VerhoPrivacy notice
In short
- We do not store the text you write into Claude or ChatGPT. Our server processes it in memory for detection and forgets it at once. The one exception is feedback to which you choose to attach a protected conversation, and in a test version of the extension also screenshots and the original values; it is deleted after 90 days.
- We know who you are, but not what you did. Your name and email are in your account. Nothing that describes use points to you.
- The original values Verho replaces with placeholders are stored only in your browser, encrypted.
- Our server is in Helsinki. No US-owned company processes your text on our behalf.
- Our website uses no tracking or advertising cookies. Cookies are set only when you sign in.
1. Controller and contact details
Tekoälytehdas Oy (business ID 3600364-1), Liisankatu 7, 00170 Helsinki, Finland.
Privacy matters: aarne@tekoalytehdas.fi. We reply within one month.
We have not appointed a data protection officer, because the law does not require one of a company our size.
2. Two roles: when we are controller and when processor
We are the controller of our own data about you: your account, sign-in, feedback, payments, website visitor numbers and messages you send us. This notice describes them.
We are a processor when we check text you write into an AI service in your work on behalf of a company or other organisation. The text, and the data of the people mentioned in it, are your firm's responsibility, and we process them on your firm's behalf and on its instructions, under the terms of service and, once your firm has one, the data processing agreement. The same applies to a firm's counters for the monthly report.
When you use Verho for your own matters, and not in the work of a company or a sole trader, we are the controller of checking the text. We process it in the same way as above: only in memory, for the length of one check, storing nothing. The legal basis is the contract, the service you have chosen to use. We process the data of people mentioned in the text only for the moment you need to protect it before you send the text to an AI service, which is in their interest too (legitimate interest).
3. What data we process and why
3.1 Account and sign-in
| Data | Source | Why | Legal basis | How long |
|---|---|---|---|---|
| Email address, name | Microsoft or Google, when you sign in with them; you, when you sign in by email | To identify you and show your account; an admin sees who holds a seat | Contract (6(1)(b)) | Until your account is deleted |
| The sign-in service and its permanent identifier for you | Microsoft, Google or your email address | To recognise you next time, even if your address changes | Contract | Until your account is deleted |
| When the account was created | Generated | Administration | Contract | Until your account is deleted |
| Which version of the terms you accepted, and when you pressed to accept it | You, when you press I accept the terms of service | Proof of the accepted terms | Contract; legitimate interest (evidence) | Until your account is deleted |
| Firm: name and business ID (for a team), plan, report retention period, which version of the terms was accepted and when | You, when you first sign in or set up a team | Firm account, invoice, proof of the accepted terms | Contract; legitimate interest (evidence) | Until the firm is deleted |
| Role (admin or member) | Generated | Who may invite, remove and pay | Contract | Until the seat is removed |
| A device's sign-in token, stored as a hash | Generated when a device signs in | The extension proves it may use the service | Contract | Until you sign out on that device |
| One-time code for email sign-in, as a hash | Generated | Sign-in without a password | Contract | 15 minutes or until used |
| Invitation: the email address it was sent to | The team's admin | Sending the invitation | Legitimate interest (your firm's and yours) | 14 days or until used |
| The extension's one-time hand-off code | Generated | Passing the sign-in from the website to the extension | Contract | 1 minute |
| A keyed hash of your email address, and when sign-in codes were sent to it | Generated when you ask for a code | So that sign-in cannot be used to flood anyone's inbox | Legitimate interest (security) | 1 hour, in memory only |
What we do not store: a password (we use none), when you signed in or used Verho, a sign-in log, a session table, or timestamps on your devices. That is why not even an admin can see when anyone used Verho, and nor can anyone else.
From Microsoft and Google we ask only for your name, email and identifier (openid email profile). We do not ask for access to your mail, calendar or files.
Your email address, name and sign-in identifier are necessary to use the service; without them you cannot sign in. The email address and attachment in feedback are optional.
3.2 The text Verho checks
When you type or paste text into the AI service's input field, the extension sends our server the text in the input field and your firm's word lists (always protect, never flag). It does not send the AI's answers, the conversation history, any other content of the page, or your browsing history.
The server finds the values in memory, returns where they are and their types, and forgets the text at once. The text is not stored in a database, logs, error reports or backups. Automated tests check with every change that no text reaches the logs.
We process the text on your firm's behalf or, in your own use, as controller (section 2). It may contain anything, including special categories of personal data such as health data.
3.3 Counters for the monthly report
Not in use yet: the monthly report comes later. This is how it will work.
When you send a message, the extension sends counters to your firm: the date (never the time of day), the AI service, the type of data (for example a person's name or a personal identity code), how many messages contained that type, how many values were found and how many of them were protected, and the time spent reviewing in seconds. Once a day it sends how long protection was on, switched off or unavailable.
Counters belong to the firm, not to a seat: they do not point to you and do not show who did what. In a firm of one, however, the counters describe your own use, and only you see them.
