In plain words
Your company's data is stored on servers in Helsinki, Finland. The agents send the text and documents they work on to an AI model to read and write; that model does not learn from your data. We do not sell data, we do not show ads and we do not track you across other sites. You can ask for a copy of your data, or for its deletion, at any time.
1. Who we are
The controller is Fidanet Solution Oy, Business ID 3497432-1, Marinkallio 6b, 02320 Espoo, Finland. Email hello@toimeen.com. We have not appointed a data protection officer, as the law does not require one of us; privacy questions are answered by the founders.
For the data your company brings into Toimeen (mail, documents, customers' and suppliers' details), your company is the controller and we are its processor. That processing follows the Data processing agreement, which takes precedence over this policy where they differ.
2. What we collect
Account. Your name, email address, company, language, role, a password stored only as a one-way hash (scrypt), and whether you have confirmed your email address.
Company details. Company name, business ID, VAT ID, address and contact details you enter, or that the company step fetches from the Finnish trade register by business ID.
Your company's content. Mail the agents read from connected mailboxes, attachments, files you upload, documents, drafts and proposals the agents prepare, your conversations with the agents, and decisions made in the approval inbox. This content often contains personal data of other people, such as your customers' contact persons.
Connections. Access keys to services you connect (for example Gmail, Microsoft 365, IMAP, Procountor, Fizzy, Baslic). They are stored encrypted with AES-256-GCM.
Telegram and notifications. If you link Telegram: your Telegram chat ID and display name. If you allow browser notifications: the push address your browser gives us.
Research. When the research agent works for you, the public pages and register entries it read and the findings it recorded. Research about individual people is off unless your company turns it on.
Sign-in and use. For each signed-in session: when it started, the IP address and browser it came from, so you can see and end your sessions. A log of actions in your company's office (who approved what, who changed which setting). Server logs with IP addresses and times, for operation and security.
Messages to us. What you write to hello@toimeen.com.
3. Why we use it, and on what legal basis
- To provide the Service you signed up for: accounts, the agents' work, connections, notifications (contract, GDPR Art. 6(1)(b)).
- To send messages the Service needs: email confirmation codes, password reset links, notices of changes (contract, Art. 6(1)(b)).
- To keep the Service secure, prevent misuse and fix faults (legitimate interest, Art. 6(1)(f)).
- To meet our legal obligations, such as bookkeeping and answering authorities (legal obligation, Art. 6(1)(c)).
We do not use your data for advertising and we do not sell it.
4. AI and model training
The agents use Claude models from Anthropic. When an agent works, the text it needs (for example a mail message, a document, an attachment as PDF or image, earlier conversation) is sent to Anthropic's API for that piece of work. Under Anthropic's commercial terms, data sent through the API is not used to train its models. Anthropic keeps it for a limited time to detect misuse. The processing takes place in the United States and is covered by the EU Standard Contractual Clauses.
When an agent searches the web, the search runs on Anthropic's side with the search words the agent chose.
5. Who else handles the data
We use a short list of service providers, each bound by a data processing agreement:
| Provider | What for | Where |
|---|---|---|
| Hetzner Online GmbH | Servers, database and file storage | Helsinki, Finland (EU) |
| Anthropic | AI models for the agents | United States (Standard Contractual Clauses) |
| Postmark (ActiveCampaign) | Email: confirmation codes, reset links, invitations | United States (Standard Contractual Clauses) |
| Simply.com | Domain name, DNS and our own mailbox hello@toimeen.com | Denmark (EU) |
Only if you choose them: messages to and from Telegram pass through Telegram's servers once you link it; browser notifications pass through your browser maker's push service, encrypted so that the push service cannot read them; and the services you connect (your mailbox, accounting program, point of sale and others) receive what the agents send them after your approval. These are your choices, governed by those services' own terms.
We disclose data to authorities only when the law requires it, and we tell you unless the law forbids that.
6. Transfers outside the EU
Your data is stored in Finland. Anthropic and Postmark process data in the United States; those transfers use the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914) together with encryption in transit.
7. How long we keep it
- Account and company content: while your account is active. After it closes, you can ask for a copy for 60 days; then we delete it within 30 days.
- Research findings and the pages read for them: 180 days by default; your company can shorten this.
- Email confirmation codes: 15 minutes. Password reset links: 60 minutes. Both work once.
- Sessions: 30 days from sign-in, or until you sign out or end them.
- Action log: while your account is active, as the record of who decided what.
- Messages to us: up to three years after the last contact.
- Data we must keep by law (for example our own bookkeeping) is kept for the period the law sets.
8. Your rights
You have the right to see the data we hold about you, to have it corrected, to have it deleted, to restrict or object to its processing, and to get it in a machine-readable form. Write to hello@toimeen.com; we answer within 30 days and free of charge.
If your data came to us through a company that uses Toimeen (for example you are one of its customers), that company is the controller; we pass your request to it and help it answer.
You may also complain to the supervisory authority. In Finland it is the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto), tietosuoja.fi.
9. Security
- Connections are encrypted with TLS.
- Passwords are stored only as scrypt hashes; access keys to connected services are encrypted with AES-256-GCM.
- Each company's data is kept apart in the database with row-level security, so one company's queries cannot reach another's data.
- Signing up requires confirming the email address; changing the password signs out your other devices, and resetting a forgotten one signs out all of them.
- Access to the servers is limited to named people at Fidanet Solution Oy.
If a breach puts your data at risk, we tell the supervisory authority within 72 hours and tell you without undue delay.
10. Cookies
The app sets only the cookies it needs: one that keeps you signed in and one that remembers your language. We use no analytics or advertising cookies, in the app or on toimeen.com. The website toimeen.com loads its fonts from Google Fonts, which means your browser asks Google's servers for them and Google sees your IP address.
11. Children
Toimeen is a tool for companies. We do not knowingly process data of children under 16.
12. Changes
When we change this policy in a way that matters, for example a new kind of data or a new service provider handling your content, we tell you at least 30 days in advance by email and in the app. The date at the top shows the version you are reading.