR”) and the Finnish Data Protection Act (1050/2018). Where we serve individuals in California, the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA”) also applies to the extent its requirements are met (see section 14).
2. Scope
This Privacy Policy applies to personal data we process as controller when you:
- Visit our website at karinja.ai
- Contact us, meet with us, or otherwise do business with us
- Administer or use an account for our Services
- Receive communications from us
It does not apply to personal data we process as processor on behalf of enterprise customers (see section 7), or to third-party websites and services that we link to (see section 17).
3. Categories of personal data we process
Depending on how you interact with us, we may process:
3.1 Website and sales data
- Name, company, role, email address, phone number
- Meeting notes, sales correspondence, and deal history
- Website usage data, cookies, and analytics data
3.2 Account and service administration data
- User and administrator account information
- Authentication and access records
- Billing and payment contact details
- Support communications and troubleshooting records
3.3 Operational and security data
- Logs, device and browser metadata
- Service usage events
- Error reports, diagnostic records, monitoring data, and security event data
- Backup and disaster recovery data where applicable
3.4 Enterprise customer service data
Where enterprise customers use our Services, they may submit or connect personal data through repositories, messaging platforms, data platforms, documents, and other business systems. For that service data, we generally act as processor on behalf of the customer.
We do not intentionally collect special categories of personal data (such as health data, biometric data, or data revealing racial or ethnic origin, political opinions, or religious beliefs) as controller. Please do not send us such data unless we specifically ask for it.
4. Sources of personal data
We collect personal data:
- Directly from you, when you email us, meet with us, sign a contract, create an account, or contact support
- Automatically, when you visit our website or use our Services, through server logs, security tools, and service telemetry
- From your organization, when your employer or another organization sets up an account for you or names you as a contact
- From third parties, such as business partners, event organizers, and publicly available professional sources (for example, company websites and professional networking profiles), where permitted by law
5. Purposes and legal bases
We process personal data for the following purposes:
5.1 To provide and operate our Services
We use personal data to create accounts, authenticate users, manage subscriptions, provide support, operate service features, and deliver continuity and recovery functions.
Legal basis: performance of a contract (GDPR Article 6(1)(b)); legitimate interests (Article 6(1)(f)).
5.2 To secure, maintain, and improve our Services
We use logs, telemetry, diagnostics, and operational data to monitor performance, prevent abuse, detect incidents, fix defects, and improve reliability.
Legal basis: legitimate interests (Article 6(1)(f)).
5.3 To manage business relationships
We use contact information and correspondence to manage prospects, customers, vendors, partnerships, contracting, invoicing, and related administration.
Legal basis: performance of a contract (Article 6(1)(b)); legitimate interests (Article 6(1)(f)).
5.4 To comply with law
We may process personal data where necessary to comply with accounting, tax, sanctions, legal process, recordkeeping, or other legal obligations.
Legal basis: legal obligation (Article 6(1)(c)).
5.5 To send business communications
We may send product, service, security, and administrative communications to customers and prospects. Where marketing consent is required by law, we will request it. You can opt out of marketing communications at any time using the link in the message or by contacting us.
Legal basis: legitimate interests (Article 6(1)(f)); consent where required (Article 6(1)(a)).
5.6 Our legitimate interests
Where we rely on legitimate interests, those interests are operating and securing our business and Services, developing business relationships with organizations, and protecting our legal rights. We balance these interests against your rights and freedoms. You can ask us for more information about this balancing, and you can object to this processing (see section 12).
5.7 Whether you must provide personal data
You are not legally required to provide personal data to us. However, some personal data is necessary to enter into or perform a contract with you or your organization, such as account and billing details. If you do not provide it, we may not be able to provide the Services.
6. No training on customer inputs and outputs
We do not use customer Inputs, Outputs, or customer-submitted service data to train our models or third-party models.
For service analytics and improvement, we may use de-identified or aggregated operational telemetry that does not identify individual employees and does not contain customer Inputs or Outputs.
