Devella One™ Privacy Notice

Suomeksi

Last updated 14.9.2026

This notice was originally written in Finnish. In the event of any discrepancy between the Finnish and English versions, the Finnish version prevails.

1. Controller

Devella Oy
Business ID: 3288286-1
Kokkola, Finland

2. Contact person for data protection matters

Panu Haaraniemi
Email: panu.haaraniemi@devella.fi

Requests and questions concerning data protection can be sent to the address above.

3. Scope of this notice and the roles of the parties

This notice covers the Devella One™ website and content management service and its administration, user accounts, AI assistant, forms, booking, payments and integrations.

Devella Oy acts as a controller when processing the data of its own customers and of the service's users for purposes such as entering into contracts, managing user accounts, invoicing, customer service, and the security and development of the service.

Each Devella One customer is responsible for the data protection of its own website. When a customer collects visitor data on its website, for example through a form, a booking or a payment, the customer acts as the controller and Devella Oy processes the data as a processor in accordance with the customer's documented instructions.

The customer determines the purposes, legal bases and retention periods of the processing and is responsible for, among other things:

• drafting and publishing its own up-to-date privacy notice and cookie notice
• informing data subjects and fulfilling their rights
• obtaining and managing any necessary consents
• the necessity of the form and booking data it collects
• the lawfulness of the payment, calendar, analytics, marketing, CAPTCHA, embed and other third-party services it chooses to enable.

This Devella Oy notice is not the privacy notice of the customer's own website and does not replace it. The technical privacy and cookie features provided by Devella One do not transfer the controller's responsibility from the customer to Devella Oy.

If a website is managed on the customer's behalf by a partner agency, the division of roles described in section 4 also applies. Where Devella Oy acts as a processor or sub-processor, the processor's obligations, sub-processors, retention periods and security measures are agreed in more detail in a separate Data Processing Agreement (DPA), which is accepted at the organisation level in the Devella One admin interface and whose current version is available at https://devella.fi/devella-one-dpa-en. In the event of a conflict, the terms of the DPA take precedence over this notice with respect to the processor's obligations.

4. Partner agencies

A Devella One website may be managed on the customer's behalf through a partner agency. This functionality exists in the service, but Devella Oy has no agency customers at the time of publishing this notice. The following describes the situation in which an agency arrangement is put into use.

When a customer belongs to a partner agency, the agency's users are granted owner-level access to the administration of the websites of the customers the agency manages, including content, media, form responses, bookings, AI conversations and site user management. Access can be restricted where necessary by granting a user a direct site- or customer-specific membership instead of, or in addition to, agency membership.

Agency membership alone does not grant the right to store directly executable code on a website, such as scripts or embeds (the so-called trusted_html permission).

An agency sees only the customers and websites of its own agency. There is no access to the data of other agencies.

An agency-level API token is not bound to a single website; the target website is selected per request, and the server accepts only websites whose customer belongs to that agency. For each request, the validity of the token creator's account and membership, the agency's active status and the current agency of the target website's customer are checked. A token expires no later than one year after issuance and can be revoked.

An agency's template library is a resource shared within the agency: content stored in a template may appear on the websites of the agency's other customers as well. For this reason, customers should avoid storing personal data in templates.

If a customer is transferred from one agency to another or removed from an agency, the change takes effect immediately: the former agency's access ends and any new agency's access begins at the same moment.

Data protection roles are determined by who has entered into the contract with Devella Oy:

• If the agency has entered into the contract with Devella Oy and uses it to manage its end customers' websites, the agency acts as a processor of the end customer's personal data and Devella Oy acts as the agency's sub-processor.
• If the end customer is itself a contract customer of Devella Oy and the agency merely manages the website on the customer's behalf, the agency acts as a user authorised by the customer, not as an independent processor.

The division of responsibilities and the processor's obligations are agreed in more detail in the Data Processing Agreement (DPA); see section 3.

In agency invoicing, the names and websites of end customers are itemised on the agency's invoice line. Invoicing data may be exported in machine-readable form for invoicing and accounting purposes.

5. Devella staff access and support

Devella Oy's developer accounts have access to the data of all websites in order to provide the service. Multi-factor authentication is mandatory for these accounts.

All administrative changes are recorded in an audit log: actor, action, target, timestamp, request identifier and a hash derived from the IP address. Secrets that would otherwise be written to the log are redacted before storage. With respect to the audit log's event data, Devella Oy is the controller, for reasons of service security and traceability. The change data associated with an event may contain personal data collected on the customer's website; with respect to such data, Devella Oy acts as the customer's processor, and the data is deleted upon final deletion of the website (see section 13).

