Privacy Policy
This policy explains what personal data IKKIO Data Rooms collects, why, who it is shared with, and the rights you have. It is written to be read, not just to exist: if something here does not match what the product does, tell us and we will fix one or the other.
1. Who we are
IKKIO Data Rooms (the “Service”) is operated by IKKIO Oy, a limited company registered in Finland, with its seat in Helsinki (“IKKIO”, “we”, “us”). You can reach us at info@ikkio.ai. For anything about personal data, write to the same address with “Privacy” in the subject line.
2. Two roles: controller and processor
The Service hosts data rooms that companies (“Workspace Owners”) create to share material with investors and their own team. That means we act in two capacities:
- As a controller for your account with us (name, email, password, company), for platform-level features such as AI credits and the Meexdy network, and for the security and operation of the Service.
- As a processor on behalf of a Workspace Owner for everything inside their data room: the documents they upload, the investors they invite, the tasks and pages their team writes, the contracts they send for signature, the bookings they receive and the CRM records they connect. For that data the Workspace Owner is the controller, decides who may see what, and is responsible for having a lawful basis to process it. If you are an investor and want to know how a particular company uses your data, contact that company; its contact email is shown on its data-room page.
3. What we collect
3.1 Your account
Email address, password (stored hashed by our authentication provider), full name and, optionally, your company or fund. Your workspace memberships and roles. Invitations addressed to your email before you sign up.
3.2 Data-room content
Documents uploaded by Workspace Owners and everything their team creates: sections, pages, boards, tasks, the answer library, business-plan and financial-model inputs, expense records and receipts, Founder's Quest answers and evidence. Documents are stored in private storage and are only served through short-lived signed links (one hour for documents, ten minutes for receipts) to people whose role allows it.
3.3 Reading activity in a data room
When an investor with Level 1 or Level 2 access opens a document, the Service records which document was opened, when, and for how long the tab stayed visible (updated every ten seconds while you read). The Workspace Owner's team can see this per investor, by name and email. Views by the company's own team are not recorded. This tracking exists so founders can see which materials investors engage with; it is part of what you accept by requesting access to a data room.
3.4 Electronic signatures
When you sign an agreement (for example an NDA) through a signing link, we store the exact text you were shown, the name you typed, your consent to sign electronically, the time of signature, your IP address, your browser's user-agent string, and a cryptographic hash binding these together. This is the audit trail that makes the signature evidential, and it is kept for as long as the agreement may be relied on.
3.5 Bookings
Public booking pages ask for your name, email and an optional note, plus the time you picked. If the Workspace Owner has connected Google Calendar, an event containing those details is created in their calendar and Google sends you the invitation.
3.6 The AI assistant
The assistant lets a signed-in user ask questions about a data room and, for team members, draft pages, add tasks and save answers. It is powered by third-party AI models. Here is exactly what happens:
- Nothing is sent to an AI provider unless you use the assistant. Opening a data room, uploading documents or reading them never involves an AI provider.
- What is sent when you do: your message, the earlier messages of that conversation, the workspace name, your name and access level, and the results of the actions the assistant takes on your behalf. Those results can include document titles and descriptions, the extracted text of documents you ask about (up to roughly 60,000 characters per document), and, for team members, pages, tasks with assignee names, answer-library entries, Founder's Quest answers and the names and emails of people you have sent contracts to. The assistant can only reach what your own role in the data room allows.
- Who receives it: Anthropic (Claude models) when you use IKKIO credits or your own Anthropic key, or OpenAI when you use your own OpenAI key. Both are used through their business APIs, under which inputs and outputs are not used to train their models. We ask OpenAI not to store conversations, and we do not opt into any training or retention programme at either provider. The providers may retain data for a limited period for abuse monitoring under their own policies, which we link to above.
- Your own API keys (if you connect one) are verified once, encrypted with a key held only on our servers, and stored in that encrypted form together with their last four characters, the model you chose, and when they were last used. They are never shown again and you can delete them at any time from the assistant page.
- Conversations are not stored on our servers. The chat lives in your browser's session storage and disappears when you start a new chat or close the tab. Pages, tasks and answers the assistant creates at your request are stored like any other data-room content.
- Credits: for each message paid with IKKIO credits we record who sent it, in which workspace, which model answered, the token counts and an estimated cost, so that we can account for the free credits we give. Requests for more credits, including any note you write, are stored until handled.
3.7 Integrations a Workspace Owner may connect
- Google Calendar: connecting it stores an OAuth refresh token, the connected Google account email and the calendar id. Tasks with a due date are pushed to that calendar, and bookings read its busy times. The scopes requested are calendar events and the account email, nothing else.
- Airtable: a Workspace Owner can connect the Airtable base where they track investors. Records are read live and shown to the workspace's admins; status changes they make are written back. We do not copy that CRM into our database. The Airtable token is stored in the workspace's settings.
