Privacy and cookies

Controller and contact

RDMAIC Oy is the controller for personal data described in this notice.

RDMAIC Oy
Business ID 3418291-7 · Joensuu, Finland
jukkis@rdmaic.com

What information is processed

Website analytics

RDMAIC uses Plausible Analytics to understand aggregate website use. Plausible does not use cookies or persistent cross-site identifiers for website analytics. The site may measure interactions such as which service area and visible contact link was clicked, but the email address, prefilled email subject, and message body are not sent to analytics.

Technical delivery of the site

The site is hosted on Vercel. As with normal web hosting and content delivery, technical request information such as IP address, browser information, requested URL, timestamps, and security-related request data may be processed as necessary to deliver, protect, and operate the site.

When you contact RDMAIC

If you contact RDMAIC by email or another channel, RDMAIC processes the information you provide, such as your name, email address, organization, role, message, and subsequent correspondence. If the discussion becomes a customer relationship, proposal, contract, invoicing, and other necessary business-administration information may also be processed.

Course Spaces: progress and notes in your browser

Course Spaces can store progress and notes in your browser using localStorage. That browser-local state is not sent to RDMAIC by the Course Space feature and is not used for advertising or tracking. It remains on that browser until you clear the relevant browser storage or the application data is otherwise removed.

AI Demonstrations: semantic checks, Catapult, inventory, Work System Explorer and Loopworks

The AI Demonstrations area is accessed with a shared workshop password and does not require a named personal account. This is a training/demo environment, not a place to submit real customer or employee information. If someone nevertheless enters information about an identifiable person, that information may be personal data.

Semantic Data Quality and Lean suggestions

When you choose Check with AI or request a Lean countermeasure, your submitted text is processed by RDMAIC through a Supabase Edge Function and sent to the Mistral AI API to classify the type of text or generate a suggested process change. The result is shown back to you. RDMAIC does not intentionally save these texts or AI responses in its demonstration database or Supabase Storage. This does not mean the information stays only in your browser: service providers process the request and may handle technical logs. Depending on the AI provider’s account-level data controls and contract, API content may also be eligible for service improvement or model training; an opt-out must not be assumed without verification.

Catapult Improvement Game

The Catapult workshop stores a pseudonymous participant identifier, team and role selection, readiness and participation timestamps, round/shot results, and optional written friction points, improvement ideas and follow-up reflections in the RDMAIC Supabase database. Participants are not asked for their names, but a pseudonymous identifier distinguishes browser/team participation. The instructor may view and export workshop results and notes; exported files are separate from the automatically cleared workshop database.

Inventory Automation Lab (deterministic simulation)

The inventory demonstration uses fictional products, stock levels, rule thresholds and simulated purchase order approvals. These values are processed only in the browser application memory and are not sent to Supabase, an AI model, ERP, n8n, Power Automate or a supplier, and they are not persisted in localStorage or sessionStorage. Reloading the page resets them. The shared demo access session and normal website hosting/analytics still operate as described here.

Adaptive Work System Explorer (fictional browser simulation)

The Work System Explorer simulates deterministic, AI-informed and agent-directed workflow steps, human clarification, retries and process-improvement experiments using repository-owned fictional cases. All selections, event traces and comparisons stay in React/browser memory and reset on reload. No real AI, agent, customer information, external tools or database are used. No additional localStorage, sessionStorage or analytics events are introduced; the existing shared password/session and ordinary website hosting/analytics still operate.

Loopworks: facilitated process-design rehearsal

Loopworks stores a workshop identifier and join code, selected team and joined status, a predefined decision, server-calculated simulation results, model/scenario configuration, revision numbers and timestamps in the RDMAIC Supabase database. No names or free text are requested. The facilitator can view the four teams; participants receive only their selected team. This is pseudonymous workshop activity, not guaranteed anonymous information. All business cases are fictional. No workshop content is sent to an AI provider, bank or supplier, and no real payments or staff assessments are made. Loopworks uses this tab’s sessionStorage for access tokens, the selected team and the last workshop reference; it does not introduce localStorage or cross-site tracking. LW1 has no export function. Ordinary hosting and security logs remain subject to the provider practices described in this notice.

Access and browser storage

The demo access session and team/instructor authorization tokens are stored in browser sessionStorage, with signed tokens lasting up to 12 hours. The Catapult feature also stores a pseudonymous participant/team identifier in browser localStorage so the same browser can resume a workshop. Browser-local information may remain until the browser clears it or you remove it, even after the server deletes the workshop data.

Please use example information: Do not enter names, contact details, health information, personal or confidential customer/employee information, or other sensitive material into semantic text fields or workshop free-text notes. AI suggestions are drafts for learning, not decisions about people or proven countermeasures.

Why information is processed and the legal bases

Operate, secure, and improve the website

Legitimate interest in providing a reliable website and understanding aggregate use with privacy-preserving analytics.

Respond to enquiries and discuss possible work

Legitimate interest in business communication and, where applicable, steps requested before entering into a contract.

Deliver agreed services and manage the customer relationship

Performance of a contract where applicable and legitimate interest in managing business contacts.

Operate limited-access AI Demonstrations and workshops

Legitimate interest in offering training examples, protecting shared access and supporting group exercises; where a workshop is provided under an agreement, performance of that agreement may also apply.

