Privacy & AI

Controller and contact

Updated 23 September 2026. The controller is Helsinki Blockchain Center Oy, Finnish Business ID 3168493-5. Contact address: Hämeentie 135 A, 3rd floor, Helsinki, Finland. Submit privacy requests through the contact form, marking the message “Privacy request”, or call +358 50 548 5659. Provide only the information necessary to handle your request.

Data, purposes and legal bases

Contact requests include your name, business contact details, organisation, role, project description, selected service path and optional phone, timing and conversation details. We use these to respond and arrange the requested expert contact. HBC applies GDPR Article 6(1)(b) to requested pre-contract steps and legitimate interests (6(1)(f)) to business enquiries; the basis is assessed according to the purpose of the request. Confirming the form is not consent to newsletters or marketing.

Newsletter processing covers your email address, confirmation and technical subscription records on the basis of consent (6(1)(a)). Unsubscribe through the link in the newsletter. Attaching an AI conversation is a separate optional choice. Security, abuse prevention and service maintenance rely on legitimate interests (6(1)(f)); processing required by law relies on legal obligations (6(1)(c)).

HBC AI: artificial intelligence, not a person

HBC AI is an AI-assisted information service, not a conversation with a human. It uses HBC knowledge, sources and, when needed, the OpenAI API. Your question and context needed to answer it may be sent to OpenAI. Some answers come from local curated information or a cache. The purpose is to answer your request, based on the legitimate interest in providing the information service you request.

Do not enter personal identity numbers, health information, passwords, trade secrets or other people’s personal data. AI may make mistakes or use outdated information. Check original sources and obtain professional advice where needed. The service does not make solely automated decisions about you with legal or similarly significant effects.

Requests use store: false, which is not a guarantee of zero retention. OpenAI may normally retain abuse-monitoring logs for up to 30 days and longer in exceptional circumstances. OpenAI states that API data is not used for model training by default without opting in. See OpenAI data controls. HBC’s cache and usage records do not mean the model automatically trains itself.

Retention and conversation history

Current WordPress settings: enquiries 365 days; separately attached conversations 180 days; answer cache 180 days; AI usage records 90 days. Usage records include a question fingerprint, topic, interaction type, feedback and usage counts. Storage of example-question text in usage records is disabled. Cached answers can contain context derived from a question.

Server-side session context has a 30-minute lifetime. Browser sessionStorage holds a random session identifier; browsers may restore tab sessions. Scheduled cleanup removes expired records; WordPress scheduling and backups mean deletion is not instantaneous from every copy. Newsletter data is kept during the subscription; necessary unsubscribe and consent records may remain to honour suppression and demonstrate consent. Separate customer relationships and statutory retention are assessed separately.

The answer-cache period is measured from last use and the AI insight period from the last observation. Daily AI request and token counters are kept separately for 400 days. These periods describe the WordPress database, not a deletion guarantee for mailboxes, server logs, backups or other services.

When you request follow-up in Tokenization Opportunity Explorer, it emails your name, address and assessment summary to an HBC-configured address. That message is outside the automatic deletion of WordPress leads described above. No automatic retention or deletion period is currently defined for contact emails in HBC’s own mail system or for Cloudflare R2 backups.

Providers and international processing

The website is hosted by Webbinen on servers in Finland. WordPress and plugin records are held in the website database. Authorised HBC staff, technical maintenance and providers delivering messages and newsletters process information as necessary. OpenAI separately processes AI requests; Finnish hosting does not mean AI processing is restricted to the EU/EEA.

Transfers outside the EU/EEA require a GDPR-compliant mechanism, such as an applicable adequacy decision or standard contractual clauses with supplementary safeguards. Ask HBC for details of recipients, processing countries and transfer safeguards. External links and opened videos are subject to their providers’ privacy practices.

Enquiries saved through the contact form and HBC AI are also sent to HBC’s own Unrun system at workspace.unrun.online, which runs on Cloudflare cloud infrastructure. The transfer includes contact details, organisation, request description and any AI conversation you separately choose to attach. Pending data is encrypted in the WordPress delivery queue; its content is removed from that queue after successful delivery. Enquiry notifications and Explorer assessment summaries also pass through HBC’s own email system. Backups are held in Cloudflare R2 in the EU, according to HBC. The processing region of Unrun and Cloudflare’s contractual and any transfer safeguards still need confirmation by HBC.

Cookies, browser storage and external media

WordPress login, form security and language choices may use technical cookies. HBC AI uses a tab-session identifier and server-side context. Server and security logs may include IP addresses, time and requested URLs. AI rate limiting uses an IP-derived identifier; this is not the same as anonymous use.

External videos or embeds may disclose information to their providers. Non-essential tracking or advertising cookies require applicable prior consent; this notice itself is not cookie consent. You can clear site data in your browser, which may reset logins and sessions.

Google Analytics 4 (measurement ID G-4071KDEYVD) is activated only if you allow analytics in the cookie panel. It helps us understand page use and improve the site. HBC does not load the Google Analytics tag without your consent. Your choice is stored in browser local storage for up to 180 days; you can change or withdraw it at any time through Cookie settings in the footer. After consent, Google may process usage and device data in connection with its service; please also see Google’s privacy policy. Withdrawal stops measurement from the next page load and the site attempts to remove Analytics cookies from your browser.

Your rights

You may request access, correction, erasure, restriction and, where applicable, portability. You may object to processing based on legitimate interests and withdraw consent without affecting the lawfulness of earlier processing. Rights are subject to legal conditions; statutory retention may prevent deletion.

Use the contact form. Identity may be verified proportionately where necessary. Requests are normally answered within one month; any legally permitted extension is explained. You may complain to the Finnish Data Protection Ombudsman or the supervisory authority where you live or work.