Devella support may, where necessary, act under another user's account (impersonation) to investigate a support request or a security incident. This is possible only with a Devella developer account, requires re-authentication and a written reason, and is recorded in the audit log. An impersonation session lasts at most one hour, and the most sensitive actions cannot be performed during it. An impersonating user cannot accept terms of service on behalf of another user.

6. Categories of data subjects

The service may process data of the following groups of people:

• contact persons and other representatives of Devella One customers
• users and contact persons of partner agencies
• administrative and developer users of the service
• visitors to customers' websites, and persons who submit forms, make bookings or make payments on them
• persons who contact customer service or otherwise contact Devella Oy
• persons who connect a calendar or other integration account to the service.

7. Personal data processed

The data processed depends on the features in use.

User and customer account data

• name, email address, phone number and language preference
• company, business ID, invoicing and address details and other details relating to the customer relationship
• user roles, permissions, invitations and account status
• login, multi-factor authentication and account recovery data in protected form
• partner agency memberships and related invitations, and agency-level API tokens
• invoicing data, including the end customer's name and website itemised on an agency's invoice
• customer service messages and other information provided by the user.

Website content and media

• texts, images, files, contact details and metadata stored on the website
• content version history, drafts, publication data and the authors of changes
• file names, captions, alternative texts, author information and technical metadata associated with images.

The user must ensure that they have the right to store the personal data and materials they add to the service.

Form, booking and payment data

• data submitted through a form, which may include, for example, name, contact details, message, selections and attachments
• booking time, service, resource, status, add-ons, notes and information provided by the booking customer
• payment amount, currency, tax details, products, payment service provider, transaction and reference identifiers and payment status
• email delivery status, the recipient's protected identifier, the recipient's domain, the message subject and the service provider's message identifier.

Devella One™ does not store card numbers, online banking credentials or other secret payment instrument details. These are processed by the payment service provider in its own service.

Technical, security and usage data

• a protected hash derived from the IP address, browser and device information, referring address and time of the event
• session, API token and security events in protected form
• login attempts, last login, logs, errors and audit data
• cookie choices and the related pseudonymous visitor identifier
• data on service usage volumes, performance and error conditions.

The raw IP address of a form submitter is not stored with the submission; instead, an HMAC-protected hash is derived from it for abuse prevention. The IP address may, however, appear for a limited time in the technical logs of the server infrastructure.

AI assistant data

• the user's conversations, instructions and feedback
• website content and settings selected for the conversation or retrieved by tools
• attachments and screenshots provided by the user where needed for the requested task
• the AI's responses, tool calls, proposed changes and their approval or rejection data
• the model used, token and cost data, request identifiers, response time and error status.

The data necessary to use the AI feature is transmitted to OpenRouter, which routes the request to the inference provider that runs the language model. Devella Oy has restricted routing to pre-approved inference providers located in the United States, which are listed in the annex to the Data Processing Agreement. Every AI request technically requires that the content of the request is not retained after the request has been processed and is not used to train models (Zero Data Retention). The publisher of a model (for example DeepSeek or Qwen) is not the same as the party that runs it: requests are not sent to model publishers' own services; open-weights models are run exclusively by the approved inference providers.

AI tools have no read access to form submissions, bookings, the email log or the consent log. Special categories of personal data (for example health data) and other sensitive data, such as personal identity numbers, payment instrument details or confidential employment and financial information, must not be entered into the AI assistant. The AI assistant is not used for automated decision-making concerning a person that would have legal or similarly significant effects. AI conversations are deleted automatically 90 days after the last message in the conversation.

Remote connections to external AI applications (MCP)

An administrator may choose to connect an external AI application, such as ChatGPT or the Claude mobile app, to their own website via a remote connection. A connection is always bound to a single website.

The user selects the permissions granted to the connection on a consent screen when establishing it. The permissions cannot exceed the user's own role on the website in question, and the connection cannot write to the website's script fields. Through the connection, website content may be transferred to the provider of the application the user has chosen, according to the user's own choice and the permissions granted.

Active connections are shown on the website's API keys page, where they can be revoked at any time.

8. Calendar integrations

A user may voluntarily connect their Google Calendar or Microsoft Outlook calendar to the Devella One booking feature.

The integration may process:

• the email address of the connected account
• calendar list identifiers, names and access information
• free/busy times of the calendar selected by the user
• calendar events created from Devella One bookings and their identifiers
• OAuth access and refresh tokens, encrypted
• granted permissions, token expiry time and synchronisation status and error data.