Counters are kept for the period the firm chooses, 3 to 24 months, 12 by default. When the firm's agreement ends, they are deleted within 30 days. We process them on the firm's behalf; for a firm of one, on the basis of the contract.
3.4 Feedback
You can send feedback from the extension. We store: the time, the topic, the text you write, the extension's version, the AI service and the language. In addition, only if you choose:
- your email address, if you tick "You may contact me about this"
- a conversation attachment: the protected prompt and answer as they were sent and came back, with placeholders and without the restored original values. You see the attachment in full and can edit it before sending.
In a test version of the extension, which we give to testers who use invented data only, you can also add up to three screenshots, and attach the same prompt and answer with the original values put back. Neither is checked for personal data. They are deleted with the attachment after 90 days and never written to logs. In a test version, "You may contact me about this" comes ticked; you can untick it.
Feedback does not point to your account, your seat or your firm. The attachment is deleted automatically after 90 days, the rest of the feedback after 24 months. The attachment is never written to logs. We read feedback to develop Verho (legitimate interest) and to reply if you allowed us to. We read an attachment only to find out what went wrong, and never use it, as it is or rewritten, for training or testing.
Do not attach your clients' or other people's data to feedback. Verho checks feedback before it is sent and tells you if it finds personal data. If we notice values in an attachment that were left unprotected, we delete them.
3.5 Usage numbers
We want to know how many people use Verho, but not who. The extension works out on the device whether this is the first time today it has checked something, and whether it is also the first time this week or this month. The first time each day it sends "active today". The server adds it to daily totals by plan and AI service and stores no device, seat, account or firm.
The numbers of accounts, firms and seats by plan are counted from the account tables. Legal basis: legitimate interest (developing and sizing the service). The stored numbers are not personal data.
3.6 Payments
Not in use yet: paid plans are coming. This is how payment will work.
Payments are handled by Revolut. When a team's admin orders, they go to Revolut's payment page. Revolut processes card and billing details under its own terms and privacy notice.
We store: Revolut's customer and subscription identifiers, the number of seats paid for, and the date paid until. No card details, billing address or invoices. The only thing we give Revolut is the admin's email address.
Legal basis: contract and the Finnish Accounting Act (6(1)(c)). Accounting records, such as Revolut's settlement reports and invoices, are kept for six years from the end of the financial year as the Accounting Act requires; the financial statements and general ledger for ten years.
3.7 Sign-up list
If you left your email address on the website to hear when Verho is available, we stored the address, an optional company name, the time and the version of the text you agreed to, and where you came to the page from (for example a LinkedIn link). Legal basis: your consent (6(1)(a)). The list is closed, and on 21 October 2026 we deleted it with every address in it.
3.8 Website visitor numbers
We count website visitors ourselves, without cookies, without storing anything in your browser and without any outside analytics service. When you open a page, the site's own script tells our server which page was opened and where you came from (the tag on a link or the name of the linking site).
While the page is open, the script may also tell the server, each as a separate message that nothing links to the others or to you, when the page has been in view for 30 seconds, and when you press a link to the Chrome Web Store or to sign in. A browser that says it is a robot, or is run by automation software, is counted only as a robot.
Your IP address is turned into a country in the server's memory using our own country file, and the address never leaves the server. To count you only once a day, a hash of your IP address and browser name is made in memory, mixed with a random value that changes every day. The hashes are never written anywhere and vanish at the end of the day. We store only daily totals by page, source, country and the events above. They cannot tell anyone who visited.
Legal basis: legitimate interest (knowing where visitors come from and how the site is read). The totals are not personal data.
3.9 Server logs
Our server logs technical events to find faults: the time, the path of the page or API, and the response status. The IP address, browser identifier and referring page are removed from the logs before they are written, as are one-time sign-in codes. No text, email addresses, names, codes or tokens are written to the logs.
Legal basis: legitimate interest (security and keeping the service working). Retention: the logs are rotated by size, so the oldest entries are deleted as new ones arrive.
3.10 Messages you send us
If you email us, we process your address and message to reply. Legal basis: legitimate interest or contract. Retention: 12 months after the matter is closed, unless the law requires us to keep it longer, for example as part of our accounts.
3.11 What the extension stores on your device
This data is only in your browser. We cannot see it.
| Data | Where | How to remove it |
|---|---|---|
| Which placeholder stands for which value, per conversation, encrypted (AES-GCM) under a key that cannot be exported from the device | In the extension's own storage, which websites cannot read | Remove the extension |
| The device's sign-in token, word lists and settings | In the extension's own storage | Sign out, or remove the extension |
The AI service's site and other websites cannot read the extension's own storage. They do, however, see the page: the AI service's page sees the contents of the input field before Verho replaces any values (terms of service, section 4.5), and the original values Verho puts back into an answer. ChatGPT's page also sends the contents of the input field to OpenAI before you press send. Verho asks once whether to stop that; while you have said yes, your browser refuses that one request. The choice is in the extension's settings. Earlier versions of the extension kept the mappings in the AI service's site storage; the current version deletes them from there. If you remove the extension, clear your browser data or change device, placeholders in old conversations can no longer be restored, and the extension marks them as unresolved.
