PRIVACY POLICY

PRIVACY POLICY
Last updated: 15th January 2026

---

1. Data Controller

Sampo Research
Address: Tykkimiehenkatu 3 as 1, 21280 Raisio, Finland
Email: support@samporesearch.com

---

2. Personal Data We Collect

We may collect:

• Account information (email, username, password hash)
• Usage data (interaction logs, feature usage, preferences)
• Device data (IP address, browser type, OS)
• AI interaction data (text inputs, uploaded files, messages)
• Cookies and analytics data (see Cookie Policy)

You will always be informed when providing personal data is required.

---

3. How We Use Personal Data

We use your data to:

• Provide core Service functionality
• Improve performance & user experience
• Secure the Service and prevent abuse
• Provide customer support
• Develop and improve AI models (only if explicitly consented or anonymized)

---

4. Legal Bases (GDPR Article 6)

We process your data under:

• Contract — to provide you the Service
• Consent — for optional features (e.g., newsletters, analytics)
• Legitimate Interest — to secure and improve our platform
• Legal Obligation — for recordkeeping, fraud prevention

---

5. Data Sharing

We do not sell your personal data.

We may share data with trusted providers:

• Hosting providers
• Analytics tools
• Email delivery services
• AI service providers (if applicable)

All partners follow GDPR and data-processing agreements.

---

6. International Transfers

If data is transferred outside the EU/EEA, we ensure adequate safeguards such as Standard Contractual Clauses (SCCs).

---

7. Data Retention

We keep personal data only as long as necessary:

• Account data — until account deletion
• Logs — typically 30–180 days
• Backups — up to 90 days

---

8. Your GDPR Rights

You may request:

• Access to your data
• Correction
• Deletion (“Right to be forgotten”)
• Restriction of processing
• Data portability
• Withdrawal of consent

Contact: support@samporesearch.com

---

9. Security

We implement technical and organizational measures such as encryption, access controls, and secure hosting.

---

10. Children’s Privacy

We do not knowingly collect data from minors under 16.

---

11. Updates

We may update this policy and will notify users when changes are material.