For Google Calendar, the service retrieves the calendar list, reads free/busy information from the selected calendar, and creates, updates and deletes events generated from Devella One's own bookings. The service does not read the titles, descriptions or attendee details of other events for the free/busy check. The booking customer's personal data is exported to a calendar event only if the customer explicitly enables this setting; otherwise the event contains only the general information needed to carry out the booking.

The calendar connection can be disconnected in the Devella One settings, and access can also be revoked in the Google or Microsoft account settings. After disconnection, no new calendar data is retrieved, and the access and refresh tokens stored in the service are deleted once the same account is no longer used in the service's other calendar connections. Events previously created in the external calendar may remain there until the user deletes them.

Devella One's use of information received from Google Workspace APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Data obtained from Google Calendar, or data derived from it, is not disclosed to AI services and is not used to train or improve generalised AI or machine-learning models. The data is also not sold, used for advertising, or used to assess creditworthiness. Humans view Google Calendar data only with the user's explicit permission in a support situation, or when necessary for security or legal compliance.

9. Purposes and legal bases of processing

When Devella Oy acts as a controller, data is processed for the following purposes:

Purpose	Primary legal basis
Providing the service and the user account, entering into the contract and managing the customer relationship	contract or pre-contractual steps
Invoicing, accounting and regulatory obligations	legal obligation
Customer service, service communications and responding to customer requests	contract or legitimate interest
Service security, prevention of abuse, troubleshooting and preparing for legal claims	legitimate interest
Improving the usability and operation of the service	legitimate interest; consent for any non-essential tracking
Providing optional integrations and AI features	contract and action requested by the user
Electronic direct marketing	consent or an existing customer relationship as permitted by applicable law

Devella Oy's legitimate interest is based on the need to maintain a secure and functioning service, manage the customer relationship and defend its rights. A data subject may object to processing based on legitimate interest on grounds relating to their particular situation.

When Devella Oy acts as the customer's processor, the customer alone determines the purposes and legal bases of the processing. Devella Oy does not determine them on the customer's behalf. Submitting a form or making a booking does not by itself always constitute consent within the meaning of the GDPR; the basis may instead be, for example, a contract, pre-contractual steps, a legal obligation or the controller's legitimate interest.

10. Sources of data

Data is obtained:

• from the data subject themselves in connection with a user account, form, booking, payment, contact or other use of the service
• from the Devella One customer, for example when the customer invites a user to the service or maintains contact person details
• from a partner agency, for example when the agency invites a user to a website of a customer it manages
• from Google or Microsoft services connected by the user, in accordance with the permissions the user has granted
• from payment, email, verification and other service providers to the extent required to deliver the service
• from technical events generated automatically by use of the service.

11. Recipients and service providers

Personal data is not sold. Data is processed only by persons and service providers authorised by Devella Oy, to the extent required to provide the service.

Devella Oy's sub-processors

Depending on the features in use, Devella Oy uses the following sub-processors to provide the service:

• Google Cloud: server infrastructure and media file storage
• Mailgun: delivery of system and form emails, unless the customer has enabled its own email server
• OpenRouter (United States): relaying AI assistant requests, and the inference providers routed through it (United States) that have been pre-approved by Devella Oy and run the language model. A complete and current list of inference providers is provided in the annex to the Data Processing Agreement.
• Stripe or Paytrail: processing of online payments, if the customer enables the payment feature
• Google or Microsoft: calendar integration, if an admin user connects their own calendar (see section 8)
• Cloudflare Turnstile or hCaptcha: form abuse prevention, if the customer enables the feature.

Calendar, payment and CAPTCHA services are used only if the relevant feature is enabled. They may also act as independent controllers with respect to their own services. A current list of sub-processors, including their locations and transfer mechanisms, is provided in the annex to the Data Processing Agreement, and customers are notified of new sub-processors at least 30 days in advance in accordance with the DPA.

Services chosen by the customer

The customer may enable the following third-party services on its website. For these, the customer is itself responsible for the lawfulness of the service, the required visitor information and the contractual relationship with the service provider:

• the customer's own SMTP server for sending emails instead of Mailgun
• analytics, marketing and content services, such as Google Analytics, Google Tag Manager, Meta Pixel, LinkedIn Insight, Matomo, Hotjar or Microsoft Clarity
• Google Fonts, if a theme font is used on the website — the visitor's browser loads the font from Google's server, whereby the visitor's IP address is transmitted to Google
• other third-party content embedded on the website
• remote connections to external AI applications, such as ChatGPT or the Claude mobile app, granted by the admin user themselves (see section 7).

Partner agencies

If the customer's website is managed by a partner agency (see section 4), the agency's users have contract-based access to the data of the websites of the customers they manage. An agency cannot see the data of other agencies.

