We try to keep Aivoin privacy-first and proportionate. That means collecting as little personal data as we can while still operating, securing, and improving the service.
1. Controller
The controller for personal data covered by this policy is Uovo Labs Oy, operating under the Aivoin brand.
2. What we collect
Depending on how you interact with Aivoin, we may collect:
- Beta signup data: your email address, submission time, and coarse acquisition details such as source, campaign, page variant, and which signup button you used.
- Marketing and contact preference data: when you ask to hear from us about the beta or launch.
- Website analytics data: aggregate page visits, referrers, country, browser, device type, and campaign parameters such as UTM tags.
- Security and anti-abuse data: hashed IP-based rate-limit identifiers, user-agent information, request metadata, and operational logs.
- Service data: if you use the product, this may include work email, name, organisation details, learner progress, training completions, and Training Record exports.
3. Why we use it
We use personal data to:
- run the website and beta signup flow;
- contact people who asked to join or hear about the beta;
- send magic links and service messages;
- deliver training, track completions, and generate Training Records;
- prevent abuse, protect the service, and debug problems;
- understand basic demand and improve the service.
4. Legal bases
We rely on one or more of these legal bases under the GDPR:
- Steps before a contract or performance of a contract when you ask to join the beta or use the service.
- Legitimate interests for security, fraud prevention, rate limiting, service operations, limited analytics, and product improvement.
- Consent where we rely on it for optional outreach or future optional features that require consent.
- Legal obligation when we must retain or disclose data to comply with the law.
5. Cookies and analytics
Aivoin uses GoatCounter for aggregate website analytics. GoatCounter does not use cookies, persistent identifiers, or personal-data tracking. It helps us understand page visits, referrers, devices, countries, and basic campaign data.
- We do not use Google Tag Manager, GA4, remarketing pixels, or heatmaps.
- We do not use non-essential marketing cookies on the landing page.
- We may process campaign parameters such as UTM tags so we can understand which channels brought visitors to the site. We accept only short, restricted values and do not forward arbitrary URLs or query parameters.
- We measure signup-button clicks and aggregate signup stages. We do not use a cross-site visitor identifier to join an individual website visit to an account.
Essential technical storage or requests may still be used where needed for security, request handling, and service functionality.
6. Sharing
We do not sell personal data. We may share data with service providers and infrastructure partners only when needed to operate Aivoin, such as hosting, analytics, email delivery, or security support.
Current subprocessors: We currently use Scaleway SAS as our cloud hosting and infrastructure provider. According to Scaleway's official legal notice, Scaleway SAS is a simplified joint stock company registered in Paris, France, with its registered office at 8, rue de la Ville-l'Évêque, 75008 Paris, France.
We also use GoatCounter for website analytics. GoatCounter is operated from Ireland and stores analytics data on Hetzner servers in Finland and Germany. The service stores aggregate analytics rather than individual raw pageviews. We do not send email addresses, names, company names, or form contents to GoatCounter.
In practice, Scaleway may process personal data on our behalf when that data is stored, transmitted, backed up, or secured through the infrastructure we use to run Aivoin.
We may also disclose data when required by law, to protect rights and safety, or as part of a merger, acquisition, or reorganisation.
7. Retention
We keep data only for as long as it is reasonably needed for the purpose it was collected for, including support, security, recordkeeping, and legal needs.
- Beta signup and its coarse acquisition details are kept while we are running or following up on the beta, then reviewed for deletion or anonymisation.
- Operational logs and anti-abuse data are kept for shorter periods where possible.
- If the full service is used, training and record data may be kept longer where needed to provide the service and maintain audit trails.
8. International transfers
Our aim is to keep Aivoin data handling within Europe where practical. If we use providers outside the EEA, we will use appropriate safeguards required by law. At the moment we are using European hosting services for our training service, including Scaleway in France.
9. Your rights
Depending on your situation and the law that applies, you may have the right to:
- access your personal data;
- correct inaccurate data;
- request deletion;
- restrict or object to certain processing;
- receive a portable copy of data you provided;
- withdraw consent where processing is based on consent;
- complain to a supervisory authority.
10. Children
Aivoin is meant for business and workplace use. It is not intended for children.
11. Changes
We may update this policy as the beta evolves or the service changes. When we make material changes, we will update the date on this page and, where appropriate, provide additional notice.
12. Contact
Aivoin is offered by Uovo Labs Oy. If you want to ask about this policy or exercise your privacy rights, please contact support@northstarokr.app
This policy describes the current landing page and beta approach. If the product expands to handle broader learner, admin, or record workflows, this page will be updated with more detailed retention, subprocessors, and contact information.