Accounting, taxation, and other mandatory records

Compliance with legal obligations.

Service providers and recipients

RDMAIC uses Vercel for website hosting, Plausible for privacy-focused web analytics, Supabase for the AI Demonstrations backend and temporary Catapult and Loopworks records, and Mistral AI to process text submitted for semantic checking or Lean countermeasure suggestions. The Catapult instructor can access and export its workshop records; the Loopworks facilitator can view rehearsal results. Email and other ordinary business IT providers may process business correspondence where necessary. Personal data is not sold to advertisers.

International transfers

Plausible states that website analytics data is processed in the EU. The AI Demonstrations Supabase project is hosted in the EU, and the Mistral integration defaults to an EU inference endpoint. This does not guarantee that all provider administration, security logs, support or subprocessors remain within the European Economic Area. Where data is transferred outside the EEA, an applicable adequacy decision, standard contractual clauses or another lawful safeguard is required. Ask RDMAIC for details of the arrangements relevant to your data.

How long information is kept

• Website analytics is retained according to the configured analytics service and only for as long as it remains useful for understanding site performance.
• Technical hosting and security logs are retained according to the provider’s operational and security settings and only for as long as needed for those purposes.
• Enquiry and business correspondence is kept only for as long as reasonably necessary to handle the enquiry, manage relevant follow-up, establish or manage a business relationship, or protect legitimate legal and business interests. When those purposes no longer apply, the information is removed from active use or deleted according to normal record-management practices.
• Customer, contract, invoicing, and accounting information is kept for the duration of the relationship and for the periods required by applicable accounting, tax, contract, and other legal obligations.
• Course Space progress and notes stored in localStorage remain in your browser until you clear that browser storage or the data is otherwise removed locally.
• Catapult workshop records are normally deleted from the Supabase demonstration database when the workshop is more than 36 hours old; an hourly automated task performs the cleanup. Copies the instructor separately exports are not deleted by that task.
• Loopworks workshop access expires 36 hours after creation. An hourly cleanup task removes expired database records on its next run; this is not a promise of deletion at the exact expiry instant. Access-token validity is separately limited to 12 hours. Tab-local references remain until the browser session or relevant storage is cleared; provider technical logs follow their separate retention settings.
• RDMAIC does not intentionally retain submitted semantic-demo text or AI responses in its own demo database or Supabase Storage. Mistral AI states that its standard API service may retain inputs and outputs for 30 days for abuse monitoring unless an approved zero-data-retention arrangement applies. Technical service logs follow the relevant providers’ retention settings.
• Demo and instructor access tokens remain in sessionStorage until the browser session ends or the storage is cleared (the signed token expires after 12 hours). Catapult’s pseudonymous participant/team identifier in localStorage can remain until cleared by the user or the application.

Cookies and similar browser storage

The current public RDMAIC site does not use analytics or advertising cookies, or other non-essential cookie-based tracking, so it does not show a general cookie-consent banner.

Plausible Analytics

Cookie-free aggregate analytics without persistent cross-site identifiers.

Course Space localStorage

Functional browser-local storage for progress and notes. It is not an advertising or cross-site tracking mechanism.

AI Demonstrations sessionStorage

Functional signed access tokens for the password-gated demos, team participation and instructor controls. Loopworks also retains the selected team and last workshop reference in this tab.

Training materials cookie (rdmaic_materials)

Functional. Set only when you open the training materials from the unlocked AI Demonstrations hub: a copy of the signed demo access token, limited to the protected training paths (/materials/, /fi/courses/green-belt-control and /course-spaces/green-belt-control/; one copy per path), Secure and SameSite=Strict, expiring after 12 hours. It is used only to check access before the password-protected materials are served; it contains no personal data and is not used for analytics or tracking.

Catapult localStorage

Functional pseudonymous participant/team identifier to allow workshop resumption in the same browser. Not used for cross-site tracking.

YouTube

Video previews use local site assets. YouTube is not contacted by the embed until you choose to play a video. Playback then loads the privacy-enhanced youtube-nocookie.com player, and Google/YouTube may process technical connection and viewing data under their own terms.

If RDMAIC later adds a technology that requires consent before use, it will not be enabled for visitors until the necessary consent mechanism and information are in place.

External links and media

Links to services such as LinkedIn and YouTube do not load those services merely because they are present on a page. When you follow an external link or activate third-party media, the external provider processes the interaction under its own privacy terms.

Your data-protection rights

Depending on the processing and legal basis, you may have the right to access your personal data, correct inaccurate data, request deletion or restriction, object to processing based on legitimate interests, and receive data in a portable format where the legal conditions apply. If processing were based on consent, you could withdraw that consent at any time without affecting earlier lawful processing.

To exercise your rights or ask a privacy question, contact jukkis@rdmaic.com. RDMAIC may need enough information to verify the request and identify the relevant data.

You also have the right to lodge a complaint with a competent supervisory authority. In Finland: Office of the Data Protection Ombudsman.

Automated decisions

AI Demonstrations automatically classify submitted text and may suggest a Lean countermeasure; the application routes demo feedback using its own rules. These educational functions do not determine a person’s legal rights or make decisions with similarly significant effects. RDMAIC does not use the website data described here for such decisions.

Changes to this notice

This notice describes the current website and contact practices. It will be updated when those practices change materially.