Providers of payment, calendar, analytics, CAPTCHA and other external services may act as independent controllers with respect to their own services. Their own privacy notice applies to the processing they carry out. The customer is responsible for the lawfulness of the third-party services it chooses for its own website and for the related visitor information.

Data may be disclosed to an authority or other party if required by law or a binding official order. Data may also be processed in connection with a corporate transaction within the limits permitted by applicable law.

12. Transfers outside the EU and EEA

The service's production infrastructure, database, media files and backups are located in the EU (Google Cloud, Finland). Email delivery takes place in Mailgun's EU region, and Paytrail payments are processed in Finland. For these, no data is transferred outside the EU or EEA.

The following services process data in the United States, and transfers are carried out in accordance with applicable data protection law:

• OpenRouter: EU Standard Contractual Clauses (Implementing Decision (EU) 2021/914). The inference providers used via OpenRouter process AI requests in the United States as OpenRouter's sub-processors on the basis of the agreement between OpenRouter and each provider.
• Stripe, Google, Microsoft, Cloudflare and hCaptcha: European Commission adequacy decision (EU–US Data Privacy Framework) or the Standard Contractual Clauses specified in the respective provider's data processing agreement.

Devella Oy has carried out a transfer impact assessment of transfers outside the EEA. External services enabled by the customer itself (see section 11) may transfer data outside the EEA under their own terms; for these, the customer is responsible for the transfer mechanism. Further information on transfer mechanisms is available from the contact person named in section 2.

13. Data retention

Data is retained only for as long as necessary for its purpose, contractual obligations, security, legal claims or legal obligations.

• Customer, contract and user account data is retained for the duration of the customer relationship and thereafter for as long as required by legal obligations or preparation for legal claims.
• Accounting records are retained for the period required by accounting legislation.
• An admin session is valid for 30 days from its last renewal and for a maximum of 90 days from its creation. An expired session record is normally deleted within one day of expiry.
• The retention period for form submissions is set by the customer per form. The default is 365 days, and the selectable range is 0–3650 days. When the retention period ends, the submission is permanently deleted together with its attachments as part of the service's scheduled clean-up. A value of 0 disables automatic scheduled deletion, in which case the data is retained until the customer deletes it or the website is deleted.
• Email delivery logs relating to forms are retained for a maximum of 180 days.
• Website content, media files and their version history are retained for the duration of the customer relationship in order to provide the service and its restore functions. Automatic autosave versions of content are deleted after 7 days.
• A file marked as deleted in the media library is permanently deleted from the database and the storage service, including earlier versions of the file, 30 days after the deletion mark. During this period the deletion can be reversed at the customer's request.
• Deleting a website or a customer account is initially a soft deletion: the data is marked as deleted and is no longer visible in use. Final deletion from the database and storage service takes place within 60 days of the soft deletion, and until then the deletion can be reversed at the customer's request. Final deletion removes the website's content, media files and version history, form submissions with attachments, bookings, AI conversations and other site-specific data.
• AI conversations are deleted automatically 90 days after the last message in the conversation. Technical data on use of the AI feature (model used, token counts, request identifiers) is retained for the duration of the customer relationship for invoicing and troubleshooting.
• Calendar OAuth tokens are retained for the duration of the calendar connection and deleted after disconnection in accordance with section 8. Technical status and audit data of calendar synchronisation may be retained for as long as required for security and troubleshooting.
• Payment transaction data is retained for as long as required for payment processing, accounting, abuse prevention and legal claims. The payment service provider retains its own data in accordance with its own privacy notice.
• Agency memberships, related invitations and agency-level API tokens are retained for the duration of the membership or token. Agency-level API tokens expire automatically no later than one year after issuance.
• Audit log event data is retained for a maximum of 12 months from the time the event is recorded. Change data associated with an event is deleted upon final deletion of the website (see section 5). Other security logs are retained for as long as reasonably required for service security and traceability of events.
• A user account is not deleted when the user's membership on a customer's or agency's website ends, because the same person may also be a user on another customer's website. The end of a membership ends access to that website, but the user account remains. Deletion of account data can be requested from the contact person named in section 2.

When data is deleted from the active system, any copies remaining in backups are removed through the normal backup rotation within 90 days at the latest. Backups are encrypted at rest. After the contract ends, the following are retained even after final deletion: invoicing data required by accounting legislation, audit log event data for the period described above, and the acceptance records of the Data Processing Agreement as evidence that the agreement was concluded.

14. Cookies and other device identifiers

Devella One uses necessary cookies for the secure operation of the service. On customers' public websites, non-essential cookies and scripts are activated only on the basis of the visitor's consent, if cookie consent has been enabled on the website and the integration has been marked as requiring consent.

