# Haihtuva Privacy Notice for Users
Version 1.1 (final)
Effective date: 13 October 2026
This version differs from the previous one only in the product's name: the service previously called Sealroom is now called Haihtuva. No term, right or obligation has changed.
## 1. Who is responsible
Biotech Start-Up Management Oy ("BSUM"), Business ID 2574531-6, Vanhatie 70, 86100 Pyhäjoki, Finland. Contact: the privacy contact published at www.bsum.fi (at the effective date: juhani.lahdenpera@bsum.fi).
This notice covers the personal data of Users that the Haihtuva Service processes about their accounts, acceptances, access and security. Personal data inside documents and results is processed for the Customer, which is its controller, under Schedule 1 of the Haihtuva Terms of Service.
## 2. What data and why
- Account data (name, e-mail address, organisation, role, authentication data): to give and secure access. Basis: the agreement with the Customer and BSUM's legitimate interest in running a secure service.
- Acceptance records (who accepted which document version and when, with a fingerprint of the exact text): to evidence the agreement. BSUM keeps a content-free copy as controller. Basis: legitimate interest in establishing and defending legal claims.
- Access and security logs (sign-ins, pages opened, downloads, use of AI functions without their content, network address): to protect documents, trace misuse and investigate incidents. Basis: legitimate interest in the security of the Service and of the parties' confidential information.
- Watermarks on protected pages (name, organisation, date and time, Room and an access number): to deter and trace unauthorised copies. Basis: as above.
- Misuse monitoring of content-free activity patterns (for example unusually rapid page access, simultaneous sessions, unusual sign-in locations): to detect misuse. It does not use the content of documents, questions or results.
- Billing contact data where a Customer pays: to invoice and collect payment. Basis: the agreement and legal accounting obligations.
## 3. Who sees it
- The User sees their own access history. The User's own organisation's administrators see access and security information about their own Users.
- The Seller sees only which of its documents each Buyer organisation opened, not who, which pages or for how long, and never Buyer questions, notes, searches or reports unless the Buyer shares them.
- BSUM receives content-free records: acceptances, usage counts and security alerts. BSUM personnel do not get the content of documents, questions or results through the Service.
- Sub-processors: Microsoft (Azure hosting, confidential computing, key management, e-mail, and AI models hosted by BSUM, in the EU region stated in the Room's Security Specification) and, for card payments, Stripe. Signed, content-free evidence may be given to a party or authority to investigate or enforce a suspected breach, as described in the Platform and Room Use Rules.
## 4. How long
- Access and security logs: 12 months, or until the Room closes if earlier, except content-free records kept at close under the Terms.
- Network addresses: 90 days.
- AI-use event logs: 12 months, or until the Room closes if earlier.
- Misuse alerts: 12 months.
- Acceptance evidence: 10 years after the Room closes.
- Records preserved for a suspected breach: until the matter is closed.
## 5. Transfers
Data is processed in the EU. If a Customer chooses a model provider or storage outside the EU/EEA under its own account, that transfer is the Customer's choice and responsibility.
Some models BSUM provides are processed outside the EU/EEA: Claude models provided by BSUM on Microsoft Azure are processed in the United States. They are used in a Room only when the Room's Security Specification names them and both sides approve it. For that processing Microsoft acts as BSUM's sub-processor under its data protection terms, and the model's developer may process the data as described in the Microsoft terms for that model; transfers rely on the EU-US Data Privacy Framework or standard contractual clauses as applicable. Documents of a Room that uses an EU-processed model never leave the EU.
## 6. Your rights
You may request access to and correction of your personal data, and, where the law allows, erasure, restriction or object to processing based on legitimate interest. Contact BSUM as above. Requests about personal data in documents or results go to the Customer that controls them. You may also lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi).
## 7. Changes
BSUM may update this notice. The current version is available in the Service.