Privacy Policy

AMV Innovative Oy · Effective as of 22 September 2026

1. General

1.1 This privacy policy (hereinafter the “Policy”) describes the processing of personal data by AMV Innovative Oy (hereinafter “AMV” or the “Controller”) in connection with the provision of the Psypen service (hereinafter the “Service”). The Policy has been drawn up in accordance with Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council (hereinafter the “GDPR”).

1.2 Capitalised terms used in the Policy have the meanings ascribed to them in the terms of service of the Service (hereinafter the “Terms”), unless otherwise defined herein. “Data Subject” means the natural person whose personal data are processed, including the User and any third parties whose data are contained in the Content.

1.3 The website amvinnovative.com is governed by a separate privacy policy.

2. Controller and Roles

2.1 Controller:
AMV Innovative Oy
Business ID 3543514-3
Helsinki, Finland
solutions@amvinnovative.com

2.2 Business Customers. To the extent a Business Customer deploys the Service for use by its own users, the Business Customer acts as controller within the meaning of Article 4(7) GDPR in respect of the Content, and the Controller acts as processor within the meaning of Article 4(8) GDPR in accordance with the data processing agreement between the parties. In respect of account, subscription and billing data and technical data, the Controller acts as an independent controller.

2.3 Third Parties Contained in the Content. The Content may contain personal data of persons other than the User, including, but not limited to, persons who have sent messages to the User, persons referred to in calendar entries and persons whose speech is captured in the User’s audio. The Controller processes such data solely on the User’s instruction and in reliance upon the User’s warranty under Section 7.2 of the Terms.

3. Personal Data Processed, Purposes and Legal Bases

3.1 Account Data

Data processed: name, email address, sign-in and authentication identifiers, indirect identifiers generated by the Controller, language and other user settings, account status, and any linking of the user account to an organisation’s Business Customer account under Section 4.5 of the Terms.
Purpose: creation and administration of the user account, identification and authentication of the User, provision of the Service, and communications to the User concerning the Service.
Legal basis: performance of a contract (Article 6(1)(b) GDPR).
Retention: for the term of the user account and thereafter for as long as necessary to complete deletion, cycle backups and comply with statutory obligations.

3.2 Subscription and Billing Data

Data processed: type and status of the Subscription, billing period, status of payment transactions, invoices and credits, and the billing details of Business Customers. Payment instrument data are processed exclusively by the payment processor; the Controller has no access to the full payment card number.
Purpose: charging of payments, invoicing, debt collection, accounting and compliance with tax obligations.
Legal basis: performance of a contract (Article 6(1)(b)) and compliance with a legal obligation (Article 6(1)(c)), in particular the Finnish Accounting Act (1336/1997) and tax legislation.
Retention: in respect of accounting records, the period required by the Accounting Act; otherwise for as long as necessary for invoicing, collection and the handling of any claims.

3.3 Speech Data

Data processed: audio transmitted through the microphone upon the User activating the Service and the text generated therefrom by speech recognition; response text transmitted to speech synthesis.
Purpose: use of the Service by voice and generation of spoken responses.
Legal basis: performance of a contract (Article 6(1)(b)).
Specific provisions: the Controller does not process audio as biometric data within the meaning of Article 4(14) GDPR for the purpose of uniquely identifying a natural person. The microphone is active solely upon the User’s express activation. Audio may be buffered and stored temporarily for the purpose of performing speech recognition and is not retained for longer than reasonably necessary; text generated from speech is processed in accordance with Section 3.4. The User is responsible for ensuring that he or she is entitled to use the Service in situations in which the speech of third parties may be transmitted to the Service.

3.4 Conversations, Journal and Memory

Data processed: requests made by the User to the Service, Outputs and actions performed by the Service, the condensed journal generated therefrom and the User-specific long-term memory, including persons, matters, preferences and other information communicated by the User to the Service.
Purpose: maintenance of the core functionality of the Service, namely User-specific memory, and continuity of the Service between sessions.
Legal basis: performance of a contract (Article 6(1)(b)).
Retention: until the User deletes the individual entry, the memory or the user account, and thereafter for as long as necessary to cycle backups.

3.5 Context Read from the Device

Data processed: information read by the Service from the User’s device upon the User assigning a task, including, but not limited to, clipboard contents, identifiers of the active window and application, selected text, the target field and its formatting, user interface structure information (accessibility tree) and screenshots of the screen or part thereof.
Purpose: interpretation of the User’s request and direction of the action to the correct target in the correct format.
Legal basis: performance of a contract (Article 6(1)(b)).
Retention: context is transmitted to the AI Functionality for the duration of the task; to the extent context forms part of the conversation history or of Derived Material, Sections 3.4 and 3.13 apply.