7. Controller / processor split for enterprise services
When an enterprise customer uses our Services and submits or connects personal data to the Services:
- The enterprise customer generally determines the purposes of that processing and acts as controller; and
- We process that data on the customer’s behalf as processor or sub-processor.
If you are an end user using our Services through your employer or another organization, you should direct service-data privacy requests to that organization first.
8. Recipients and disclosures
We may disclose personal data to:
- Service providers and subprocessors who help us provide hosting, support, security, analytics, backups, and related business functions. For example, our website is hosted by Cloudflare.
- Professional advisers such as lawyers, auditors, and insurers
- Competent authorities or courts where required by law
- Counterparties in a corporate transaction, such as a merger, acquisition, or sale of assets, subject to confidentiality protections
Our service providers process personal data only on our instructions and under written agreements that require them to protect it. A list of our current subprocessors is available on request.
We do not sell personal data, and we do not share personal data for cross-context behavioral advertising.
9. International transfers
We aim to store and process personal data for our Services within the European Economic Area (“EEA”).
If we need to transfer personal data outside the EEA, we will do so only where permitted by law and with an appropriate transfer mechanism, such as:
- An adequacy decision of the European Commission, including the EU-U.S. Data Privacy Framework for recipients certified under it; or
- The European Commission’s Standard Contractual Clauses, together with supplementary measures where required.
You can request a copy of the safeguards we use by contacting us.
10. Retention
We retain personal data for as long as necessary for the purposes described above, including:
- Identifiable operational logs: generally up to 3 months
- De-identified or aggregated telemetry: generally up to 12 months or longer where no longer personal data
- Billing and contractual records: as required by law
- Support records: for the support lifecycle and reasonable follow-up period
- Backups: according to our backup and deletion cycles
When personal data is no longer needed, we delete or anonymize it. Where we must keep data longer to comply with law or to establish, exercise, or defend legal claims, we keep it only for that purpose.
11. Automated decision-making
We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.
12. Your rights
Where the GDPR or similar laws apply, you may have rights to:
- Access your personal data and receive a copy of it
- Rectify inaccurate or incomplete data
- Erase data in certain cases
- Restrict processing
- Object to processing based on legitimate interests
- Object at any time to processing for direct marketing, in which case we will stop that processing
- Receive data portability where applicable
- Withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing before withdrawal
To exercise your rights, contact us at privacy@karinja.ai. We respond within one month of receiving your request. We may extend this by up to two further months for complex or numerous requests, and if we do, we will tell you why within the first month. Exercising your rights is free of charge, unless a request is manifestly unfounded or excessive. We may ask for information to confirm your identity before acting on a request.
If we process your data on behalf of an enterprise customer, we may direct your request to that customer.
13. Complaints
If you are in Finland or the EEA, you may lodge a complaint with your local supervisory authority, in particular in the country where you live, work, or where an alleged infringement took place. In Finland, the competent authority is the Office of the Data Protection Ombudsman (tietosuoja.fi).
We would appreciate the chance to address your concerns first, so please consider contacting us before you lodge a complaint.
14. Notice to California residents
14.1 Applicability
This section applies to residents of California and supplements the rest of this Privacy Policy. It describes our practices under the CCPA and other California privacy laws, to the extent they apply to us. Terms such as “personal information”, “sell”, “share”, and “sensitive personal information” have the meanings given in the CCPA.
14.2 Personal information we collect
In the preceding 12 months, we may have collected the following categories of personal information, from the sources described in section 4 and for the purposes described in section 5:
| Category | Examples |
|---|---|
| Identifiers | Name, email address, phone number, IP address, account identifiers |
| Customer records (Cal. Civ. Code § 1798.80(e)) | Name, address, telephone number, billing and payment contact details |
| Commercial information | Subscriptions, contracts, purchase and deal history |
| Internet or other electronic network activity | Website and service usage data, logs, device and browser metadata |
| Professional or employment-related information | Company, job title, role |
| Sensitive personal information | Account log-in credentials |
We do not collect precise geolocation, biometric information, or the contents of your personal communications other than those you send to us. We do not use personal information to infer characteristics about you.
