About working together
Privacy notice
What personal data I process, why, and what rights you have.
Updated October 5, 2026
1. Controller and contact details
The controller of your personal data is Jelena Alanko, who operates under the name AIGhostTools as a light entrepreneur (kevytyrittäjä) in Finland. Invoicing is handled by UKKO.fi.
- Controller
- Jelena Alanko (AIGhostTools)
- Business form
- Light entrepreneur, domiciled in Seinäjoki, Finland
- Invoicing
- UKKO.fi (the invoicing company's official business details appear on each invoice)
- Postal address
- Provided on request.
2. What this notice covers
This notice covers personal data I process through the aighosttools.com website, enquiries, the newsletter, proposals, client projects and invoicing.
When I build an automation in a client's own environment, the client is usually the controller of that personal data and I process it on the client's behalf. In that case, we sign a data processing agreement before work starts, setting out the roles, the data involved and the safeguards.
3. What data I process
- Contact form
- Your email address, company name, a description of the work you want to automate and any optional details you give, such as the apps you use. Also the form language, your optional permission to receive the newsletter and your IP address, which is used only for the bot-protection check.
- Email messages
- The sender's name and email address and the content of the messages.
- Newsletter
- Your email address, optional first name, language (Finnish or English), the time you subscribed and whether you have unsubscribed. Also delivery data and, where enabled, opens and link clicks (see section 5).
- Proposals and projects
- The contact person's name, work email, phone number and job title, company details, proposals, approvals and project communication. Temporary access to the client's systems needed during the project.
- Invoicing
- The company and contact details needed for invoicing, plus invoice and payment data.
- Website technical data
- Technical data processed by the server and Cloudflare, such as IP address, browser details, the page requested and the time.
Please don't send passwords, health data or other sensitive information through the form or by email. We agree separately on a secure way to share project access.
4. Purposes and legal bases
- Replying to enquiries and preparing proposals
- I reply to your message, check whether the work fits the service and prepare a proposal. Legal basis: steps taken at your request before entering into a contract, and my legitimate interest in replying to business enquiries.
- Delivering a project
- Planning, building, testing and handing over the agreed work. Legal basis: performance of a contract.
- Invoicing and accounting
- Invoicing and keeping records required by law. Legal basis: contract and legal obligations.
- Newsletter
- I send the newsletter you subscribed to. You can subscribe through the blog sign-up form or by ticking a separate box on the contact form. The box is never pre-ticked. Legal basis: your consent, which you can withdraw at any time.
- Website and form security
- Preventing spam and misuse and keeping the server running. Legal basis: my legitimate interest in keeping the services secure.
- References
- Finished client work is shown only with the client's separate permission. Legal basis: consent, which can be withdrawn.
I don't make decisions based solely on automated processing that have legal or similarly significant effects on you, and I don't sell personal data.
5. Newsletter
Subscribing is optional and isn't required to contact me or buy the service. After you subscribe, you get a welcome email. After that, I send at most one newsletter a week about new blog articles.
You can unsubscribe at any time with the link at the end of the welcome email and every newsletter, or by emailing hello@aighosttools.com. Once you unsubscribe, you won't receive the newsletter again.
Newsletters are sent through Brevo. Brevo records delivery, and with its default settings it may measure opens and link clicks. I use this data only in aggregate to improve the newsletter. You can block open tracking through your email app's image settings.
6. AI-assisted tools
I use AI-assisted tools to support research, drafting, coding and review. I give them only the data a task needs, and I don't enter passwords, sensitive data or unnecessary identifiable personal data.
If a client project requires processing personal data in an AI service, we agree on the purpose, the data and the service in advance and record them in the data processing agreement. I personally review all deliverables before handover.
7. Service providers and recipients
I use the following service providers. Each receives only the data its task requires.
- Contabo GmbH
- Server for the website and my own n8n automation platform. The server is located in the EU.
- n8n (self-hosted)
- Processing form submissions and newsletter sign-ups. Runs on my own server at Contabo.
- Cloudflare, Inc.
- Domain name service, website protection and delivery, bot protection for forms (Turnstile) and email forwarding. United States.
- Brevo (Sendinblue SAS)
- Newsletters, subscriber lists, storing enquiries and email notifications. France (EU).
- Google LLC
- Receiving email and client communication (Gmail), and a backup system for the contact form (Google Forms) that stores form data only if the primary processing is unavailable. United States.
- UKKO.fi
- Invoicing and payments. Finland.
- AI services
- For example Anthropic, OpenAI, Google and Groq, depending on the task and within the limits in section 6. Mainly United States.
In client projects, data is processed in the client's own services, such as the client's n8n Cloud account and the software the client has chosen. Authorities or professional advisers may receive data where the law requires it or where it's needed to establish, exercise or defend legal claims.
8. Transfers outside the EU
Some providers (Cloudflare, Google and AI services) may process data in the United States. These transfers rely on the EU–US Data Privacy Framework where the provider is certified under it, or on standard contractual clauses approved by the European Commission. You can ask me which safeguard applies to a specific provider.
9. How long data is kept
- Enquiries
- Up to 12 months from the last contact if no client relationship follows. Contact form data is then deleted automatically. If you gave permission to receive the newsletter, I keep your email address for the newsletter until you unsubscribe. Data stored in the backup system is moved into regular processing and deleted from the backup within 30 days.
- Project records
- Up to 3 years after the project ends, unless longer retention is needed for a legal claim.
- Project working data and access
- Temporary access to client systems is removed when it's no longer needed. Client data used in the work is deleted or returned within 30 days of handover and the agreed correction round.
- Invoicing records
- For the period required by accounting and tax law. UKKO.fi keeps invoicing records under its own legal obligations.
- Newsletter
- For as long as your subscription is active. After you unsubscribe, I keep only a record of the unsubscription so I don't email you again.
- Form processing logs
- Execution logs on the automation platform are deleted automatically after about 14 days.
- Server logs
- Website server logs are kept for up to 30 days.
10. Cookies and local storage
The website doesn't use analytics or marketing cookies. Cloudflare may set strictly necessary cookies to protect the site, and the form's bot protection (Cloudflare Turnstile) processes technical browser data to prevent spam. Strictly necessary cookies don't require consent.
11. Security
I limit access to personal data to what the work requires. I use strong authentication on accounts where it's available, and connections to the website and forms are encrypted. Still, no method of transfer or storage can be promised to be completely secure.
12. Your rights
Depending on the situation, you have the right to:
- access your personal data and know how it's used
- have inaccurate or incomplete data corrected
- ask for your data to be erased or its processing restricted
- object to processing based on legitimate interest, and always to direct marketing
- receive your data in a portable format where processing is based on consent or contract
- withdraw your consent at any time. Withdrawal doesn't affect the lawfulness of earlier processing.
Send your request to hello@aighosttools.com. I'll reply within one month. For complex requests, this can be extended by up to two further months, and I'll let you know. I may ask you to confirm your identity.
You also have the right to lodge a complaint with a supervisory authority. In Finland, this is the Office of the Data Protection Ombudsman, tietosuoja.fi. You can also contact the authority in your own EU country.
13. Do you have to provide data?
Providing data is voluntary. Without an email address, though, I can't reply to an enquiry or send the newsletter, and a contract can't be made without the details needed for invoicing.
14. Changes and language versions
I update this notice when processing, service providers or the law change. The date of the latest update is shown at the top of the page. I'll notify clients and newsletter subscribers of material changes by email.
This notice is available in Finnish and English. Both versions have the same content.