The key cookies set by Devella One itself are:

Cookie or storage item	Purpose	Typical lifetime
__Host-dv_session	admin login session	30 days at a time, maximum 90 days
__Host-dv_csrf	prevention of cross-site request forgery	30 days
dv_admin_locale	admin language preference	365 days
dv_locale	public website language preference	lifetime defined by the website
dv:consent	public website cookie choices	180 days
__Host-dv_gate	access to a password-protected website	7 days
__Host-dv_payment_attempt	securely linking the return from a payment to the original browser session	30 minutes
dv_site	remembering the website selected by an admin or developer	session or browser storage lifetime

In development environments and over unsecured local connections, cookie names do not use the __Host- prefix. Controlling the display frequency of website components may additionally use a cookie, localStorage or sessionStorage for a period defined by the customer.

The visitor's cookie choice is stored as the dv:consent cookie in the visitor's own browser and is used to control which scripts are loaded on the website. Devella One does not store cookie consents on the server, so the customer must, where necessary, ensure that consents can be demonstrated by other means.

Analytics, marketing, CAPTCHA and embed services enabled by the customer may set their own cookies and process technical identifiers under their own terms. The customer is responsible for describing these services, the purposes of processing, legal bases and retention periods in the cookie or privacy notice of its own website. The Devella One cookie banner is a technical tool, and enabling it does not by itself fulfil the customer's information and consent obligations. Visitors can change their consent choices in the website's cookie settings or delete the stored data from their browser.

15. Data security

Data is protected by technical and organisational measures. These include, among others:

• encrypted HTTPS data transfer
• role- and site-specific access rights
• strong one-way hashing of passwords (Argon2id) and constant-time comparison at login
• storage of session and API tokens as one-way hashes
• encryption at rest (AES-256-GCM) of integration, SMTP and other secrets, such as calendar OAuth tokens
• support for multi-factor authentication; mandatory for Devella developer accounts
• short-lived re-authentication (step-up) required for the most sensitive actions
• cross-site request forgery (CSRF) protection on mutating requests
• rate limiting of login attempts and other abuse-prone functions
• tenant isolation: every database query is bound to a site identifier through several complementary layers of protection
• sanitisation of user-stored content and uploaded SVG files to remove malicious code
• automatic removal of location-revealing EXIF data from images
• technical separation of the admin interface and the public website
• audit logs of administrative actions
• regular backups to separate storage, encrypted at rest
• restriction of access rights according to job duties and need.

Although appropriate measures are used to protect data, no electronic service is entirely free of risk. Security measures are developed alongside the service. On request, customers receive a more detailed description of the technical and organisational measures in use as an annex to the Data Processing Agreement.

16. Automated decision-making and profiling

Devella Oy does not use personal data covered by this notice for fully automated decision-making or profiling that would have legal or similarly significant effects on the data subject.

The technical spam and abuse assessment of forms may automatically flag a submission for review. Payment and CAPTCHA service providers may carry out their own fraud prevention assessments in accordance with their own privacy notices.

17. Rights of the data subject

Under applicable data protection law, a data subject may have the right to:

• obtain confirmation as to whether their personal data is being processed, and access to the data
• request the rectification of inaccurate or incomplete data
• request the erasure of data
• request the restriction of processing
• object to processing based on legitimate interest and to direct marketing
• receive the data they have provided in a structured, commonly used and machine-readable format where the right to data portability applies
• withdraw consent at any time without affecting the lawfulness of processing carried out before the withdrawal
• lodge a complaint with a supervisory authority.

In Finland, the supervisory authority is the Office of the Data Protection Ombudsman: tietosuoja.fi.

If a request concerns form, booking or other data provided on a Devella One customer's website, the request should primarily be addressed to that customer, which acts as the controller. Devella Oy assists the customer in fulfilling the request as a processor. If the website is managed by a partner agency, assistance may also be provided through the agency in accordance with the division of roles in section 4. Requests concerning data that Devella Oy processes in its own role as a controller should be addressed to the contact person named in section 2.

If a data subject addresses a request concerning a customer's website directly to Devella Oy, Devella Oy notifies the customer of the request and refers the data subject to the customer. The processor's obligation to assist in fulfilling data subjects' rights is agreed in more detail in the Data Processing Agreement (DPA); see section 3.

The identity of the person making a request may be verified before the request is fulfilled where necessary. Rights may be restricted only on grounds provided by law.

18. Changes to this notice

This notice is updated when the service, the processing of personal data or the applicable requirements change. The current version is kept available on Devella Oy's website. Material changes are communicated in the service or by other appropriate means.