Dashboard privacy
Updated 29 September 2026
Airmodus Oy, Erik Palmenin Aukio 1, 00560 Helsinki, Finland, operates this dashboard. This page explains how we handle account information, instrument data and assistant conversations. Our privacy contact is ENVEA Helsinki office at info.aerosols@envea.global.
We are responsible for personal data used to administer and protect dashboard accounts. Where we handle your organisation's personal data on its behalf, your organisation determines the purpose and we act under its agreed processing instructions.
What the service processes
- Accounts and access: your name, email, role, organisation memberships, password hash and authentication records are used to provide and protect access. Staff/admin sign-in also uses encrypted authenticator credentials and hashed, one-use recovery codes.
- Instrument records: measurements, serial numbers, timestamps, settings, annotations and operational history support your organisation's use of its instruments. Some records identify an uploader or operator. Instrument data must not be assumed to be anonymous.
- Operational diagnostics: limited request, error and recovery information helps investigate faults and protect the service. Diagnostics can include account and organisation references; access is restricted to staff/admin. They are separate from the optional improvement archive.
Information comes from you, your organisation's administrators, connected instruments and the use of the service. Account details are needed for authenticated access; optional improvement sharing is not required. We do not use this workflow to make automated decisions with legal or similarly significant effects about people.
Optional connection and remote diagnostics
Connecting to the dashboard is optional. You can use local instrument logging without connecting to this service. When your organisation connects, the dashboard stores and displays the data it sends, and authorised Airmodus / ENVEA staff and administrators can inspect relevant measurements, instrument settings, logs and service records to provide the agreed remote support, diagnose faults, maintain the service and protect its security.
Normal remote diagnostic work does not require a separate approval for each access. Your organisation's agreed service scope, confidentiality terms and processing instructions remain applicable. Optional connection does not authorise unrelated research, public disclosure or product-improvement reuse.
Selected staff dashboard requests are recorded in a restricted customer-access archive with account and record identifiers, action, time and response status. Repeated successful reads of the same records are grouped within a minute. The archive does not copy measurement values, request bodies or credentials. Instrument custody references describe custody at access time, not necessarily ownership of historical data. The archive has bounded retention and storage and does not capture direct server/database access.
Using the assistant
To answer a request, the assistant sends your messages and relevant permitted context or tool results to an inference service. The implementation uses Tinfoil and can use a configured NEAR AI Cloud Inference fallback only when that recipient is approved for the organisation. A fallback may use different infrastructure. Contact us for the applicable provider and processing-location details. This page does not promise that all processing stays in one country or that every provider has the same safeguards.
The current dashboard conversation is also kept in your browser tab's session storage so it can continue across page navigation. Connecting an external assistant through MCP sends permitted results to that assistant; its provider's data-handling terms also apply.
Organisation settings separately control AI processing, external MCP access, improvement reuse and public measurement sharing. These restrictions also apply when staff use AI; they do not prevent authorised human remote diagnostics. In the browser or MCP, staff select one customer organisation for assistant data reads, including its recorded service jobs and shipments; without a selection, only public product knowledge is available. Changing that selection starts a new conversation. Multilogger assistants use their installation's fixed organisation and continue to support existing clients.
Help improve the assistant
Customer accounts start with improvement sharing off. You can use the assistant without enabling it. If you turn it on, authorised administrators may review limited question/reply excerpts, reasoning traces and tool names to investigate mistakes and improve prompts, tools and tests. This choice does not authorise general research, publication of customer data or training a foundation model.
Staff/admin accounts start with the setting on under the internal product policy. Staff can turn it off. An organisation restriction overrides this setting. This default is a setting, not consent given on an employee's behalf.
New review examples omit full prompt/tool payloads, session IDs and direct account attribution. We redact known account details and common identifying or secret values. Excerpts can still contain personal or confidential information, so we treat them as de-identified, not anonymous. A separate restricted account link supports withdrawal and deletion.