3.6 Connected Services

Data processed: access tokens granted by the User in the authorisation interface of the Connected Service and content retrieved from Connected Services for the purpose of fulfilling the User’s request, including, but not limited to, messages, calendar entries, files and contacts. The Service may transmit the User’s requests, Outputs and instructions to a Connected Service in order to perform actions, and the Connected Service receives and processes them under its own terms. Certain Connected Services may remain accessible to the Service on an ongoing basis until the User disconnects them. Connected Services may include, among others, Gmail, Google Calendar, Google Drive and Docs, Google Chat, Discord, Notion and Linear; the Connected Services supported from time to time are indicated within the Service. To the extent the User uses the function whereby the Service drafts text in the User’s own writing style, the Service processes messages previously sent by the User as style samples and may store the style profile generated from them as Derived Material.
Purpose: performance of tasks requested by the User within Connected Services.
Legal basis: performance of a contract (Article 6(1)(b)).
Retention: access tokens are stored in encrypted form until the User disconnects the service or deletes the user account. Retrieved content is transmitted to the AI Functionality for the duration of the task and retained permanently only to the extent it forms part of the material referred to in Section 3.4. The User may also revoke the access granted through the settings of the relevant Connected Service.

3.7 Google User Data

The Controller’s use and transfer to any other app of information received from Google Workspace APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The Controller (i) uses Google user data solely to provide or improve User-facing features requested by the User which are visible in the user interface of the Service; (ii) transfers Google user data to third parties solely to provide or improve such features, for security purposes, to comply with applicable law, or as part of a merger, acquisition or sale of assets with the User’s explicit prior consent; (iii) does not use Google user data for advertising and does not sell or otherwise disclose it; (iv) does not use Google user data to create, train or improve generalised artificial intelligence or machine-learning models; and (v) does not allow humans to read Google user data except with the User’s explicit consent in respect of specific data, for security purposes (including the investigation of abuse or defects), to comply with applicable law, or in aggregated and anonymised form for internal operations.

3.8 Technical Data and Logs

Data processed: IP address and approximate location derived from it, type and version of the device and operating system, browser and referrer information, time zone, mobile operator or internet service provider, device, advertising, probabilistic and other unique identifiers, application version, dates and times of access, features used and links clicked, information about third-party applications and services the User interacts with through the Service, event, error and security logs, usage metrics (including the duration of speech recognition and the volume of AI Functionality usage), and, upon an error, information about the error, the time it occurred, the feature in use, the state of the application and the content being processed at the time of the error. The automatic update check of the application transmits the IP address and application version to the update server or distribution platform (for example an app store).
Purpose: provision, maintenance, operational reliability and security of the Service, prevention of abuse, usage-based billing and development of the Service on the basis of aggregated data.
Legal basis: the Controller’s legitimate interest (Article 6(1)(f)) in providing a functioning, secure and economically viable Service; in respect of billing, performance of a contract (Article 6(1)(b)).
Retention: for as long as necessary for the operation, security, billing and development of the Service.

3.9 Customer Service, Communications, Feedback and Research Participation

Data processed: name, email address and message content provided by the User upon contacting the Controller, and the contact history; Feedback provided by the User, including the entire related conversation stored upon the rating of an Output; and, where the User participates in the Controller’s research studies, surveys or interviews, the responses provided together with associated account and technical data. A conversation stored as Feedback is disassociated from the user identifier and may be used for the training and development of artificial intelligence models on all tiers.
Purpose: handling of enquiries, delivery of necessary notices concerning the Service (including changes to terms and payment failures), development of the Service and models on the basis of Feedback, research, and delivery of tailored recommendations and direct marketing to the User, including the marketing profiling referred to in Section 7.
Legal basis: performance of a contract (Article 6(1)(b)) and the Controller’s legitimate interest (Article 6(1)(f)), including in developing the Service and marketing its own services; in respect of electronic direct marketing, consent (Article 6(1)(a)) to the extent required by the Act on Electronic Communications Services, which the User may withdraw at any time in connection with each message.
Retention: for the duration of the matter and thereafter for as long as necessary to handle any follow-up enquiries and claims.
The email address, name, operating system, intended use, IP address and browser identification data (user agent) provided on the Early Access waiting list form are processed in order to allocate a place and to communicate about it; the legal basis is steps taken prior to entering into a contract (Article 6(1)(b)), and the data are deleted when the Early Access phase ends or when the User requests erasure.

