Privacy policy

1. Data controller

Innovila & Co Oy (Business ID 3632755-8)
Logomo Byrå, Junakatu 9, 20100 Turku, Finland
info@innovila.fi · +358 40 724 9359

2. What data we process

We process personal data in four contexts:

• Contacts: when you reach out by email, by phone or through the forms on our website (the contact form and the Growth Map request), we process your name, company, contact details, website address and the content of your message. Messages sent through the forms are forwarded to us by email.
• Technical data: when you visit the site, our hosting provider Cloudflare processes technical data such as your IP address and browser details to deliver the site securely and to protect the forms from spam (Cloudflare Turnstile). Cloudflare may use a strictly necessary security cookie for this.
• Website usage data (only with your consent): with Google Analytics we see which pages are visited, the device type and approximate location, as statistics. Analytics cookies are set only if you allow them.
• Google user data in the Innovila tool: our internal tool processes data obtained from Google’s APIs in order to manage our clients’ accounts. See section 10 for details.

3. Purpose and legal basis

• Communication and customer relationships: based on a contract or steps preceding one, and legitimate interest.
• Running, protecting and developing the site: based on the controller’s legitimate interest.
• Website analytics: based on your consent, which you can withdraw at any time.

4. Retention

Contact-related data is kept as long as handling the matter and any customer relationship require. Analytics data is kept for at most 14 months.

5. Recipients

We use the following service providers, which process data on our behalf:

• Google (Google Workspace email and, with your consent, Google Analytics and Tag Manager)
• Cloudflare, Inc. (site hosting and delivery, and spam protection for the forms)
• Resend (delivery of website form messages by email)
• Anthropic (Claude), OpenAI (ChatGPT) and Google (Gemini): AI services we may use when handling inquiries and in our customer work, for example to analyze or summarize information

We never sell or hand over personal data to third parties for marketing purposes.

6. Transfers outside the EU/EEA

Google, Cloudflare, Resend, Anthropic and OpenAI may process data in the United States. Transfers rely on the EU–U.S. Data Privacy Framework and, where needed, the EU Commission’s standard contractual clauses.

7. Cookies

The site stores your cookie choice and one technical setting for the opening animation in your browser. Neither contains personal data. Our hosting provider Cloudflare may set a strictly necessary security cookie (such as __cf_bm) to protect the site from bots. Google Analytics cookies (_ga and _ga_…) are set only if you allow analytics, and they are kept for up to two years. You can change your choice at any time from “Cookie settings” at the bottom of every page.

8. Your rights

You have the right to:

• know what personal data of yours we process, and receive a copy of it
• request correction or deletion of your data
• request restriction of processing, or object to it
• withdraw your consent at any time
• have the data you provided transferred to another controller

Send requests to info@innovila.fi. You also have the right to lodge a complaint with the supervisory authority (tietosuoja.fi/en).

9. Changes

We update this policy when our services or the law change. The current version always lives on this page.

10. Processing of Google user data in the Innovila tool

This section concerns only the internal Innovila tool used by our employees, not visitors to this website.

The tool uses Google’s APIs (Google Ads API, Google Analytics Data API and Google Search Console API). An employee signs in with their own Google account (OAuth 2.0), and the tool uses their email address and basic identifiers along with the advertising, analytics and search data of the client accounts they have access to. The data is used only to analyze, optimize and report on our clients’ advertising.

Access credentials issued by Google are stored only on the employee’s own workstation. Only aggregated performance figures are stored for client reporting, for the duration of the client relationship, and each client sees only their own accounts. The data is never sold, never handed over to third parties and never used for ad targeting, creditworthiness assessment or training general-purpose AI models.

Innovila’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. The tool’s access can be revoked at any time at myaccount.google.com/permissions.