Privacy Policy

Last updated: 14 October 2026

Who we are

Aye Matey is a service provided by Mainostoimisto Kaksi Oy (business ID 2546713-3). Our website address is https://www.ayematey.fi.

Data controller:
Mainostoimisto Kaksi Oy (auxiliary trade name Aye Matey)
Business ID 2546713-3
ahoy@ayematey.fi

Two roles: controller and processor

In the Aye Matey service, personal data is processed in two different roles. Understanding this helps you know who to contact in matters concerning your own data.

1. When you visit ayematey.fi or are our customer, Mainostoimisto Kaksi Oy is the controller of your personal data. This notice describes that processing.

2. When you chat with an Aye Matey receptionist on one of our customers’ websites, that company is the controller of your personal data and Mainostoimisto Kaksi Oy acts on its behalf as a processor. In that case, the primary privacy information can be found in that company’s own privacy notice. Processing is agreed with our customers in a data processing agreement (DPA).

If you have chatted with an Aye Matey receptionist on another company’s website, please direct any requests concerning your privacy primarily to that company.

What data we collect and why

Customer accounts and use of the service

When you create an Aye Matey account, we collect and process: your name, email address, company name and contact details, login information, and the settings and configuration of the service.

You can also sign in to the customer panel with your Google account. In that case we request only the openid, email and profile permissions from Google, which give us your name, email address and profile picture. We use them solely for authentication. Signing in with Google does not give us access to your calendar; the calendar connection is a separate authorisation (see Calendar integration).

Purpose: providing the service, account management, customer support and service-related communication. Legal basis: contract.

Billing

Payments are processed by our payment partner Stripe. We do not store payment card details in our own systems. For invoicing, we process the company’s billing details and payment history. Legal basis: contract and statutory obligations (incl. accounting legislation).

Contact requests and demo bookings

When you contact us or book a demo, we process the contact details you provide and the content of your message in order to respond to you. Legal basis: pre-contractual measures when you request a demo or a quote, and for other contact requests our legitimate interest in responding to enquiries and managing our customer and business relationships.

Receptionist conversations on our customers’ websites (as processor)

When a website visitor chats with the Aye Matey receptionist, the system stores the content of the conversation and any contact details the visitor voluntarily provides (e.g. name, email, phone number), together with a description of their need.

Purpose: responding to the conversation, charting the need, booking appointments and responding to contact requests on our customer’s behalf. The data is not used for marketing or disclosed to third parties for marketing.

Visitors are always told that they are talking to an AI assistant.

Where data is stored and how it is protected

We store data (such as conversations, leads, bookings and settings) in our systems on servers located in the EU.

Data is protected with appropriate technical and organisational measures. Data in transit is encrypted, passwords are stored as hashes, and integration credentials, such as the tokens of calendar and messaging channel connections, are stored encrypted. Access to the data is restricted to people who need it to provide the service, deliver customer support or maintain security, and processing is subject to confidentiality obligations.

For generating AI responses, we use a carefully selected technology partner under a data processing agreement (DPA). Some of our subprocessors may process data outside the EU and the EEA. In such cases, transfers rely, where applicable, on the European Commission’s Standard Contractual Clauses or another transfer mechanism permitted under the GDPR. You can request more information about these safeguards, and a copy of them, at ahoy@ayematey.fi. The categories of service providers are listed under Subprocessors below.

How long we keep data

Customer account data is kept for the duration of the customer relationship and is deleted or anonymised no later than 12 months after the relationship ends. Accounting records are kept for the period required by the Finnish Accounting Act: vouchers for six years and books of account for ten years from the end of the financial year. Customer support conversations in the service’s admin panel are kept for 12 months.

For personal data in receptionist conversations, our customer can set a retention period after which personal data is anonymised automatically. The default retention period is 90 days, and the customer can change it in their own settings as needed. After anonymisation, statistics remain without personal data. Data is also deleted on request.

Deleted data may remain in backups for about 30 more days, after which it is removed from them as well.

