1. Controller and contact details
Data Haltuun Oy is the controller for the marketing website. You can find the company’s contact details below. You can also send requests concerning your personal data to the same email address.
This notice covers visitors to the marketing website and people who contact us through it. The voice-feature summary below separately describes processing in the Nopsa app. Full details about app accounts, tasks, time entries and invoicing data are provided in the app’s privacy policy, available from its sign-in screen or the privacy link in voice help.
Data Haltuun OyFinnish Business ID: 3146498-3antti.saarela@datahaltuun.fi2. Optional voice features in the app
This summary, added on 13 October 2026, explains our existing voice features and does not introduce new uses of your data. You can continue using tasks, work hours and invoices without voice features. Browsing the marketing website does not trigger OpenAI voice processing.
When you use a voice feature in the app, your recording is sent to the OpenAI API to convert speech into text. The transcript and app context are then sent to OpenAI to interpret your request, prepare a task, work-hour or invoice action, or answer a question about tasks.
Depending on the feature, context includes customer and project names, task identifiers or titles, and date, time and language information. The task assistant also includes summaries of up to 50 tasks: titles, due dates, completion status, priority, and associated customer and project names. This context accompanies task-assistant voice requests, including requests to create a task.
Data travels over encrypted connections. Our voice service excludes recordings, transcripts, task context and generated content from diagnostic logs. OpenAI states that API inputs and outputs are not used to train its models by default, unless the API customer opts in to data sharing.
OpenAI documents no application-state or abuse-monitoring retention for its audio transcription endpoint. For text interpretation, its standard abuse-monitoring logs may contain transcripts, context and outputs for up to 30 days, unless longer retention is legally required. Retention depends on the applicable service and account controls. Tasks, work-hour entries and invoices you save remain subject to the app’s normal retention practices.
The app’s main database (Firestore) is hosted in Finland. OpenAI may process data outside the EU and EEA; our current voice integration does not restrict processing to these regions. International transfers are subject to GDPR requirements for a valid transfer mechanism, such as an applicable adequacy decision or Standard Contractual Clauses and any necessary additional safeguards. Contact privacy@nopsa.io for information about the transfer arrangements applicable to your data.
3. What data do we process and why?
We receive data from you when you contact us and from your browser when you use the website. You do not need an account to browse the site.
- Enquiries: your email address, name and any other information you send us. We use this to respond and handle your enquiry, based on our legitimate interest in assisting people who contact us or on steps taken at your request before entering a contract.
- Technical operation and security: the IP address, time, requested URL and browser details of a web request may be included in service provider logs. Processing supports website delivery, troubleshooting and abuse prevention, based on our legitimate interest in maintaining a working and secure website.
- Usage analytics: with your consent, we measure page visits, button clicks, language choices and interactions with product examples using Google Analytics 4. Data may include cookie identifiers, device and browser details and approximate location. The purpose is to understand website use and improve its content.
- Cookie choice: we store your analytics decision and its timestamp in your browser so that we can respect your choice.
5. Service providers and international processing
The website is delivered using Google Firebase Hosting and Google Cloud Run. Google provides consent-based usage analytics. Enquiries are handled through the company’s email service. These providers may process data to deliver their services.
Using international providers may involve processing outside the EU and EEA. Google describes international transfers and safeguards, such as European Commission standard contractual clauses, in its own terms. You can contact us for further information about recipients of your personal data and transfer safeguards.
6. Retention and protection
We retain enquiry data for as long as needed to handle the matter. Where necessary, retention continues to meet legal obligations or deal with legal claims. The need for retention is assessed based on the enquiry’s purpose and progress.
Technical log retention depends on the services’ logging settings and security needs. Analytics data retention depends on the retention settings in Google Analytics. The consent choice stored in your browser remains valid for 180 days. Contact us for more information about retention of your data.
Data is protected through access permissions and the technical safeguards of the services used. Please do not send passwords or unnecessary sensitive personal data by email.
7. Your rights
You can request access to your personal data, correction of inaccuracies, erasure or restriction of processing, subject to applicable legal conditions. You can object to processing based on legitimate interests on grounds relating to your particular situation. For automated processing based on consent or a contract, you may have the right to data portability.
Send your request to the controller’s email address. We may ask for information necessary to verify your identity. We normally respond within one month. You can also lodge a complaint with the Finnish Data Protection Ombudsman if you believe your data has been processed unlawfully.
8. Changes to this notice
We update this notice when the website or personal data processing changes. The date at the top shows the latest update. If the purpose of consent-based processing changes, we will request new consent where required.