Privacy Policy

Effective: July 8, 2026 · Last updated: August 13, 2026

Who we are

Varjosoft Oy (Y-tunnus: 3360588-2), Topeliuksenkatu, 00260 Helsinki, Finland. Managing Director: Hannu Varjoranta. Contact: privacy@varjosoft.com

What we collect

We collect only what you give us or what is technically necessary to serve the site.

• Contact form submissions: your email address and any message you choose to write. We also store which intent you selected (advisory, investor, Spegling, etc.) if you clicked one.
• Server logs: IP address, request path, timestamp, user agent. These are standard web server logs retained for security and debugging. They are not linked to your identity.
• Browser storage: the Dots chat widget uses your browser's localStorage to work. It keeps how long you have been reading (so it knows when it is ready) and a random ID it generates in your browser (so a return visit can continue a conversation). This is first-party functional storage. It holds no name, email, or other identifying detail, and it is never sent to a third party.

What we do not collect

• We do not use cookies.
• We do not use third-party analytics (no Google Analytics, no tracking pixels).
• We do not load external resources that track you (fonts are self-hosted).
• We do not fingerprint your browser or device.
• We do not sell, share, or trade your data with anyone.

How we use your data

• Email addresses are used to respond to your inquiry or to answer a Spegling access request if you made one. Nothing else.
• Server logs are used for security monitoring and debugging. They are not analyzed for marketing purposes.
• localStorage data is used by the Dots widget to gate itself on real reading time and to keep continuity across pages and return visits. It stays in your browser until you ask Dots a question; the ask sends the visitor ID and accumulated reading time along with it, as described below.

Legal basis (GDPR)

• Contact form: performance of a contract or pre-contractual measures (Art. 6(1)(b)). You are requesting us to respond to your inquiry.
• Server logs: legitimate interest (Art. 6(1)(f)). Security and availability of the service.
• The Dots widget: legitimate interest (Art. 6(1)(f)). We run a small on-site chat widget and keep the questions asked of it so we can operate and improve it. The browser storage it uses is functional. We set no tracking cookies and do not profile you; you can decline by not using the widget and clearing your browser storage.

The Dots widget

Dots is the small chat widget in the corner of the site. When you send it a question, we store the following on our server so it can answer, keep context within a short conversation, and so we can see how it is used:

• The question you asked and the answer that was generated.
• Which page you asked it from.
• A one-way hash of your IP address. The raw IP is not stored, and we do not derive or store your location from it.
• The random visitor ID your browser generated, which is what groups a short conversation together.
• How long you had been reading before you asked, plus basic operational metrics (which model answered, token counts, cost, and response time).

The visible text of the page you are on is sent to the AI provider so the answer can be grounded in what you are reading. It is used only to generate the reply and is not stored. There is no login and no account. You can clear your browser storage for this domain at any time, and you can ask us to delete the questions tied to your activity by contacting privacy@varjosoft.com.

AI-generated content

Dots and Spegling chat responses are generated by artificial intelligence. They may be inaccurate, incomplete, or inappropriate. Spegling does not provide professional advice (legal, financial, medical, or otherwise). Varjosoft Oy is not liable for actions taken based on AI-generated responses.

Your questions are not used to train AI models by Varjosoft or any AI provider. They are stored so the widget can keep context and so we can operate and improve it, and are processed by our AI provider solely to generate the reply.

Data retention

• Contact form submissions: retained for 24 months after last interaction, then deleted.
• Server logs: retained for 90 days.
• Dots questions and answers: retained while the widget is in active development. You can request deletion of records tied to your activity at any time.

Where your data is stored

All data is stored on servers in the EU, primarily in Finland. We currently use Hetzner (Helsinki) and may use OVH (EU data centers) or UpCloud (Helsinki) as the project grows.

International data transfers

Questions you ask the Dots widget, and the page text sent with them, are answered by Nebius Token Factory and processed within the EU. We do not send your Dots questions to providers outside the EU/EEA. We may use other AI providers (including ones based in the United States) for our own internal benchmarking and research, using our own test material rather than visitor questions.

Your rights

Depending on the processing and its legal basis, the GDPR gives you the right to:

• Access the data we hold about you
• Correct inaccurate data
• Request deletion of your data
• Restrict processing
• Data portability
• Object to processing
• Withdraw consent at any time (without affecting the lawfulness of prior processing)
• Lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi)

To exercise any of these rights, contact privacy@varjosoft.com. We will respond within 30 days.

Children

This site, Dots, and the Spegling chat are intended for users aged 16 and older. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, contact privacy@varjosoft.com and we will delete it.

AI processing

Dots and Spegling use large language models to generate chat responses. Our primary AI provider is Nebius Token Factory, which processes visitor questions on EU-hosted endpoints. We use Nebius because it allows us to keep AI processing within the EU.

We may use additional model providers (including Anthropic, OpenAI, and Perplexity) for our own benchmarking and research. Questions asked of the Dots widget are not sent to them; they are answered by Nebius in the EU. We do not attach personal identifiers (name, email, raw IP address) to any AI request, with any provider. Anything you type into a question is sent as written.

Spegling is in an active research and development phase. We aim to use EU-based models and processing wherever possible. This section will be updated with more specific details as development proceeds.

Third parties and data processors

Infrastructure:

• Hetzner Online GmbH (Helsinki, Finland) — primary server hosting
• OVH (EU data centers) — potential additional hosting
• UpCloud (Helsinki, Finland) — potential additional hosting
• Let's Encrypt — TLS certificates
• DB-IP — IP geolocation database (CC BY 4.0). Downloaded and queried locally on our server. No visitor data is sent to DB-IP.

AI providers (data processors):

• Nebius Token Factory (EU data centers) — answers the Dots widget; the only provider that processes visitor questions
• Anthropic (Claude API), OpenAI, Perplexity — used for our own benchmarking and research, not for processing visitor questions

We do not attach personal identifiers to AI requests, and no provider uses your data for model training. Nebius, the only provider that processes visitor questions, incorporates its Data Processing Agreement into its terms of service.

Changes

This project is in active development. This policy will be updated as the product matures. We may add or remove providers, but the core commitment remains: EU-based processing where possible, no personal identifiers sent to AI providers, no data sold or traded. The effective date at the top will change with each update. No retroactive changes to how existing data is used.

Contact

Varjosoft Oy
Topeliuksenkatu, 00260 Helsinki, Finland
Y-tunnus: 3360588-2
Email: privacy@varjosoft.com