3.10 Cookies

The website, applications and account management of the Service use cookies, scripts and similar technologies (hereinafter “Cookies”) to administer the Service, recognise the User, personalise the user experience, analyse use of the Service and market the Controller’s products and services. Cookies strictly necessary for sign-in and security do not require consent under section 205 of the Finnish Act on Electronic Communications Services (917/2014); for other Cookies the User’s consent is requested to the extent required by law, and the User may manage them in the cookie settings or in his or her browser settings. The Cookies in use from time to time and their purposes are indicated in the cookie settings of the Service.

3.11 Training and Development of AI Models (Free Plan)

Data processed: on the Free Plan, requests made by the User to the Service, Outputs and actions performed by the Service, and material derived therefrom. Google user data, content retrieved from Connected Services and context read from the device under Section 3.5 are not used for training.
Purpose: training, evaluation, testing and development of artificial intelligence models, classifiers and the Service by the Controller, its partners and the Suppliers referred to in Section 5; development of other products and services of the Controller; and research on artificial intelligence and its use, the aggregated, de-identified or anonymised findings of which the Controller may publish. The Controller may also train its models on material obtained from other sources, including publicly available material, datasets obtained under commercial agreements and material generated by the Controller itself.
Legal basis: the Controller’s legitimate interest (Article 6(1)(f)) in offering a free tier, the provision of which requires the exploitation of material generated by its use for development purposes. Development use is an integral condition of the Free Plan and cannot be disabled. A User who does not accept development use may move to a paid Subscription or delete the user account; the right to object under Section 9.1 is given effect accordingly.
De-identification: material taken into the Controller’s own development material is de-identified before use to the extent the development purpose permits; the method and extent of de-identification are determined at the Controller’s discretion, and de-identification is not a guarantee of non-identifiability. Material transmitted to Suppliers is processed by the Suppliers in accordance with their own terms.
Retention: the Controller’s development material is retained separately from the user account for as long as necessary for the development purpose. Deletion of the user account or transition to a paid Subscription ends the use of new material for development purposes but does not affect models already trained (Section 9.3).
On a paid Subscription, Content is not used for the purposes of this Section, save for processing under Section 3.12.

3.12 Security and Abuse Monitoring

Data processed: Content, Outputs, actions and associated technical data flagged as suspicious in the course of automated and, where necessary, manual monitoring of the Service, on all tiers.
Purpose: detection, investigation and prevention of security threats, abuse, breaches of the Terms and unlawful use; protection of the Service, its users and third parties; training and development of safety and classification models; compliance with statutory obligations; and the establishment, exercise or defence of legal claims. Google user data may be investigated for security purposes but is not used for the training of models. Flagged material used for training is disassociated from the user identifier; the Controller is however entitled to re-identify the material to the User in order to monitor and enforce the Terms.
Legal basis: the Controller’s legitimate interest (Article 6(1)(f)) and compliance with a legal obligation (Article 6(1)(c)) to the extent required by applicable law; where necessary, protection of the vital interests of the Data Subject or another natural person (Article 6(1)(d)).
Retention: for as long as necessary to investigate the matter, prevent repeat abuse and handle any claims; material flagged as suspicious may be retained for longer than other material.

3.12a Age and Identity Verification

Data processed: where the Controller requests the User to verify his or her age or identity under Section 4.6 of the Terms, depending on the verification method, an image of an official identity document and the information appearing on it, an image or video of the User, facial geometry templates which may constitute biometric data within the meaning of Article 9 GDPR, and the result of the verification.
Purpose: ensuring compliance with the age limit and the Terms, prevention of fraud and abuse.
Legal basis: the Controller’s legitimate interest (Article 6(1)(f)); in respect of biometric data, the User’s explicit consent (Article 9(2)(a)), given by the User’s selection of a biometric verification method.
Retention: for as long as necessary to complete the verification and evidence its result.

3.12b Aggregation and De-identification

The Controller applies the principle of data minimisation by aggregating and de-identifying personal data where appropriate, and may process personal data in aggregated or de-identified form to analyse and improve the Service, to conduct research, to study user behaviour and to train artificial intelligence models to the extent permitted by applicable law. The Controller maintains and uses de-identified material in de-identified form and does not attempt to re-identify it, except as permitted by law or as provided in Section 3.12.

3.13 General Retention Principle

The Controller retains personal data for as long as reasonably necessary for the purposes described in the Policy and thereafter for as long as required by applicable law, by an order of a competent authority or for the establishment, exercise or defence of legal claims. The retention periods stated in Sections 3.1 to 3.12 are applications of this principle.

4. Special Categories of Personal Data

4.1 The Service does not require or request special categories of personal data within the meaning of Article 9(1) GDPR, including data concerning health, religious or political beliefs, sexual orientation or ethnic origin.

