Privacy Policy

1. Data Controller

This website (boro.fi) is owned and operated by:

Boro Oy
Business ID: 3340498-9
Puolikkotie 1 A 1, FI-02230 Espoo, Finland
Contact: ana@boro.fi

Boro Oy is the data controller within the meaning of the EU General Data Protection Regulation (GDPR, Regulation 2016/679) and the Finnish Data Protection Act (1050/2018). All references to "we", "us", or "our" in this policy refer to Boro Oy.

2. What Personal Data We Collect

We collect only the minimum data necessary to provide our services. The specific data we may process depends on how you interact with the site:

2.1 Women's Health Playbook & Strategy Report Form

When you use the Playbook commissioning form on /womens-health-playbook, the following fields are presented:

• Full name
• Work email address
• Organization / company name
• Billing address & country
• VAT / tax registration number
• Invoice preference
• Strategy intake parameters (persona type, objective, target area, geographic scope, context notes)

Important: This form operates entirely client-side. When you click "Commission", your device's default email application opens a pre-composed email to ana@boro.fi. No form data is transmitted to or stored on our servers. The data is only shared when you voluntarily send the email from your own mail client. We do not have access to your data unless you choose to send it.

2.2 Women's Health Map Inquiry Form

The interactive map at /womens-health-map includes a contact form collecting:

• Your name
• Email address
• Area of interest
• Message details

Like the Playbook form, this operates via mailto: — your device opens a pre-composed email. No data is transmitted to or stored on our servers. Data is only shared when you voluntarily send the email.

2.3 AI Chat Assistant ("Ask Ana")

The AI-powered chatbot on /blog and /womens-health-map allows you to ask questions about women's health, Boro services, and the ecosystem map. When you submit a question:

• Your question text is sent to our server-side API endpoint.
• The question is forwarded in real time to Google Gemini API (Google Cloud, processed under Google's Data Processing Addendum) to generate a response.
• We do not store your chat messages. Questions are processed transiently — they exist only for the duration of the API call and are not logged, saved, or retained by us.
• Google processes the data in accordance with its Cloud Terms of Service. Under the Gemini API Terms, Google does not use API customer data to train its models.
• A simple in-memory rate limiter tracks the number of queries per anonymous session (based on a generic client identifier) to prevent abuse. This counter resets daily and contains no personal data.

3. Cookies

We do not set any first-party cookies. Our website does not use cookies for tracking, analytics, advertising, session management, or any other purpose.

We use Vercel Analytics and Vercel Speed Insights for aggregated, anonymous website performance metrics. These services are designed to be privacy-respecting and do not use cookies. They do not collect personal data, do not track individual users across sessions, and do not create user profiles. Data is processed by Vercel Inc. under their Privacy Policy.

No third-party cookies are set by our site. We do not use Google Analytics, Facebook Pixel, advertising trackers, retargeting pixels, or any similar technology.

Because we do not use cookies, no cookie consent banner is required under the ePrivacy Directive (2002/58/EC) or Finnish Information Society Code (917/2014).

4. We Do Not Sell or Share Your Data

Boro Oy does not sell, rent, trade, or otherwise share your personal data with any third parties for marketing, advertising, profiling, or any commercial purpose. Period.

The only circumstances under which your data may be disclosed are:

• By your own action: When you voluntarily send an email via the mailto: links, your email is transmitted via your own email provider (e.g. Gmail, Outlook) — not through our systems.
• Transient API processing: AI chat questions are forwarded to Google Gemini API solely to generate a response and are not stored.
• Legal obligation: If required by Finnish or EU law, or by a valid court order from a competent authority.

5. Legal Basis for Processing (GDPR Art. 6)

• Consent (Art. 6(1)(a)): When you voluntarily submit your contact details via email to commission a report or make an inquiry.
• Legitimate Interest (Art. 6(1)(f)): Anonymous website performance analytics (Vercel Analytics) to maintain and improve website functionality.
• Contractual Necessity (Art. 6(1)(b)): Processing billing and contact data to fulfill a commissioned Playbook report order.

6. Data Retention

• Form data: Not stored on our servers. Data exists only in your email once voluntarily sent.
• AI chat messages: Not stored. Processed transiently and discarded after generating a response.
• Email correspondence: If you email us, we retain the correspondence for as long as necessary to fulfill your request and comply with Finnish accounting obligations (6 years for invoicing records under the Finnish Accounting Act, Kirjanpitolaki 1336/1997).
• Analytics data: Aggregated, anonymous, and retained by Vercel according to their data retention policy.

7. Data Transfers Outside the EU/EEA

The following data transfers outside the European Economic Area may occur:

• Vercel Inc. (United States): Website hosting and analytics. Transfers are governed by Vercel's Data Processing Addendum and the EU-US Data Privacy Framework.
• Google Cloud / Gemini API (United States): AI chat processing. Governed by Google's Cloud Data Processing Addendum and Standard Contractual Clauses (SCCs).

Both providers maintain adequate safeguards under GDPR Art. 46, including Standard Contractual Clauses and participation in recognized data privacy frameworks.

8. Your Rights Under GDPR

As a data subject, you have the following rights under the GDPR:

• Right of access (Art. 15): Request a copy of any personal data we hold about you.
• Right to rectification (Art. 16): Request correction of inaccurate personal data.
• Right to erasure (Art. 17): Request deletion of your personal data ("right to be forgotten").
• Right to restriction of processing (Art. 18): Request that we limit how we use your data.
• Right to data portability (Art. 20): Receive your data in a structured, machine-readable format.
• Right to object (Art. 21): Object to processing based on legitimate interests.
• Right to withdraw consent (Art. 7(3)): Withdraw consent at any time without affecting prior lawful processing.

To exercise any of these rights, contact us at ana@boro.fi. We will respond within 30 days.

You also have the right to lodge a complaint with the Finnish Data Protection Ombudsman (Tietosuojavaltuutetun toimisto):

Office of the Data Protection Ombudsman
Lintulahdenkuja 4, FI-00530 Helsinki, Finland
Tel: +358 29 566 6700
Email: tietosuoja@om.fi
Website: tietosuoja.fi

9. Security

Our website is served over HTTPS (TLS encryption) via Vercel's global edge network. We implement appropriate technical and organizational measures to protect against unauthorized access, alteration, disclosure, or destruction of data. However, given that we do not store personal data on our servers, the risk surface is minimal by design.

10. Children's Privacy

Our website and services are not directed at individuals under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at ana@boro.fi and we will promptly delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Any material changes will be posted on this page with an updated "Last updated" date. We encourage you to review this page periodically.

12. Contact

For any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact:

Anastasiya Markvarde
Data Controller, Boro Oy
Email: ana@boro.fi
Website: boro.fi