Privacy Policy

Last updated: 18 August 2026

This policy explains how SevenHeaven AI Ltd (“we”, “us”) processes personal data of visitors to this website, sevenheaven.ai. It is written to meet our transparency obligations under the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and the Finnish Data Protection Act (Tietosuojalaki 1050/2018).

This website is an informational marketing site. It has no user accounts and no third-party advertising or tracking. The one form on it is the optional demo-booking request described below. Our products — Trace and Bid — are separate applications with their own privacy terms presented inside each service.

1. Who is responsible for your data

The data controller is:

For any privacy-related question or request, email us at privacy@sevenheaven.ai or write to us at the address above. We are not legally required to appoint a Data Protection Officer, and we have not done so.

2. What we collect, why, and on what legal basis

Website analytics

We use Plausible Analytics, which we host ourselves on our own servers within the EU. It gives us aggregate, anonymous insight into how the site is used — for example total page views, the pages visited, the referring website, your approximate location, and your browser and device type.

Approximate location means your IP address is looked up in a geolocation database held on our own server, which returns a country and, where available, a coarse region or city. That lookup happens locally: your IP address is never sent to the database provider, and it is not stored alongside the resulting statistic. The result is often imprecise — mobile and broadband addresses commonly resolve to the network operator’s location rather than to yours — and we read it accordingly. This product includes GeoLite2 data created by MaxMind, available from maxmind.com.

This analytics does not use cookies and stores no information on your device. It does not create any persistent or cross-site identifier and does not track you across other websites. Visitor counts are derived from a daily rotating value that cannot be used to single you out and is discarded; no profiles are built and no personal data is retained for this purpose.

Legal basis: our legitimate interest (GDPR Art. 6(1)(f)) in understanding and improving our website using privacy-friendly, aggregate statistics.

Booking a demo

If you use the “Book a demo” form, we process the details you enter: the product you are interested in, your name, work email, company name, the week you would prefer, and any note you choose to add. Every field is one you type yourself — the form collects nothing in the background beyond the page you submitted from.

These details are stored in our own customer-relationship system, which we host ourselves on our own servers within the EU. They are not sent to any third-party form, scheduling or CRM service. We use them only to arrange the demo and to follow up about it, and we keep them for as long as the enquiry is commercially relevant — after which they are deleted.

Legal basis: our legitimate interest (GDPR Art. 6(1)(f)) in responding to demo requests, and where applicable taking steps at your request prior to entering a contract (GDPR Art. 6(1)(b)). Using the form is entirely optional — you can email us instead, and nothing on the site requires it.

Server logs

Like virtually all web servers, ours automatically records technical request data — including your IP address, the date and time, the page requested and your browser’s user-agent. We use these logs only to operate the site securely and to detect, prevent and investigate abuse, faults and security incidents.

Legal basis: our legitimate interest (GDPR Art. 6(1)(f)) in the security and reliable operation of the site.

If you contact us

The website’s contact links open your own email program. If you email or call us, we process the contact details and the content you choose to share (such as your name, email address, phone number and message) in order to respond and, where relevant, to discuss our products or a possible business relationship.

Legal basis: our legitimate interest (GDPR Art. 6(1)(f)) in handling enquiries and communicating with prospective customers and partners, and where applicable taking steps at your request prior to entering a contract (GDPR Art. 6(1)(b)).

3. Cookies

This website does not use cookies and does not store or read any information on your device for analytics, advertising or tracking. Because nothing is stored on or read from your device, no cookie consent is required under Section 205 of the Finnish Act on Electronic Communications Services (917/2014) — which is why you will not see a cookie banner here.

4. Where your data is processed

All processing connected with this website — including our self-hosted analytics and our server logs — takes place on servers located within the EU/EEA. We do not transfer this data outside the EU/EEA, and we do not share it with third-party analytics, advertising or data-broker services.

5. Who we share data with

We do not sell or rent personal data, and we do not share it for marketing purposes. Because our analytics is self-hosted and the site uses no third-party trackers, no website analytics data is shared with anyone. We may disclose information only where we are legally required to do so, for example in response to a lawful request from a competent authority.

6. How long we keep it

• Analytics: retained only in aggregate, non-identifying form for as long as it is useful for statistics.
• Server logs: kept for a short period for security and troubleshooting, then deleted or anonymised.
• Email correspondence: kept for as long as needed to handle your enquiry and any resulting relationship, and thereafter only as required to meet legal or accounting obligations.

7. Your rights

Under the GDPR you have the right to request access to the personal data we hold about you, and to ask us to rectify, erase or restrict it, to object to processing based on legitimate interests, and to receive your data in a portable form where applicable. Note that our cookieless analytics holds no data that can identify you, so it cannot be linked back to an individual on request.

To exercise any of these rights, contact us using the details in section 1. We may need to verify your identity before acting on a request.

If you believe we have handled your personal data unlawfully, you have the right to lodge a complaint with the Finnish supervisory authority, the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto).

8. Automated decisions

We do not carry out automated decision-making or profiling that produces legal or similarly significant effects on you.

9. Changes to this policy

We may update this policy from time to time. The current version is always published on this page, with the “last updated” date above reflecting the latest revision.