# Kuori Auth terms and privacy

# Privacy policy

Kuori Oy is the controller for the personal data described here. Kuori Auth is the sign-in
service for Kuori's applications, and Kuori runs it on its own servers. Its only job is to
establish who you are. What an application does with your data after you have signed in is
described in that application's own privacy policy, not here.

Questions about data privacy go to your Kuori representative or to signage@kuori.tech.

## How you sign in

Kuori Auth hosts the sign-in page, so the applications never see your password or your code.
There is no password to begin with. You sign in one of three ways:

- **An emailed code.** You enter your email address and we mail you a one-time code. It
  expires in 10 minutes and works once.
- **Google.** Google authenticates you and tells us your email address, name, and a link to
  your profile image. Google learns that you signed in to a Kuori service. What Google does
  with that is covered by Google's own privacy policy.
- **Your organisation's own single sign-on**, where your organisation has asked us to connect
  it. Your organisation authenticates you and sends us your email address and name. Its own
  privacy notice governs what it does.

You cannot create an account here. Identities exist because an application created one for
you, and an application creates one only when someone entitled to grant you access does so.

## What Kuori Auth stores

- Your identity. Email address, name, a link to your profile image, and the link to your
  Google account or to your organisation's single sign-on where you use one.
- Sign-in events. The time, the method, and the outcome. These records can contain your email
  address.
- Failed attempts, for lockout. Ten failed attempts within an hour lock the address for 10
  minutes.

Nothing about what you are allowed to do is stored here. Roles, permissions and which
organisation you work for belong to the applications.

## What Kuori Auth tells an application about you

When you sign in to an application, it receives a permanent identifier for your identity,
your email address, and a flag saying the address is verified. Your name and profile image
link come along when the method you used provides them.

No role, permission, or organisation membership is ever carried in a sign-in token. Each
application decides on its own what you may see and do, and refuses you if it has no record
of you.

## Sessions and cookies

Kuori Auth keeps a sign-in session in a cookie on its own address, which is what lets one
sign-in serve several Kuori applications. Each application issues its own separate session
and controls how long that lasts.

Signing out from inside an application ends that application's session and also ends the
Kuori Auth session, so the next sign-in asks who you are again. Sessions that simply expire
end only in the application.

## How long we keep it

Your identity lives as long as at least one Kuori application uses it. A monthly job disables
identities that no application uses any more and deletes them permanently 60 days after that.
Deletion is final. If you return later, you are a new identity everywhere.

Database backups are deleted 30 days after they are taken, so a deleted record can survive in
them until then, and no longer.

Sign-in event records have no automatic expiry today. We delete them on request as part of an
erasure, and we are working on pruning them on a schedule.

## Your rights

You can ask for a copy of the personal data we hold about you, ask us to correct it, or ask us
to erase it. Erasure removes your records from every Kuori application and then permanently
deletes your identity here, without waiting for the monthly job. Backups taken before the
request hold the older state until they age out 30 days later, and an application may keep
records it has to keep for its own reasons, which its privacy policy explains.

Where we process your data on the basis of our legitimate interests, you can object to that
processing under Article 21 and ask us to explain why our interest overrides yours in your
case.

Send any of these requests to signage@kuori.tech. If you are not satisfied with how we handle
one, you can complain to your national data protection authority. In Finland that is the
Office of the Data Protection Ombudsman.

## Sharing

Kuori Auth runs on Kuori's own infrastructure, so no external identity vendor holds your
sign-in data. Google receives data only if you choose to sign in with Google, and your
organisation's identity provider only if you sign in through it. Your data is not shared with
anyone outside Kuori Oy for commercial purposes.