Privacy Notice
This notice explains how Ordfeste processes personal data when you use ordfeste.fi or access Ordfeste through an AI application.
Data controller: Aregon, Business ID 3596336-8
Privacy and other enquiries: info@ordfeste.fi
Where we obtain data
We obtain data from you, your AI application, your chosen sign-in provider and use of the service. Legal materials come from public sources such as Finlex, courts and public authorities.
A request sent by your AI application may include information from your conversation, form responses or a document you provide. The content Ordfeste receives depends on the request the application sends.
Data we process
| Category | Examples and purpose |
|---|---|
| Account and sign-in data | Your Google or Microsoft account identifier, name and email where supplied, and sign-in information. We use these to identify you and manage your account. Ordfeste does not receive your password or request access to your emails or cloud files. |
| Connected application permissions | The application you connect and the permissions you grant it. We use these to check access to the service. |
| Searches and document content | Questions, descriptions of your matter, personal data and files you provide. We use these for the research, document creation and conversion you request. |
| Generated files | Word and PDF documents and information needed to deliver them and manage access. |
| Technical data | Information about service use, connections and errors, including IP addresses. We use this to keep the service working and secure. |
| Enquiries | Your contact details and information you provide so we can respond to your enquiry. |
| Public legal sources | Personal data in sources, such as names or professional roles, used to search and present legal sources. |
Purposes and legal bases
Managing your account and processing data about you that is necessary to provide the service you request are based on performing our contract with you or taking steps you request before entering into a contract (GDPR Article 6(1)(b)).
Service security, investigating faults and maintaining the service are based on our legitimate interest in providing a secure, functioning service (Article 6(1)(f)). This also covers necessary enquiries unrelated to performing a contract. For ordinary personal data in public legal sources, the legitimate interest concerns providing legal research. Public availability alone does not make processing lawful.
Processing to meet legal obligations, such as responding to data protection rights requests, is based on the relevant obligation (Article 6(1)(c)).
Processing information about other people requires an appropriate legal basis of its own. Health data, other special categories of personal data and criminal data also require the relevant legal conditions to be met. Connecting an AI application to Ordfeste does not itself give consent to every processing purpose.
Ordfeste does not use your questions, documents or other content you provide for model training, analytics, profiling or product development.
Service providers and recipients
AI application. Your chosen application, such as ChatGPT or Claude, sends requests to Ordfeste and receives responses, document information and download links. Its own processing, retention and model-training practices are governed by its provider’s terms, privacy notice and your settings.
Sign-in provider. Google or Microsoft identifies you and supplies Ordfeste with the information needed for sign-in. Its own processing is governed by its privacy notice.
Providers that help run the service. We use service providers for hosting, security and search. Your search question, including any personal data it contains, is sent to an AI service provider that supports search.
Other recipients. Anyone with a download link can download the document while the link is valid. We disclose data to authorities where required by law.
Locations and international transfers
Ordfeste’s data storage and processing of search questions take place in the European Union, in Sweden. A provider operating worldwide also helps deliver and protect service connections, so this does not mean all processing associated with using the service is limited to the EU.
Your AI application’s and sign-in provider’s privacy notices describe their own processing locations and international transfers.
How long we retain data
| Data | Retention |
|---|---|
| Generated Word and PDF files | Documents are available to download for four hours after creation and are then deleted from the service. |
| Account data and permissions | Account deletion requests are completed within 15 days. Disconnecting your AI application or letting access expire does not delete your account. |
| Technical logs | Retained for 30 days to maintain the service and investigate faults. Routine usage logs do not contain question text or document content. Error messages may, however, contain fragments of content you send. Logs are not used for analytics or profiling. |
| Backups | Backups are retained for seven days. |
Deleting an Ordfeste file does not delete information held by your AI application or copies you download or share.
Cookies and protection of data
We use a cookie necessary for sign-in. Ordfeste’s own web pages do not use advertising or analytics cookies. Sign-in providers and AI applications may use their own cookies.
We protect data through encrypted connections and restricted access. A download link grants access to the document: keep it secure and share it only with intended recipients.
Your rights
Where the legal conditions are met, you can request access to your personal data, correction or deletion, restriction of processing and data portability. You can object to processing based on legitimate interests on grounds relating to your particular situation. If processing relies on consent, you can withdraw it without affecting the lawfulness of earlier processing.
Send your request to info@ordfeste.fi. We may ask for additional information needed to verify your identity. Account deletion requests are completed within 15 days. We respond to other rights requests without undue delay, normally within one month. If an extension permitted by law is needed, we explain it and the reason within one month.
You can complain to the Office of the Data Protection Ombudsman or another competent supervisory authority in the EU or EEA.
Providing data and automated processing
Account identification and permissions are necessary to connect Ordfeste to your AI application. You decide what to include in searches and documents. Missing information may prevent the requested action or make its result less useful.
Ordfeste searches for information and creates documents automatically. It does not make decisions about you based solely on automated processing that have legal or similarly significant effects under GDPR Article 22. You decide how to use the results.
Changes to this notice
We update this notice when the service or its processing changes. We publish the current version and its date on the website. We notify you of material changes as required by law before starting the new processing.