- Calendar feed: a workspace can generate a private calendar-subscription link. Anyone holding that link can read the workspace's tasks, so treat it like a password.
3.8 Meexdy
Meexdy is the member network inside the Service. A member profile (display name, handle derived from your email, role line, bio, city, who invited you) is created when you first open Meexdy. Posts, comments, reactions, introduction requests, company postings, applications, pitches and circle notes you create there are visible to other members according to Meexdy's rules, and read receipts on posts are visible to the author.
3.9 Technical data
Our hosting providers keep standard server logs (IP address, time, requested URL, browser) for security and debugging. We run no advertising or analytics trackers and no third-party scripts on the Service.
4. Why we process it, and on what basis
| Purpose | Legal basis (GDPR art. 6) |
|---|---|
| Providing your account, data rooms, invitations, roles and the assistant you ask to use | Performance of a contract (art. 6(1)(b)) |
| Recording reading activity for Workspace Owners | Legitimate interest of the Workspace Owner in understanding investor engagement (art. 6(1)(f)), disclosed to you when you request access |
| Electronic-signature audit trail | Performance of a contract and legal obligations to evidence signatures (art. 6(1)(b), (c)) |
| Security, abuse prevention, debugging, server logs | Legitimate interest in running a secure service (art. 6(1)(f)) |
| Accounting for AI credits | Legitimate interest and contract (art. 6(1)(b), (f)) |
| Optional integrations you connect (Google, Airtable, your own AI key) | Consent, given by connecting and withdrawn by disconnecting (art. 6(1)(a)) |
| Meexdy profile and content | Performance of a contract (art. 6(1)(b)) |
5. Who we share data with
We do not sell personal data. We share it only with the people it is meant for and the providers we need to run the Service:
- Other users, according to roles: Workspace Owners and their admins see their investors' names, emails, roles and reading activity; team members see each other's names on tasks and pages; Meexdy members see what you publish there.
- Supabase — database, authentication, file storage and account emails. Our project is hosted in Ireland, in the European Union.
- Vercel — application hosting and request logs.
- Anthropic and OpenAI — AI models, only when you use the assistant, as described in section 3.6.
- Google and Airtable — only for workspaces whose owner connected them, as described in section 3.7.
- Authorities when the law requires it, and a successor if IKKIO is acquired or merges, under this same policy.
6. International transfers
Your account, data-room content and files are stored in Ireland, inside the European Union. Anthropic, OpenAI, Vercel, Google and Airtable process data in the United States. We rely on the EU–US Data Privacy Framework where the provider is certified and on the European Commission's Standard Contractual Clauses otherwise, together with the providers' own data processing agreements.
7. Cookies and browser storage
The Service uses only strictly necessary cookies and no tracking cookies, so there is no cookie banner:
- Session cookies that keep you signed in.
- A short-lived security cookie (ten minutes) while a Workspace Owner connects Google Calendar.
- Browser storage on your device for the assistant conversation (session storage, cleared when you close the tab), which pages you have expanded, and timer settings. None of this is sent to us.
8. How long we keep data
- Account data: until you ask us to delete your account.
- Data-room content, reading activity, bookings and CRM connections: for as long as the Workspace Owner keeps them; owners can delete documents, members and workspaces themselves.
- Signature records: for as long as the signed agreement may need to be evidenced, typically the term of the agreement plus any limitation period, unless the Workspace Owner deletes the request.
- AI credit ledger: for the life of your account, for accounting.
- Your own AI keys: until you disconnect them.
- Server logs: as set by our hosting providers, normally a matter of days to weeks.
9. Security
All traffic is encrypted in transit. Documents are stored in private buckets and reached only through expiring signed links. Every workspace is isolated by row-level security enforced in the database, so a query from one workspace cannot read another. API keys you connect are encrypted at rest with a key that never leaves our servers. Access to production systems is limited to IKKIO staff who need it. No system is perfectly secure; if we learn of a breach affecting you we will notify you and, where required, the supervisory authority without undue delay.
10. Your rights
Under the GDPR you can ask us to access, correct, delete or export your personal data, to restrict or object to processing based on legitimate interests, and to withdraw consent at any time. To exercise these rights email info@ikkio.ai; we answer within one month. For data inside a company's data room, we will forward your request to that Workspace Owner or point you to them, because they decide what happens to it.
You can also complain to the Finnish Data Protection Ombudsman (tietosuoja.fi) or to the supervisory authority where you live.
11. Children
The Service is for businesses and professional investors and is not directed at anyone under 18. We do not knowingly collect data from children.
12. Changes
When we change this policy we update the date at the top and, for material changes, tell signed-in users in the app. The current version always lives at this address.
13. Contact
IKKIO Oy · Helsinki, Finland · info@ikkio.ai