Privacy Notice

1. Who is responsible

Lataamo Group Oy (business ID 1652310-5), Töölönkatu 51 b, 00250 Helsinki, Finland, is the controller for the personal data of Visuta users.

Contact for privacy matters: finance@lataamo.fi

Content we process for clients. When a client (for example an event organiser) sends content to Visuta through our API or uses Visuta for its own purposes, the client is the controller of the personal data in that content and Lataamo processes it on the client's behalf under a data processing agreement. If you appear in such content, for example as a speaker or event participant, the client's own privacy notice applies and you should contact the client first.

2. What data we process

• Account data: your name, email address and profile picture, which we receive from Google when you sign in, and your organisation and role in Visuta.
• Content you submit: text you paste, audio, video and documents you upload, web pages you ask Visuta to read, and the transcripts made from them. This content may contain personal data about other people, such as names of speakers.
• Generated visualizations and their titles, descriptions and settings.
• Usage and cost records: who created which visualization, when, with which AI model, and what it cost.
• Invitations and API keys: email addresses of people invited to an organisation, and API keys (stored only in hashed form) with the name of who created them.
• Technical data: sign-in cookies, and server logs from our hosting provider that can include IP addresses and request details.

3. Why we process it and on what legal basis

• To provide Visuta — to let you sign in, create visualizations, share them and manage your organisation. For Lataamo staff the legal basis is our legitimate interest in providing work tools (GDPR Art. 6(1)(f)); for client users it is the performance of our agreement with your organisation (Art. 6(1)(b)) or our legitimate interest in serving it.
• To track costs and invoice clients — legitimate interest and our accounting obligations (Art. 6(1)(f) and (c)).
• To keep Visuta secure and working — logs, access control and troubleshooting, based on our legitimate interest (Art. 6(1)(f)).

You do not have to give us personal data, but you cannot use Visuta without an account. Please do not submit special categories of data (such as health information) unless it is necessary and agreed with Lataamo.

4. AI processing

Content you submit is sent to an AI model provider (see section 5) to produce the visualization. The providers do not use this data to train their models under their business terms. Visuta does not make decisions about people that have legal or similarly significant effects on them; the AI only produces visual summaries of the content you give it.

5. Who receives the data

We use the following service providers (processors) to run Visuta. They process data only on our instructions and under data processing terms.

Shared links. Visualizations are shareable by link by default. Anyone who has the link can view the visualization (but not the original content it was made from). You can turn sharing off for any visualization.

We do not sell personal data or use it for marketing.

6. Transfers outside the EU/EEA

Some providers above process data in the United States. These transfers rely on the European Commission's Standard Contractual Clauses and, where the provider is certified, the EU–US Data Privacy Framework, as set out in each provider's data processing terms.

7. How long we keep data

• Account data is kept while your account exists, and deleted on request.
• Visualizations and the text content they were made from are kept until you or your organisation's administrator deletes them.
• Uploaded audio, video and document files are deleted automatically once the visualization has been created.
• Copies held by our AI provider OpenAI are deleted as soon as the result has been saved; OpenAI may keep abuse-monitoring logs for up to 30 days.
• Cost records are kept as long as needed for invoicing and accounting.

8. Cookies

Visuta uses only the cookies needed to keep you signed in, and stores your display preferences in your browser. We do not use analytics or advertising cookies. Shared visualizations may load web fonts from Google, which means your browser contacts Google's servers.

9. Your rights

You have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data deleted;
• restrict or object to processing based on our legitimate interest;
• receive the data you gave us in a machine-readable format.

To use your rights, email finance@lataamo.fi. We reply within one month. You also have the right to lodge a complaint with the Finnish data protection authority, the Office of the Data Protection Ombudsman (tietosuoja.fi).

10. Security

Access to Visuta requires signing in, and each organisation only sees its own content. Data is encrypted in transit, API keys are stored hashed, and access to production systems is limited to Lataamo staff who need it.

11. Changes

We update this notice when our processing changes. The date at the top shows the latest version.