Sovereign AI Cloud Pricing How to AI Blog About
Legal & Trust Center

Clear terms for a sovereign stack.

How we handle your data, what you agree to when you use Alverion, and where in Europe your information actually lives. Written to be read — not just signed.

Taipalsaari, FinlandGoverning jurisdiction · South Karelia
EU data residencyNo data leaves the region
GDPR-nativePrivacy by design & default
Updated 14 May 2026Across all documents

Privacy Policy

Last updated 14 May 2026 Version 3.1 ~6 min read

In plain terms

We collect what we need to run your account and your agents — nothing we sell. Your documents and prompts stay inside the EU region you choose, and we never use your content to train foundation models. You can export or delete your data at any time.

01Who we are

Nordic Intelligence Labs Oy (“Nordic Intelligence Labs”, “we”, “us”) is the data controller for the information described here. We are registered in Finland and reachable at the address in the Contact section below.

02Information we collect

We group the data we process into four categories:

CategoryExamplesSource
AccountName, work email, organisation, role, billing detailsYou, at sign-up
ContentDocuments, prompts, files, and outputs your agents processYou, in use
UsageFeature events, session metadata, device & browser typeCollected automatically
SupportMessages, diagnostics you share with our teamYou, on request

03How we use it

  • To provide the Alverion stack — running agents, the office suite, and live chat.
  • To secure accounts, prevent abuse, and meet legal obligations.
  • To bill correctly and support you when you ask.
  • To improve reliability and performance using aggregated, non-identifying metrics.

04Legal bases

We rely on the GDPR legal bases set out in the GDPR & Your Rights document — primarily performance of our contract with you, our legitimate interests in operating a secure service, your consent for optional analytics, and compliance with legal obligations.

05Your content & model training

We do not train foundation models on your content. Prompts, documents, and agent outputs are processed solely to deliver results back to you, then retained under the schedule below. Long-term agent memory is scoped to your organisation and never pooled across customers.

06Sharing & sub-processors

We do not sell personal data. We share it only with vetted sub-processors that help us run the service, each bound by a data-processing agreement. The current categories and their locations are listed under Data Residency.

07Retention

DataKept for
Account recordsLife of the account + 30 days
Content & agent memoryUntil you delete it, or 30 days after closure
Usage logs13 months, then aggregated
Billing recordsAs required by Finnish law (typically 6 years)

08Your rights

You can access, correct, export, or delete your data, and object to or restrict certain processing. See GDPR & Your Rights for the full list and how to exercise each one.

09Cookies & analytics

We use strictly necessary cookies to keep you signed in and the product secure. Optional, privacy-preserving analytics run only with your consent and can be withdrawn at any time from your settings.

10Contact

Privacy questions: privacy@nordicintelligencelabs.com. Data Protection Officer: dpo@nordicintelligencelabs.com. Postal address available on request — registered office in Taipalsaari, South Karelia, Finland.

Terms of Service

Last updated 14 May 2026 Version 2.4 ~7 min read

In plain terms

Use Alverion lawfully and you keep full ownership of everything you put in. We keep the service running and secure; you stay responsible for how your agents are used. AI output is powerful but not infallible — keep a human in the loop for decisions that matter.

01Agreement to these terms

By creating an account or using the service, you agree to these Terms. If you are accepting on behalf of an organisation, you confirm you have authority to bind it.

02The service

Alverion provides an agentic AI system, an open-source office suite, and sovereign cloud hosting. We may add, change, or deprecate features, giving reasonable notice of material reductions.

03Accounts & eligibility

  • You must be 18+ and provide accurate registration details.
  • You are responsible for safeguarding credentials and all activity under your account.
  • Notify us promptly of any unauthorised use.

04Acceptable use

You agree not to use the service or its agents to:

  • Break the law, infringe rights, or process data you have no right to.
  • Generate malware, run unauthorised scraping, or attack other systems.
  • Circumvent rate limits, security controls, or usage entitlements.

05Your content & intellectual property

You retain all rights to the content you submit. You grant us a limited licence to host and process it solely to operate the service for you. Our software, models, and brand remain ours.

06AI output & human oversight

AI-generated output may be inaccurate or incomplete. It is provided “as is” for your evaluation; you are responsible for reviewing it before relying on it, especially for legal, financial, or safety-critical decisions.

07Fees & billing

Paid plans are billed in advance on a recurring basis. Fees are exclusive of applicable taxes. Unless required by law, payments are non-refundable for partial periods.