14.3 Disclosures for a business purpose
In the preceding 12 months, we may have disclosed each category of personal information listed above for a business purpose to the categories of recipients described in section 8.
14.4 No sale or sharing
We do not sell personal information, and we do not share personal information for cross-context behavioral advertising. We have not done so in the preceding 12 months. We have no actual knowledge of selling or sharing personal information of consumers under 16 years of age.
14.5 Sensitive personal information
We use and disclose sensitive personal information only for purposes permitted under the CCPA, such as providing the Services, securing accounts, and preventing fraud. We do not use it to infer characteristics about you.
14.6 Retention
We retain each category of personal information for the periods described in section 10.
14.7 Your California privacy rights
Subject to certain exceptions, you have the right to:
- Know and access the categories and specific pieces of personal information we collected about you, the categories of sources, the business or commercial purposes for collecting it, and the categories of third parties to whom we disclosed it
- Delete personal information we collected from you
- Correct inaccurate personal information
- Opt out of the sale or sharing of personal information
- Limit the use and disclosure of sensitive personal information, where it is used for purposes beyond those permitted under the CCPA
- Not be discriminated against for exercising any of these rights. We will not deny you services, charge you different prices, or provide a different level of quality because you exercised your rights.
14.8 How to submit a request
To submit a request, email privacy@karinja.ai with the subject line “California privacy request”. We will confirm receipt within 10 business days and respond within 45 calendar days. If we need more time, we may extend this by up to a further 45 calendar days, and we will tell you why.
We will verify your identity before responding to requests to know, delete, or correct. We do this by matching information you provide with information we already hold. You may use an authorized agent to submit a request on your behalf. We may require the agent to provide your signed permission and may ask you to verify your identity directly with us.
14.9 Global Privacy Control
We treat a Global Privacy Control signal sent by your browser as a valid request to opt out of the sale and sharing of personal information for that browser, and for any account associated with it if known to us.
14.10 Do Not Track
Some browsers send “Do Not Track” signals. Because there is no common industry standard for these signals, our website does not respond to them. We do not allow third parties to collect personally identifiable information about your online activities over time and across different websites when you use our website.
14.11 Shine the Light
California Civil Code § 1798.83 allows California residents to request information about disclosures of personal information to third parties for their direct marketing purposes. We do not disclose personal information to third parties for their own direct marketing purposes.
15. Children
Our website and Services are intended for businesses and are not directed at children under 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, contact us and we will delete it.
16. Security
We implement technical and organizational measures designed to protect personal data, taking into account the risks involved and the nature of the data. No method of transmission or storage is completely secure. If a personal data breach occurs, we will notify the competent authorities and affected individuals where required by law.
17. Third-party links and services
Our website and Services may link to or integrate with third-party websites and services. We are not responsible for their privacy practices, and this Privacy Policy does not apply to them. We encourage you to read their privacy notices.
18. Changes to this Privacy Policy
We may update this Privacy Policy at any time, for example to reflect changes in our Services, our processing activities, or applicable law. We review it at least once every 12 months.
When we update this Privacy Policy, we will publish the new version on this page, update the effective date at the top, and record the change in the changelog.
- Material changes: if we make changes that materially affect how we process your personal data or your rights, we will give you reasonable advance notice before they take effect. We will do this by email to account holders and business contacts, by a notice in the Services, or by a prominent notice on our website.
- Other changes: changes that do not materially affect you, such as clarifications, formatting, or updated contact details, take effect when we publish them.
- Consent: where applicable law requires your consent to a change, we will ask for it before applying the change to your personal data.
The version in effect at the time of processing applies to that processing. Previous versions are summarized in the changelog, and you can request a copy of any previous version by contacting us.
19. Contact
For privacy questions or requests, contact: privacy@karinja.ai
Karinja Oy, Espoo, Finland, business ID 3613878-1