GSafe← Back to Home
GSAFEAI

Privacy Policy (BETA)

Last Updated: May 2026

1. Introduction

Welcome to GsafeAI (“we,” “us,” or “our”). We respect your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use, and safeguard your information when you use our website and our AI-powered ship safety and regulatory compliance platform GSafeAI beta version (the “Service”).

The data controller for the personal data described in this policy is GSafe.ai Oy, registered in Finland, with its registered office in Helsinki. Where we process personal data on behalf of a customer (for example, end-user account data within a customer workspace), we act as a processor under a separate Data Processing Addendum.

2. Data We Collect

We only collect and process personal data that is necessary for us to provide our services.

a. Information You Provide

Account Data: Name, email address, company name, job title, and password (encrypted and never stored in plain text) when you register for the Beta.

User Content: Vessel information, vessel documents, safety records, inspection data, and queries you input into the GSafeAI platform (e.g., safety compliance queries, safety assessments, compliance workflows). If you choose to import documents via Google Drive, we access only the specific files you explicitly select using the drive.file scope - we do not access any other files in your Drive.

Beta Feedback: Responses to surveys, bug reports, and feature requests you submit during the testing phase.

b. Information Collected Automatically

Usage Logs: Timestamps, click paths, features used, and dwell time.

Technical Data: IP address, browser type, device information, and operating system.

AI Interaction Data: Metadata regarding your interactions with the AI (e.g., query length, response latency, error rates).

3. How We Use Your Personal Data

We use your personal data for the following purposes:

  • To Provide the Service: To grant access to the Software, manage your account, and deliver the service you have requested (delivering safety and regulatory compliance workflows through the platform).
  • To improve the Beta Product: To analyse the performance of our product (fixing bugs, analysing stability, speed), and to identify opportunities for improvement and to develop new features.
  • To communicate with you: To send service-related notifications, updates, security alerts.
  • For Marketing: To send information about our products and services that we believe may be of interest, based on your preferences. You may opt out at any time via the unsubscribe link in any marketing email or by contacting [email protected]
  • For Legal Compliance: We may disclose your personal data if required by law or in response to valid requests by public authorities (e.g., a court or government agency).

AI Model Training & Confidentiality

Our policy on AI training is as follows:

No Training on Private Documents: We do not use the documents, prompts, completions, embeddings, or audit data associated with your account to train, fine-tune, or otherwise improve any general-purpose AI model, whether ours or a third party’s. Your private documents remain isolated to your workspace.

Zero Retention with LLM Providers: In the case of Cloud Deployment, where we use third-party Large Language Model APIs (e.g., Azure OpenAI Service, Amazon Bedrock), those providers are contractually bound to zero data retention and are prohibited from using your data to train their foundation models.

Service Improvement: We may use anonymized interaction data (e.g., the types of queries and the relevance of our answers, the automated workflows accuracy…) to improve the accuracy of our regulatory and safety guidance.

4. Your Rights

Under the EU General Data Protection Regulation (GDPR), the Finnish Data Protection Act, and equivalent laws, you have the right to:

  • Access your personal data.
  • Correct inaccurate or incomplete data from your profile settings.
  • Delete ("Right to be Forgotten") your personal data, subject to legal retention requirements.
  • Object to processing based on legitimate interests.
  • Export your data.
  • Opt-out of marketing communications.
  • Lodge a complaint with the Finnish Data Protection Ombudsman (Tietosuojavaltuutettu, tietosuoja.fi) if you believe your personal data has been processed in violation of applicable data protection law.

To exercise these rights, please contact us at [email protected]

5. Beta Program Specifics

By participating in our Beta, you acknowledge that:

  • The Service may contain bugs or errors. We may review anonymized logs more frequently to diagnose errors.
  • Data availability is not always guaranteed during the Beta phase.
  • We may reach out to you specifically for feedback regarding your experience.

6. Data Security

We implement industry-standard security measures to protect your data, including:

Encryption: Data is encrypted in transit (TLS) and at rest.

Access Control: Strict role-based access control (RBAC) for our internal team and regular security assessments.

Data Minimization: Personal data is retained for a maximum of 12 months from collection, or for such shorter period as the Beta program requires, unless a longer retention period is required by applicable law. You may request deletion at any time by contacting [email protected].

While we strive to protect data to the highest standards, no method of transmission over the Internet or electronic storage is completely secure.

7. Data Sharing and Third Parties

We do not sell your personal data. We share data only with trusted third-party service providers necessary to operate our business, who process data on our behalf ("Data Processors"):

  • Cloud Infrastructure: Amazon Web Services EMEA SARL (hosting and compute, EU region).
  • AI & LLM Providers: In the case of Cloud Deployment only, Microsoft Ireland Operations Ltd. (Azure OpenAI Service, EU Data Boundary) and AWS (Amazon Bedrock, EU) can process your data on our behalf. These providers operate under zero data retention and are contractually bound not to use your data to train their foundation models.
  • Observability: LangChain, Inc. (LangSmith, US, under EU Standard Contractual Clauses).
  • Analytics: Google Analytics and/or PostHog, used in aggregated form to analyse Beta usage.
  • Google API Services: When you import documents via Google Drive, we use Google OAuth 2.0 with the drive.file scope, which grants access only to files you explicitly select - not your full Drive. Selected files are used solely to complete the import you initiated and are not used for advertising, profiling, or any other purpose. Our use of data obtained via Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements. You can revoke access at any time via myaccount.google.com/permissions.

We ensure all third parties act in compliance with GDPR. Where data is transferred outside the EEA, we rely on EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) and supplementary measures aligned with EDPB Recommendations 01/2020 (Schrems II).

8. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of any changes by posting the new policy and updating the "Last updated" date. We encourage you to review it periodically.

9. Contact & Complaints

If you have any questions, concerns, or requests regarding this Privacy Policy, please contact us at [email protected]