3.12 Cookies
Our website uses no analytics, tracking or advertising cookies. Signing in uses three strictly necessary cookies, which need no consent:
| Cookie | Purpose | Duration |
|---|---|---|
verho_session | Keeps you signed in to the website. Holds your account identifier and an expiry, signed; nothing is stored on the server | 30 days |
verho_signin | Holds the security values of a sign-in with Microsoft or Google until you come back from them. Nothing about you | 10 minutes |
verho_email | Remembers the email address a sign-in code was sent to | 15 minutes |
4. What we never do
- We do not store the text you write into an AI service or its answers, except a feedback attachment you choose to send (section 3.4).
- We do not store who did what, or when.
- We do not infer emotions, productivity or performance from what you write.
- We do not train or improve models with our customers' text.
- We do not sell data, use it for advertising, or use it to assess creditworthiness.
- We never handle your Claude or ChatGPT credentials or session.
- We use no US-owned sub-processor to process your text.
5. Who else processes data
| Who | For what | Role | Where |
|---|---|---|---|
| UpCloud Oy | The server Verho runs on, including the database | Processor | Helsinki, Finland |
| Zoho Corporation B.V. (ZeptoMail EU) | Sending sign-in codes and invitations by email | Processor | EU |
| Revolut Bank UAB | Processing payments, once paid plans open | Independent controller | Lithuania, EU |
| Microsoft and Google | Sign-in, if you choose them | Independent controllers under their own terms | Under their own policies |
| Our accounting firm | Bookkeeping | Processor | Finland |
We also disclose data to authorities where the law requires it. If the Verho business is transferred to another company, the data goes with it, and we will tell you in advance.
Anthropic and OpenAI are not our recipients. When you send a message to Claude or ChatGPT, you send it yourself, and their own terms and privacy notices apply. Verho sends them nothing.
The extension is installed from the Chrome Web Store, which Google operates under its own terms.
6. Transfers outside the EU and EEA
The text Verho checks is not transferred outside the EU. It is processed in Helsinki.
Microsoft and Google may process sign-in data outside the EU under their own policies when you choose to sign in with their accounts.
7. Your rights
You have the right to:
- know what data we process about you and receive a copy
- have incorrect data corrected
- have your data erased
- have processing restricted
- receive the data you gave us in a machine-readable format
- object to processing based on legitimate interest.
Send your request to aarne@tekoalytehdas.fi. We reply within one month. We may ask you to confirm your identity, for example by signing in.
What we cannot give you: because we do not store what anyone did, we cannot tell you which texts you checked or when you used Verho. That data does not exist.
If you are mentioned in text someone else checked with Verho, we do not know it, because we do not store the text. Contact the organisation in whose work the text was processed.
You have the right to complain to a supervisory authority: in Finland the Office of the Data Protection Ombudsman (tietosuoja.fi, PO Box 800, 00531 Helsinki), or the authority in the country where you live or work.
8. Automated decisions
We make no automated decisions about you that have legal or similarly significant effects. Detection suggests which parts of a text are sensitive; you decide what is protected and sent.
9. How we protect data
- All traffic between the extension, the website and the server is encrypted (TLS).
- Text is processed only in the server's memory. Logs are filtered, and automated tests check that no text or tokens reach logs or error reports.
- We use no passwords. Sign-in tokens, invitation codes and one-time codes are stored as hashes and can be revoked.
- The database's structure prevents linking use to a person: tables that describe use have no column for an account or a seat, and an automated test keeps it so.
- The server is in UpCloud's data centre in Helsinki.
- The extension's code is readable and not obfuscated.
If a personal data breach is likely to put you at risk, we will tell you and the Data Protection Ombudsman as the law requires.
10. Age limit
Verho is meant for people aged 18 and over. We do not knowingly collect data about minors.
11. Chrome Web Store and Limited Use
The use of information received by Verho will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements. We use the data only for Verho's single purpose: finding and protecting sensitive data before you send it to an AI service. We do not transfer it to anyone other than those named in this notice, do not use it for advertising, and do not allow people to read it, except a feedback attachment you choose to send.
12. Changes
We update this notice when our processing changes. We announce material changes by email and on the account page before they take effect. Earlier versions are available on request.
| Version | Date | Change |
|---|---|---|
| 1 | 19 October 2026 | The product's first privacy notice. Replaces the notice for the sign-up list |
| 2 | 23 October 2026 | 3.7: the sign-up list has been deleted. 3.8: the events the website counts. 3.11: the extension keeps the mappings in its own storage |
| 3 | 25 October 2026 | 3.1: which version of the terms you accepted, and when you pressed to accept it |
| 4 | 26 October 2026 | 3.4: screenshots and the original values in feedback from a test version of the extension |
| 5 | 27 October 2026 | 3.11: ChatGPT's page sends the input field to OpenAI before you press send, and Verho can stop that |