The platform does not automatically send these saved examples through an additional model evaluation. Human review can still identify mistakes. Do not include other people's personal information or material your organisation has not authorised you to share.
Change the setting in Settings → Data and privacy. Turning it off stops new improvement examples and deletes linked stored examples, including linked older conversation records and their reports. Organisation withdrawal removes its linked examples and deactivates its public measurement links. Revocation prevents new access; copies already delivered and previously issued download links cannot be recalled immediately. Your account, current browser conversation, instrument data and limited operational diagnostics are not deleted by this setting.
Retention and deletion
The assistant archive has a configured retention period of 90 days and periodic cleanup. Earlier conversation records may contain more context than new examples; records without a verified data source are quarantined from improvement review and remain subject to cleanup and account-linked withdrawal. Other records, including scientific history, diagnostics, exports and backups, have separate purposes and lifecycles. Contact us for your organisation's retention and deletion arrangements.
- Raw measurements and device logs use the existing 730-day cleanup rule. Aggregated scientific history, annotations, service records and uploaded files have separate lifecycles; the raw-data rule does not erase them.
- Operational diagnostic and customer-access archives normally retain up to 30 days, with record and storage limits that can remove older entries sooner.
- Generated measurement export files normally expire after one day.
- Reviewed account applications and completed personal-data requests are cleaned up after 180 days. Open requests remain while they are being handled.
Cleanup runs periodically, so expiry is not an immediate deletion at a precise second. Recovery backups can retain earlier copies. They are restricted to recovery use; applicable deletions and restrictions must be reapplied before recovered data is returned to service. Nightly database and selected local-file backups use a seven-day snapshot retention policy. Expiry follows a successful backup and integrity check, so older copies can remain if a job fails. This scope does not include every original object, mailbox or secret configuration file.
Deleting an account removes its access credentials and linked assistant examples. Shared scientific and operational records may remain. Removing an author reference does not necessarily remove personal information written inside a note or document. Contact us about personal information that remains in retained records.
Security and service providers
The production dashboard uses HTTPS, password hashing and server-side access controls. Hosting, storage, email and inference providers can be involved in delivering the service. Improvement sharing does not change processing necessary to answer your request or the policies of an external assistant you connect. Provider agreements, backup protection and international-transfer arrangements are separate from this setting.
- Hetzner: dashboard and PostgreSQL hosting; the current production server is in Helsinki, Finland.
- Cloudflare R2: configured object storage and encrypted recovery backups in private storage.
- Google mail services: configured service email delivery and retrieval.
- Tinfoil and approved NEAR AI fallback: processing necessary for requested assistant responses.
Provider and external-assistant processing can involve countries outside the EEA. The Helsinki server location does not establish the location of all storage, email or inference processing. Ask our privacy contact for the arrangements applying to your organisation, including available information about transfer safeguards.
Purposes and legal bases
For account administration, access security and necessary service diagnostics, the relevant interest is operating a reliable, secure service for our customers. Where Airmodus acts as controller, these activities are assessed under legitimate interests; a contract is a basis only where the processing is necessary for a contract with the individual. Handling statutory privacy rights serves our legal obligations.
Optional customer improvement sharing is based on the customer's affirmative choice and can be withdrawn without affecting earlier lawful processing. A staff default is not employee consent. Customer-controlled instrument data is processed under the customer's instructions and applicable agreement. Connecting voluntarily does not replace these requirements or permit unrelated use.
Your privacy rights
You can request access to or correction of personal data, erasure, restriction or objection to processing, and portability where applicable. You can withdraw optional improvement sharing in Settings without losing access to the assistant. Applicable legal bases and controller/processor responsibilities depend on the processing activity and your organisation's service agreement; optional customer improvement participation is a separate choice.
Use Personal-data requests when signed in, or email info.aerosols@envea.global. The account download includes your profile, memberships and saved improvement preference; a full access request may cover other records. We normally respond within one month and explain any permitted extension. You may also contact the Finnish Office of the Data Protection Ombudsman or the competent data protection authority. This information is not a certification of GDPR compliance.