Trust
Your data stays yours.
Strategy work is sensitive. This page explains in plain language how Suunta.ai handles your content, and links to the documents that bind us.
Principles
How we handle your data
Four principles that shape how Suunta.ai treats your content.
- 01
EU first
Data is processed primarily in the EU. Where a provider operates elsewhere, transfers are covered by the safeguards described in our DPA.
DPA: international transfers - 02
Your content, not training data
We don’t use your content to train general-purpose AI models, and we choose AI providers and settings accordingly.
DPA: AI-related processing - 03
Separated by organisation
Each organisation’s data is kept separate, and access is limited to what running the service requires.
DPA: security measures - 04
DPA and subprocessors
Our DPA and subprocessor list are public. Ask us for anything else your vendor review needs.
Subprocessor list
What happens when you use AI
When you use an AI feature, your prompt and the context needed to answer it are sent to an AI provider. Inputs may be screened automatically for misuse.
Our AI providers are listed in the subprocessor list, with their processing locations, transfer safeguards and retention practices. We give notice before a new subprocessor is taken into use.
Conversation history is stored so the service works, and you can delete it. Summaries of conversations held in a workspace may be added to the workspace’s shared memory, which the AI features of the workspace’s members use. For a private conversation, use one outside the workspace.
Control and portability
- Export
- Your organisation can export its data in a commonly used machine-readable format.
- Deletion
- Delete conversation history and documents in the app. An organisation’s administrator can request deletion of the organisation’s data; contact privacy@suunta.ai.
- Access
- Role-based permissions control who sees what inside your organisation.
At a glance
Trust at a glance
The facts that vendor reviews ask for most, each with the document section that states it.
| Topic | What the documents say | Source |
|---|---|---|
| Provider | Y4 Works Oy (business ID 2978296-6), Helsinki, Finland | DPA: parties |
| Roles | For content your organisation submits, your organisation is the controller and Suunta.ai is the processor. For account, billing, security and product analytics data, Suunta.ai is the controller. | DPA section 2 |
| Processing location | Primarily in the EU/EEA. Some processing, such as AI processing, may take place elsewhere. | DPA section 9 |
| Transfer safeguards | An adequacy decision of the European Commission, such as the EU–US Data Privacy Framework, or Standard Contractual Clauses, with supplementary measures where necessary. | DPA section 9 |
| AI model training | Customer Data is not used to train general-purpose AI models without the customer’s consent. | DPA section 5 |
| AI providers and retention | Listed with their processing locations, transfer safeguards and retention practices. | Subprocessor list |
| Changes to subprocessors | Customers receive advance notice of a new subprocessor and can object on reasonable data protection grounds. | DPA section 6 |
| Personal data breaches | The customer is notified without undue delay after Suunta.ai becomes aware of a breach. | DPA section 8 |
| Audits | Customers can request compliance information and, where needed, conduct or commission an audit. | DPA section 10 |
| Export and deletion | Export in a commonly used machine-readable format; deletion after the agreement ends. Backups are cleared in their normal rotation. | Terms section 15 |
| Governing law | Finland | DPA section 14 |
| Contact | privacy@suunta.ai | DPA section 15 |
The documents
These documents are published in the Suunta.ai app.
-
Data Processing Agreement
Roles, processing purposes, security measures, sub-processors, international transfers, audit rights and retention. It forms part of the agreement you accept when you use Suunta.ai.
-
Privacy Notice
How we process personal data as a controller: accounts, security, product analytics, communications and your rights.
-
Terms of Service
The B2B terms for using Suunta.ai, including AI terms and data protection.
-
Subprocessors
Who may process Customer Data, where, and under which transfer safeguards, plus each AI provider’s retention practices.
Questions
Common security and data questions
Short answers, each backed by the documents above.
Suunta.ai is built with GDPR in mind. Your data is processed primarily in the EU, protected with encryption and access controls, and kept separate from other organisations’ data.
We don’t use your content to train general-purpose AI models, and we choose AI providers and settings accordingly. Conversation history is stored so the service works, and it can be deleted.
AI providers are listed as subprocessors, with transfer safeguards where data leaves the EU/EEA. See our DPA and subprocessor list.
Data is processed primarily in the EU. Some processing, such as AI processing, may take place elsewhere through the providers named in our subprocessor list, under the safeguards described in our DPA.
Questions for your vendor review? Email privacy@suunta.ai.
We don’t use your content to train general-purpose AI models, and we choose AI providers and settings accordingly. The details are in our DPA and subprocessor list.
Suunta.ai personnel access customer content only where needed to operate and support the service, and only under confidentiality obligations. Each organisation’s data is kept separate from other organisations’, and we process your content only on your documented instructions. Details on access, security measures and subprocessors are in our Data Processing Agreement.
AI processing is done by the providers named in our subprocessor list, which also shows each provider’s processing location and transfer safeguards. If keeping AI processing inside the EU is a requirement for your organisation, email privacy@suunta.ai and we’ll go through the options with you.
Yes. Our DPA, subprocessor list, Privacy Notice and Terms of Service are published and open to read.
You can delete chat history at any time in the app. For full account and data deletion, contact privacy@suunta.ai.
Yes. Suunta.ai supports single sign-on via Google and Microsoft (OIDC/OAuth2). Role-based access controls help separate owner, admin, member, viewer and consultant access across the organisation.
SAML SSO, including Okta and Azure AD federation, and SCIM provisioning are roadmap items, not current production features. Audit and activity data are available through data export workflows.
Need something else for your vendor review?
Email privacy@suunta.aiSee it in action
Try it with your own strategy.
Start free and see how Suunta.ai works with your real context.