How your information is handled

For visitors who submit a Toimii-powered form

A business used a Toimii form to collect this information from you. This page explains what happens to it.

Who's responsible for your information

The business that runs the form is the data controller — they decide what's collected and how it's used. Toimii is the data processor: we provide the form and store your submission securely on the business's behalf, acting only on their instructions.

What's collected

When you submit the form, Toimii processes:

• The form field values you enter (name, email, message, and any other fields the business set up)
• Your IP address — kept for 30 days so the business can investigate spam or abuse, then deleted.
• Your browser's user agent — used to filter out automated spam, then deleted alongside the IP address after 30 days.
• The address of the page the form was on, and the moment you started filling it in — used to tell a real visitor from a bot.

Where it's stored

All submissions are stored in the EU, on AWS Europe (Stockholm).

No selling, no ads, no tracking

Toimii doesn't sell your data, show you ads, or track you across the web. Your submission is used only to deliver it to the business and to run the service.

AI and your submission

What you type is never sent to an AI model. The business may have used an AI assistant to draft the form's fields and labels before publishing it, but your answers go only to them — they aren't used to generate content, train a model, or score you automatically.

How long it's kept

The business controls how long your submission is kept. They can delete it at any time, and all data is removed within 30 days of the business closing its Toimii account.

• Your IP address and browser user agent are deleted 30 days after you submit. What you wrote stays with the business; the technical details about your connection do not.
• A submission caught by the spam filter is deleted outright after 90 days. Quarantine is not an archive.
• If you reply to an email from the business, the raw email file is kept for 90 days as a fallback in case the reply was displayed incorrectly. The text of your reply stays with the conversation.

Your rights

Under the GDPR, you can ask to see, correct, or delete your data. Because the business is the data controller, contact them first — they handle these requests, and Toimii assists them as their processor. You also have these rights:

• Right of access — request a copy of your data
• Right to rectification — correct inaccurate data
• Right to erasure — request deletion of your data
• Right to lodge a complaint with the Finnish Data Protection Ombudsman (tietosuojavaltuutettu)

Contacting Toimii

For questions about Toimii's role as the data processor, you can reach us at:

Toimii Digital
Email: support@toimii.io

Last updated: August 31, 2026