08Availability

We target high availability and publish status at our status page. Scheduled maintenance is announced in advance. Specific uptime commitments, if any, are set out in your order or enterprise agreement.

09Disclaimers

Except where prohibited by law, the service is provided “as is” without warranties of merchantability, fitness for a particular purpose, or non-infringement.

10Limitation of liability

To the extent permitted by law, neither party is liable for indirect or consequential losses, and our aggregate liability is limited to the fees you paid in the 12 months before the claim. Nothing limits liability that cannot be limited under Finnish or EU law.

11Termination

You may close your account at any time. We may suspend or terminate for material breach, with notice where practicable. On termination you can export your data during a 30-day window before deletion.

12Governing law

These Terms are governed by the laws of Finland. Disputes are subject to the exclusive jurisdiction of the courts of South Karelia, Finland, without prejudice to mandatory consumer protections.

GDPR & Your Rights

Last updated 14 May 2026 Version 3.1 ~5 min read

In plain terms

The GDPR gives you real control over your personal data. Here are the legal grounds we rely on, the eight rights you can exercise, and exactly who to contact — including the Finnish regulator if you ever want to complain.

01Controller & processor roles

For your account and our own operations we act as the controller. For the content your agents process on your instruction, we act as a processor under your Data Processing Agreement, and you remain the controller.

02Legal bases we rely on

BasisWhen it applies
ContractRunning your account and delivering the service
Legitimate interestSecurity, abuse prevention, service reliability
ConsentOptional analytics and marketing communications
Legal obligationTax, accounting, and lawful requests

03Your eight rights

Art. 15

Access

Get a copy of the personal data we hold about you.

Art. 16

Rectification

Correct data that is inaccurate or incomplete.

Art. 17

Erasure

Ask us to delete your data where the law allows.

Art. 18

Restriction

Limit how we process your data in certain cases.

Art. 20

Portability

Receive your data in a machine-readable format.

Art. 21

Object

Object to processing based on legitimate interests.

Art. 7(3)

Withdraw consent

Withdraw consent at any time, without penalty.

Art. 22

No solely-automated decisions

Not be subject to significant decisions made without human review.

04How to exercise them

Email dpo@nordicintelligencelabs.com or use in-product controls. We respond within one month, extendable by two months for complex requests, and we will tell you if that applies.

05International transfers

Your data is stored and processed within the EU. In the rare case a transfer outside the EEA is unavoidable, we rely on European Commission Standard Contractual Clauses plus supplementary safeguards. See Data Residency.

06Automated decision-making

Agents assist and accelerate work, but we do not make decisions producing legal or similarly significant effects about you based solely on automated processing without meaningful human oversight and a route to contest the outcome.

07Complaints & your DPO

Our Data Protection Officer is reachable at dpo@nordicintelligencelabs.com. You also have the right to lodge a complaint with your local supervisory authority — in Finland, the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto).

Data Residency

Last updated 14 May 2026 Version 1.8 ~4 min read

In plain terms

You choose a European region; your prompts, files, model traffic, and backups stay there. Everything is encrypted in transit and at rest, and our sub-processors are EU-based and contractually bound to the same standard.

01Where your data lives

🇫🇮
Helsinki, FinlandPrimary EU region · default for new accounts
Live
🇩🇪
Frankfurt, GermanyEU region · selectable at provisioning
Live
🇸🇪
Stockholm, SwedenEU region · disaster-recovery & failover
Live

Your chosen region pins compute, storage, and model inference. We do not move your data between regions without your instruction.

02What stays in region

  • Prompts, documents, and files your agents process.
  • Model inference and intermediate computation.
  • Long-term agent memory and embeddings.
  • Encrypted backups and snapshots.

03Sub-processors

PurposeLocation
Cloud infrastructure & computeEU (Helsinki, Frankfurt, Stockholm)
Object storage & backupsEU, same selected region
Transactional emailEU
Payment processingEU / EEA

A current, named list is available to customers under NDA and on the in-product trust page. Material changes are notified in advance.

04Encryption

  • In transit: TLS 1.3 across all endpoints and internal service traffic.
  • At rest: AES-256 for storage, databases, and backups.
  • Key management: region-resident keys with strict, audited access.

05Access & sovereignty

Administrative access is limited to EU-based personnel under least-privilege controls, with logging and review. We resist unlawful third-country access requests and disclose only what the law strictly requires.

06Compliance & assurance

Our controls are built and audited against recognised frameworks including GDPR, ISO/IEC 27001, and SOC 2 principles. Current attestations and reports are available to customers on request.