Privacy Policy

Last updated: 2 June 2026

1. Data Controller

Pauhu AI Ltd (Pauhu AI Oy)
Business ID (Y-tunnus): 3477255-1
P.O. Box 292, 00101 Helsinki, Finland
Email: dpo@pauhu.ai

2. What Data We Collect

Account data: email address, and organisation name if provided.
Query data: the questions and searches you submit, used to return cited answers.
Payment data: processed by Stripe (PCI DSS Level 1). We do not store card numbers.
Technical data: IP address, browser type, preferred language, and timestamps, recorded in logs for security and reliability.

3. Legal Basis (GDPR Art. 6)

Contract performance (Art. 6(1)(b)): account creation, service access, billing.
Legitimate interest (Art. 6(1)(f)): security monitoring and fraud prevention.
Legal obligation (Art. 6(1)(c)): tax and accounting records.

4. Where Data Is Processed

Service data is processed and stored within the European Union (Hetzner Online GmbH, Finland and Germany). Payment data is processed by Stripe, which may process it outside the EU under appropriate safeguards (Standard Contractual Clauses). We do not sell personal data.

5. Data Retention

Data type	Retention period
Account data	Duration of the account, plus 6 months
Query data	Kept only as long as needed to provide the service
Technical logs	Up to 90 days
Billing records	6 years (Finnish Accounting Act)

6. Your Rights (GDPR Art. 15-22)

Right of access, rectification, and erasure.
Right to restriction of, and objection to, processing.
Right to data portability.
Right to withdraw consent at any time.

To exercise any right, email dpo@pauhu.ai. We respond within 30 days.

7. Cookies and Tracking

We use only strictly necessary cookies for sign-in and preferences. We do not use third-party advertising or tracking cookies.

8. Supervisory Authority

Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto), P.O. Box 800, 00531 Helsinki, Finland. tietosuoja.fi