Privacy Policy

Rekisteriseloste / Privacy Policy

Data Controller

Toimii Digital
Private trader (sole proprietorship)
Business ID: 2501710-8
Vantaa, Finland
Email: support@toimii.io

What data we collect

Account data

When you sign up, we collect the following through Google or Apple sign-in:

• Email address
• Display name
• OAuth provider identifier

Component settings

Settings you create for your components: field definitions, look, and behavior options.

Submission data

Form responses submitted by visitors on your website through Toimii components:

• Form field values (name, email, message, etc. — as configured by you)
• Submitter's IP address
• Browser user agent

Why we collect this data

• To provide and run the Toimii service
• To deliver form submissions to you
• To send email notifications for new submissions
• To improve the service and fix bugs

Legal basis

• Contract performance — your account data is needed to provide the service
• Legitimate interest — submission data is processed on your behalf to deliver the service

Data storage

All data is stored in the EU, on AWS Europe (Stockholm).

Data sharing

We don't sell your data, show ads, or run analytics tracking. To run the service we rely on a short list of sub-processors:

• AWS (EU — Stockholm) — hosting, sign-in, email, and the AI features
• Stripe — payments and subscription billing
• Sentry (EU) — error reports, with form content deliberately excluded
• Cloudflare (US) — the invisible bot check on our demo page, nothing else (Turnstile Privacy Addendum)

The bot check runs only when someone opens the demo on our own site. It never runs on your website, and never on a form your visitors fill in.

Nothing else, and never for advertising.

AI features

Three dashboard features use AI. They run on AWS Bedrock in the EU (Stockholm), and they only ever see what you write yourself:

• Form generation — the description you type into "Generate with AI" is sent to the model, which drafts the fields and labels. You review and edit the result before anything is published.
• Field translation — the labels and messages you wrote are sent to the model and returned in another language.
• Brand themes — the public design details (colours, fonts) read from your own website address are sent to the model, which suggests a matching theme.

Your visitors' form submissions are never sent to an AI model — not for generation, not for translation, not for spam filtering. Spam scoring is plain rules, no AI.

AWS Bedrock does not use these prompts to train models and does not retain them after the request completes.

Cookies

Toimii uses one session cookie for sign-in. No marketing cookies, no analytics cookies, no third-party tracking.

Data retention

• Account data is kept while your account is active
• Submission data is kept per your preferences and can be deleted anytime
• All data is deleted within 30 days of account closure

Your rights

Under the GDPR, you have these rights:

• Right of access — request a copy of your data
• Right to rectification — correct inaccurate data
• Right to erasure — request deletion of your data
• Right to data portability — receive your data in a portable format
• Right to lodge a complaint with the Finnish Data Protection Ombudsman (tietosuojavaltuutettu)

Embedded components and data processing

When you embed a Toimii component on your site, you are the data controller for your visitors' submissions. Toimii acts as a data processor on your behalf and shows your visitors a standard privacy notice describing how their data is handled. You remain responsible for making sure your visitors are appropriately informed, and can add your own privacy policy if your use requires it.

Changes to this policy

We'll notify you of material changes via email. Minor clarifications may be made without notice.

Last updated: August 3, 2026