4.2 The User independently determines what information he or she provides to the Service. To the extent the User provides special categories of personal data to the Service or instructs the Service to process such data from Connected Services, the User thereby gives his or her explicit consent within the meaning of Article 9(2)(a) GDPR to the Controller processing such data for the purpose of performing the task requested by the User and maintaining User-specific memory in accordance with the Policy. Such data are processed in the same manner as other Content. The User may withdraw consent by deleting the relevant data from memory or by deleting the user account; withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

5. Recipients of Personal Data

5.1 Processors. The Controller uses Suppliers in the following categories in the provision of the Service, which process personal data on behalf of the Controller under agreements compliant with Article 28 GDPR. The list of Suppliers in use from time to time is available at psypen.app/subprocessors. The Controller is entitled to replace and add Suppliers by updating the list; material changes are notified within the Service before taking effect.

5.2 AI Suppliers. Suppliers of speech recognition, language models and speech synthesis process and retain material transmitted to them in accordance with their own contractual terms, including, but not limited to, for the provision of the service, security and abuse monitoring and compliance with statutory obligations, and processing may take place within the EU or outside it under a transfer mechanism referred to in Section 6. On a paid Subscription the Controller uses Supplier services under such terms and settings as, according to the Supplier’s own representation, exclude the use of the material for the training of generalised models. On the Free Plan material may be used for training in accordance with Section 3.11. The Controller assumes no responsibility for the content of or changes to Suppliers’ terms.

5.3 Connected Services. The providers of Connected Services are not processors of the Controller but independent controllers, which the Service accesses under the User’s authorisation and whose processing is governed by the terms and privacy practices of the relevant service.

5.4 Other Recipients. The Controller may disclose personal data (i) to public authorities, courts, law enforcement and other parties where the Controller believes in good faith that disclosure is reasonably necessary to comply with applicable law, regulation or legal process, including for tax and accounting purposes, to prevent serious harm to any person or property, to detect or prevent fraud or other unlawful activity, or to protect the rights, property or safety of the Controller, its users or third parties; (ii) to its group companies and affiliates; (iii) to its legal, financial and other advisers, auditors and assessors of industry standards and compliance; (iv) to service providers and business partners for purposes including data hosting, research, auditing, data processing, investigation of security and abuse incidents and provision of the Service; (v) at the User’s direction or with the User’s consent, including to Connected Services as part of the operation of the Service; and (vi) in connection with, or in preparation for, a corporate transaction, merger, demerger, bankruptcy or transfer of its business or any part thereof, to the acquirer or other party to the transaction. The User’s explicit prior consent is obtained for the transfer of Google user data in the circumstances referred to in item (vi).

6. Transfers of Personal Data outside the European Economic Area

The Controller’s servers and databases are located within the European Union. Certain Suppliers process personal data outside the European Economic Area, in particular in the United States. Transfers are carried out in accordance with Chapter V GDPR (i) on the basis of an adequacy decision of the European Commission (Article 45), including the EU–US Data Privacy Framework in respect of Suppliers certified thereunder and the adequacy decision in respect of Switzerland, (ii) on the basis of standard contractual clauses adopted by the European Commission (Article 46(2)(c)) supplemented by such additional safeguards as may be necessary, or (iii) in individual cases on the basis of the derogations in Article 49 GDPR, including where the transfer is necessary for the performance of the contract with the User. The Data Subject may request further information on transfer safeguards from the address stated in Section 2.1.

7. Automated Decision-Making and Profiling

Outputs and actions of the Service are generated by means of AI Functionality. The Controller does not make decisions concerning the Data Subject based solely on automated processing which produce legal effects concerning the Data Subject or similarly significantly affect him or her within the meaning of Article 22(1) GDPR. The Controller may profile the Data Subject for marketing purposes, including, but not limited to, on the basis of the User’s account, Subscription and usage data and data generated from the use of the Service, in order to target tailored recommendations and direct marketing. Google user data referred to in Section 3.7 are not used for marketing profiling. Profiling is based on the Controller’s legitimate interest (Article 6(1)(f)) and, in respect of electronic direct marketing, on consent under Section 3.9 to the extent required by law. The Data Subject has the right to object at any time to the processing of personal data concerning him or her for direct marketing purposes, including profiling to the extent that it is related to such direct marketing (Article 21(2)), in which case the personal data shall no longer be processed for such purposes.

8. Security

The Controller implements appropriate technical and organisational measures in accordance with Article 32 GDPR to protect personal data, including encryption of data in transit (TLS), encryption of data at rest, encrypted storage of access tokens for Connected Services, role-based access control to production systems and logging. Personal data breaches are notified to the supervisory authority and to the Data Subject in accordance with Articles 33 and 34 GDPR.