Subprocessors

We use carefully selected service providers in delivering the service. They process personal data on our behalf under data processing agreements. The categories of service providers are:

• server, database and backup services (EU)
• AI services for generating responses (Google Gemini API by default, see AI services below)
• payment processing (Stripe)
• calendar integrations (Google and Microsoft, only when authorised by the customer)
• messaging channels (WhatsApp and Instagram, if enabled by the customer)
• visitor statistics (Google Analytics, only with the visitor’s consent)
• Cloudflare, Inc. (Turnstile) – Bot protection for forms and chat. Turnstile validates in the background that the visitor interacting with forms is human. Processed data includes IP address and browser technical details; data is not used for advertising. For more information, see the Cloudflare Privacy Policy and Turnstile Privacy Addendum.
• email services

Server, database and backup services are located in the EU. Other service providers may also process data outside the EU and the EEA under the transfer safeguards described above.

A named list of subprocessors is available to our customers as part of the data processing agreement, and we will tell you the recipients of your data on request.

AI services: responses of the receptionist’s chat and voice assistant are generated by default with the Google Gemini API (Google AI Studio, paid tier). On the paid tier, Google does not use prompts or responses to train its models. In the Agentuuri plan, the customer may choose to use their own API key with one of the following services: OpenAI, Anthropic, Mistral, Meta Llama (via an OpenAI-compatible API) or Microsoft Azure OpenAI. In that case, the customer has its own contractual relationship with that provider. The AI service processes the visitor’s chat messages (and speech, in the voice assistant) and the responses generated to them. It does not receive Google calendar data.

Calendar integration (Google and Microsoft)

Our customers’ specialists can connect their own Google or Microsoft calendar for bookings using OAuth 2.0.

What permissions we request (Google):

• Looking up busy times (calendar.freebusy): we receive only busy time intervals, not the contents of events.
• Reading calendars (calendar.readonly): fetching the calendar list so that the specialist can choose the target calendar and busy times can be checked across all of their calendars, and checking events created by Aye Matey itself.
• Managing events (calendar.events): creating, moving and cancelling bookings.

How we use the data: solely to display available times and to save bookings made through the receptionist. Tokens are stored encrypted.

What we do not do: we do not read, analyse or store the contents of other events in the calendar, and we do not disclose calendar data to third parties.

Disconnecting: the specialist can disconnect the calendar connection at any time, in which case the tokens are removed from the system.

The application complies with the Google API Services User Data Policy (Limited Use): calendar data is used only for booking and availability display purposes and is not transferred to other applications.

Processing of Google Workspace Data and Artificial Intelligence

1. Data Protection Mechanisms

Data processed via Google Workspace APIs (specifically Google Calendar) is encrypted in transit (TLS 1.2 or later), and OAuth tokens are stored encrypted (AES-256). Access to user data is strictly limited to real-time system queries required to perform user-requested actions.

2. Data Retention and Deletion

We store only the data needed to carry out a booking: the email address of the connected Google account, the ID and name of the selected calendar, the ID and meeting link of the event created by Aye Matey, and the encrypted access tokens. We do not store the contents of other events. Busy time intervals are fetched when needed and are not stored permanently; the available times calculated from them are kept in a short-lived cache for at most 60 seconds. If a user disconnects the application or requests account deletion, all associated Google authentication tokens and temporary session data are immediately removed from our systems. They are removed from backups within about 30 days.

3. AI Model Training Prohibition & Limited Use

User data received from Google Workspace APIs (including calendar events and details) will never be used, transferred, or sold to train, retrain, or improve third-party or generalized artificial intelligence or machine learning (AI/ML) models.

The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

Aye Matey’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

User data received from Google, such as calendar data and information derived from it (for example available times), is never passed to any AI model or AI service, and is never used to train or develop AI models.

Automated decision-making

We do not make automated decisions based on your personal data within the meaning of Article 22 of the GDPR that would produce legal effects concerning you or similarly significantly affect you. The AI assistant answers questions and forwards contact requests, but it does not make such decisions.

Your rights

You have the right to:

• know what personal data we process about you, and receive a copy of it
• request rectification or erasure of your data
• restrict or object to processing as provided by law
• transfer the data you have provided to another controller
• withdraw your consent at any time where processing is based on consent, such as Google Analytics statistics. You can change your choice using the Open cookie settings button on the Cookie Policy page. Withdrawal does not affect the lawfulness of processing carried out before it.
• lodge a complaint with a supervisory authority (in Finland, the Office of the Data Protection Ombudsman, tietosuoja.fi)

The right to erasure does not apply to data that we must retain for statutory, administrative or security reasons.

If your question concerns a conversation on one of our customers’ websites, we will forward the request to the correct controller where necessary. You can also contact that company directly.

Contact in privacy matters: ahoy@ayematey.fi.