Privacy Policy

1. Data controller

The data controller for the Opastin service is Membri Oy. The service is used as an internal knowledge base tool for customer service teams.

2. What data we collect

Palvelun tarjoamiseksi keräämme seuraavat tiedot. Suostumukseen perustuva markkinoinnin mittaus kuvataan erikseen kohdassa 5.1.

• Basic Google account info — name and email address provided during Google sign-in. We do not store passwords.
• Usage log — information about when a user has signed in and what changes they have made to instruction documents.
• Service content — instruction documents created and edited by users in your organization, along with their version history.

3. How data is used

Collected data is used exclusively for the following purposes:

• User identification and login
• Managing access rights within the organization
• Maintaining change logs (who changed what and when)
• Importing user-selected files and providing AI features
• Technical maintenance and troubleshooting of the service

Emme käytä organisaatiosi ohjedokumentteja markkinointiin emmekä myy niitä kolmansille osapuolille. Suostumuksellasi käytämme Meta Pixeliä mainonnan mittaamiseen ja kohdentamiseen kohdassa 5.1 kuvatulla tavalla.

4. Data processing and storage

User authentication is handled via Google and Microsoft OAuth services. Instruction documents and user data are stored in a PostgreSQL database. The data flow for Google Drive imports and external AI processing is described in more detail below.

Service content is retained as long as your organization uses the service or until it is deleted separately. When an organization is deleted, its content is removed from the service's active database.

5. Third parties

The service uses the following third-party services:

• Google OAuth and Drive API — for login and importing files selected by the user. Google processes data in accordance with its own privacy policies.
• Microsoft OAuth — for login. Microsoft processes login data in accordance with its own privacy policies.
• Anthropic Claude — AI features (summaries, search, conflict checking). Text from instruction documents is sent in API calls for analysis.

5.1. Meta Pixel ja markkinointievästeet

Käytämme Meta Pixeliä mainonnan mittaamiseen ja uudelleenkohdentamiseen Facebookissa ja Instagramissa vain, jos hyväksyt markkinointievästeet. Palveluntarjoaja on Meta Platforms Ireland Ltd. Pixel välittää Metalle tietoja sivukäynneistä ja tapahtumista, kuten hinnaston katselusta ja rekisteröitymisen valmistumisesta.

Meta Pixel käyttää evästeitä _fbp ja _fbc selaimen ja mainonnasta saapuvien käyntien tunnistamiseen. Tietojen käsittelyn oikeusperuste on suostumus. Voit kieltäytyä markkinointievästeistä tai peruuttaa suostumuksesi milloin tahansa avaamalla ”Evästeasetukset” ja poistamalla Markkinointi-valinnan. Tällöin poistamme nämä evästeet ja lopetamme Pixelin käytön selaimessasi.

Google Drive import and AI processing

Google Drive connection is voluntary and separate from logging into the service.Organisaation ylläpitäjä yhdistää oman Google-tilinsä ja selaa My Drivea sekä jaettuja asemia Opastinin tiedostoselaimessa. Opastin pyytää Drive-sisällön drive.readonly-lukuoikeuden tiedostojen ja kansioiden selaamista varten. Tuontia varten luetaan valitsemiesi tiedostojen sisältö.Opastin does not modify, delete, or create files in Google Drive.

• During linking, your Google account ID, name, and email address are read to identify the connection.
• From selected files, the ID, name, file type, size, and available link, edit time, and version information are read. File content is read during preview.
• Text extracted from Google Docs, PDF, DOCX, and TXT files is sent directly to the Anthropic API for instruction parsing and AI processing. Drive access tokens are not sent to Anthropic.
• Validated articles and their source data are saved to the Opastin database. Canceling the preview does not save the articles, but Anthropic API processing already performed cannot be undone. Imported article text may also be processed in search and other AI features used by the user.

The connection is restricted to the organization and the administrator who connected it. OAuth access and refresh tokens are stored on the server AES-256-GCM encrypted.Drive-käyttöoikeus- ja virkistystunnuksia ei välitetä selaimeen; Drive API -pyynnöt tehdään palvelimella.Content import and customer selection are verified on the server according to organization permissions.

Removing the link deletes the Google connection credentials stored in Opastin and cuts off future access via this connection. You can also revoke the permission granted to Google from your Google account's third-party connections. Already imported articles, source data, and version history are not deleted upon unlinking; they are subject to the service's content retention and deletion policies. Deletion requests can be directed to your organization's administrator or controller.

Anthropic API is a commercial service. Anthropic states that it does not, by default, use inputs or outputs from its commercial services to train its models. Anthropic processes and retains API data according to its applicable commercial terms. This statement does not promise Anthropic Zero Data Retention. More information: Anthropic API data usage and retention policies.

The use and transfer of information obtained by Opastin from Google API services comply with the Google API Services User Data Policy, including Limited Use requirements. Data is used only to provide and improve Opastin features visible to the user. It is not sold, used for ad targeting, or for training general-purpose AI models. Transfers to service providers are limited to the implementation of these features. Humans may read the data only with the user's explicit consent, for security reasons, legal requirements, or as permitted by practice in aggregated and anonymized form.

6. User rights

In accordance with the EU General Data Protection Regulation (GDPR), you have the right to:

• Access the data stored about you
• Request correction or deletion of your data
• Restrict the processing of your data
• File a complaint with a data protection authority

For requests, please contact your organization's Opastin administrator or the data controller directly via the contact information below.

7. Contact information

For questions regarding privacy, please contact: info@membri.fi