Privacy policy
Last updated 2026-08-15
This policy explains how Herizon Oy processes personal data when you visit associatify.org and when you create and use an Associatify account. It covers the data we control about you. It does not cover the members, contacts or applicants you manage inside your own workspace: for that data you are the controller and Herizon acts as your processor.
Who we are
Data controller: Herizon Oy, business ID 3418543-7, PL 30, 02211 Espoo, Finland. For any privacy question, or to exercise your rights, email [email protected].
Data we process
Account data: your name, email, hashed password and organization name. Usage and security data: sign-in events, IP address, device and pages viewed. Billing data, on paid plans only: your plan, Stripe customer id and invoices. Card details are handled by Stripe and are never stored by us. Support data: the messages you send us.
Why we process it, and on what basis
To provide and secure the service and to perform our contract with you, we process account, security and billing data. To understand usage and to improve and market the service, we process aggregate analytics on the basis of our legitimate interest. Where we ask for your consent, such as optional analytics or a mailing-list signup, you can withdraw it at any time.
Artificial intelligence
AI is an optional feature, not a function applied to everything you do. Specific features, such as AI-assisted grant evaluation, report drafting and translation, send only the content needed for that feature to our AI sub-processor, and only when you or your workspace choose to use it. We do not use your data to train AI models. AI never makes an automated decision about you without human review. If you do not use these features, no data is sent for AI processing.
Cookies and analytics
We use strictly necessary cookies for sign-in and for your language and theme preferences. On the associatify.org marketing site we use privacy-friendly, aggregate analytics to measure traffic, and public forms may show a bot-protection challenge. We do not sell personal data and we do not use cross-site advertising cookies.
Sub-processors and data recipients
We share personal data only with the providers we need to run Associatify. Each acts under a data-processing agreement and may process data only on our instructions.
| Provider | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Hosting, database and encrypted backups | EU (Finland, Germany) |
| Cloudflare, Inc. | DNS, TLS and bot protection for public forms | EU and USA |
| Stripe Payments Europe | Subscription billing and invoices, on paid plans | EU and USA |
| Resend, Inc. | Transactional and campaign email delivery | USA |
| Anthropic PBC | Optional AI features, when you use them | USA |
| Glyphex | Aggregate analytics on the marketing site | EU and USA |
Your workspace data is hosted in the EU. Where a provider above processes data outside the EU or EEA, the transfer is covered by the European Commission's Standard Contractual Clauses or another approved safeguard. Optional integrations you switch on inside your workspace, such as social posting, may add further recipients, which are described where you enable them.
Retention
We keep account data while your workspace is active. When you close it, we delete or anonymize personal data within a reasonable period, unless the law requires us to keep it, for example accounting records.
Your rights
You can access, correct, export, delete or restrict the processing of your personal data, and object to processing based on legitimate interest. To exercise these rights, email [email protected]. You also have the right to lodge a complaint with a supervisory authority; in Finland this is the Office of the Data Protection Ombudsman (tietosuoja.fi).
Security
We host in the EU, encrypt data in transit, store passwords hashed, isolate each customer's data, keep audit logs and take regular backups. No system is perfectly secure, but we work to protect your data and to notify you of a breach where the law requires.
Changes
We may update this policy and will change the date above. We will give notice of material changes through the service.
Contact
Herizon Oy, PL 30, 02211 Espoo, Finland. Email [email protected].