Privacy policy
How we collect, use and protect personal data. Last updated: 2025-05-15.
Controller
Airfra Oy (Airfra AI), Espoo, Finland. Contact: igor@airfra.com .
Data we process
We process the personal data you provide when contacting us, signing up, or using our services: name, work email, phone number, employer, role, message content and product usage telemetry. For customers, we process the personal data you transmit to the service as your data processor, under our DPA.
Purposes & legal bases
We process personal data to (a) provide and operate the service (contractual necessity, art. 6(1)(b) GDPR); (b) communicate with prospects and customers (legitimate interest, art. 6(1)(f)); (c) comply with legal obligations (art. 6(1)(c)); and (d) where required, on the basis of consent (art. 6(1)(a)).
Storage & residency
By default, customer data is stored on Microsoft Azure North Europe (Ireland). Other regions are available on request for enterprise customers.
Sharing
We do not sell personal data. We share data with sub-processors strictly required to operate the service (hosting, analytics, support tooling). A current list is available on request.
Retention
We keep personal data only as long as needed for the purposes above and as required by law. Customer data is deleted on contract termination per the DPA terms.
Your rights
Under GDPR you can access, correct, delete, restrict or port your personal data, and object to processing. To exercise these rights, email igor@airfra.com . You may also lodge a complaint with the Finnish Data Protection Ombudsman.
Security
We use encryption in transit and at rest, role-based access, audit logging, MFA and regular security reviews. Customers can request our security overview under NDA.
Changes
We will publish material changes to this policy on this page and, where appropriate, notify customers directly.
Contact
Privacy questions or rights requests: igor@airfra.com .