Privacy policy
Updated 4 November 2026
This policy explains how Soitto handles personal data for call planning, reminders and the optional Google Calendar connection.
Controller and contact
Soitto is provided by Codon Oy. For privacy enquiries and requests about your data, contact soitto@soitto.app. If you use an employer-managed account, your organisation also manages your use of that account.
soitto@soitto.appData we process
We process your name, email, user role, account status, sign-in records and optional profile photo. Passwords are stored as salted hashes. We store the call slots, notes, working hours, breaks, preferences and reminders you add. Browser push notifications require a stored push subscription. Our infrastructure may process IP addresses and technical logs to operate and secure the service.
Purposes and legal bases
We use data to provide your account and the service, synchronise your entries and deliver reminders you request. Account and service processing is based on performance of a contract; maintaining security is based on legitimate interests. The optional Google connection and browser notifications are enabled with your permission. You can turn these features off.
Google Calendar data
Connecting Google gives Soitto your account identifier and email address, and permission to create a separate Soitto calendar and manage its events (calendar.app.created). Soitto reads free/busy periods in your calendars (calendar.freebusy) to show unavailable times in the grid. It does not read event titles, descriptions or attendees from other calendars. We store a refresh token, calendar ID, email, time zone and connection date to maintain the connection. Google data is used only for this calendar feature, not advertising, sale or AI model training. Soitto’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Google API Services User Data PolicyService providers and sharing
Cloudflare provides hosting and data storage. SMTP2GO processes data needed to deliver emails. Your browser’s push service delivers notifications you subscribe to. Google processes calendar connection data when you enable it. We do not sell personal data. Providers may process data outside the EU and EEA; applicable data protection requirements and transfer mechanisms must be followed. Your organisation’s administrators can manage your user account.
Cookies and browser storage
Soitto uses a session cookie for sign-in (up to 30 days) and language and theme preference cookies (up to one year), and a cookie notice acknowledgement cookie (180 days). Your theme, local grid copies and preferences may be stored in browser local storage. The current application has no advertising or analytics tracking scripts. You can clear browser storage in your browser settings.
Retention and deletion
Account and planning data remain in the service until deleted or no longer needed to provide it. You can request account and data deletion by email. Disconnecting Google removes the stored connection and attempts to revoke Google authorisation. You can also revoke access in your Google Account’s connections settings. Disconnecting does not automatically delete calendars or events already in Google; you can delete them in Google. Local browser copies may need to be cleared separately.
Your rights and security
You can request access, correction, deletion, restriction or portability where applicable, and object to processing based on legitimate interests. You can withdraw consent without affecting the lawfulness of earlier processing. You may complain to Finland’s Office of the Data Protection Ombudsman (tietosuoja.fi). We protect data with access controls, password hashing and secure connections. Avoid adding unnecessary sensitive information to notes.
tietosuoja.fiPolicy changes
We update this policy as the service changes. The current version and update date appear on this page. Material changes will be communicated through the service or by email.