9. Rights of the Data Subject

9.1 The Data Subject has, in accordance with and subject to the conditions and limitations of Chapter III GDPR, the right (i) of access to personal data concerning him or her (Article 15); (ii) to rectification of inaccurate or incorrect data (Article 16); (iii) to erasure of his or her data (Article 17); (iv) to restriction of processing (Article 18); (v) to data portability in respect of data provided by the Data Subject (Article 20); (vi) to object to processing based on legitimate interest on grounds relating to his or her particular situation (Article 21(1)); (vi a) to object at any time to the processing of his or her personal data for direct marketing purposes, including profiling related thereto (Article 21(2) and (3)); and (vii) to withdraw consent at any time to the extent processing is based on consent (Article 7(3)).

9.2 The Data Subject may exercise his or her rights primarily through the functions of the Service to the extent the Service offers such functions from time to time (for example browsing and deletion of memory, data export and deletion of the user account) and otherwise by submitting a request to the address stated in Section 2.1. The Controller is entitled to require the Data Subject to verify his or her identity before a request is fulfilled by requesting information sufficient to confirm identity. The Controller responds to requests within one month of receipt; where a request is complex or requests are numerous, the period may be extended by up to two further months in accordance with Article 12(3) GDPR. The Controller is entitled to decline a request where it has a lawful basis to do so, and to charge a reasonable fee or refuse to act where requests are manifestly unfounded or excessive. The Controller does not discriminate against the Data Subject for exercising his or her rights.

9.2a Limitation of the Right to Object. Where the Data Subject objects to processing based on legitimate interest, the Controller ceases the processing unless it can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the Data Subject, or unless the processing is necessary for the establishment, exercise or defence of legal claims (Article 21(1)). This Section does not apply to objections to processing for direct marketing purposes.

9.2b Rectification of Outputs. The Controller does not guarantee the factual accuracy of Outputs. Where an Output contains inaccurate personal data relating to the Data Subject, the Data Subject may submit a rectification request and the Controller will make reasonable efforts to correct the information; owing to the technical nature of language models, however, correction may not be possible in all cases.

9.3 Implementation of the Right to Erasure and Limitations of Rights. The right to erasure applies exclusively to personal data. When the Data Subject exercises the right to erasure or deletes his or her user account, the Controller deletes or de-identifies the personal data relating to the Data Subject from the User Material and the Derived Material, manually where necessary, such that the remaining material can no longer be linked to the Data Subject. The remaining Derived Material, cleansed of personal data, is not personal data, and the Controller is entitled to retain and use it in accordance with Section 7.3 of the Terms without limitation in time. The rights of the Data Subject do not extend to (i) data which the Controller is under a statutory obligation to retain or which are necessary for the establishment, exercise or defence of legal claims (Article 17(3)); (ii) material which has been de-identified such that it can no longer be linked to the Data Subject; or (iii) artificial intelligence models, classifiers or other systems for the training, evaluation or development of which the Data Subject’s data have been used in accordance with Sections 3.11 or 3.12. The exercise of the right to erasure or the withdrawal of consent terminates the use of the Data Subject’s data for further training but does not oblige the Controller or its Suppliers to retrain, decommission or remove the influence of the Data Subject’s data from models already trained, such removal being technically impossible or requiring disproportionate effort.

9.4 The Data Subject has the right to lodge a complaint with a supervisory authority. In Finland the competent supervisory authority is the Office of the Data Protection Ombudsman (www.tietosuoja.fi).

10. Age Limit

The Service is intended exclusively for adults. The Controller does not verify the User’s age by default and does not knowingly process the personal data of persons under eighteen (18) years of age, but is entitled to take measures to detect and remove minors from the Service, including verification under Section 3.12a. Upon becoming aware that a User is a minor, the Controller deletes the user account and the associated data in accordance with Section 3.13 and Section 12 of the Terms.

11. Amendment of the Policy

The Controller is entitled to amend the Policy at its discretion upon changes to the Service, applicable law or processing operations. Material amendments are notified to the User by appropriate means, and the effective date of the Policy is updated. Continued use of the Service after an amendment has taken effect constitutes acceptance of the amended Policy to the extent processing is based on a ground other than consent. Changes of Suppliers are recorded in the list referred to in Section 5.1. Should Google user data be used for a purpose not described in the Policy, the Controller shall obtain the User’s approval before commencing such use. Continuous background recording does not form part of the Service; should such functionality be added, the Policy will be updated before its release and the functionality will be disabled by default.