Privacy Policy — The Library Navigator
Last updated: 11 October 2026
This Privacy Policy explains how personal data is processed when you use The Library Navigator (the “Service” or “Navigator”). The Navigator is provided by Raylab Oy under the Biblioworks.ai internal unit.
We designed the Navigator with data minimisation in mind: it aims to work without identifying you as a named person and without using tracking cookies.
1) Who is responsible for your data?
Responsibility depends on who decides why and how your data is processed in a given deployment.
A. Library deployment
(Library = Controller, Raylab Oy = Processor)
When the Navigator is provided as part of a library’s services (e.g., integrated in library websites/catalogues), the library typically decides the purposes and means of processing.
- Data Controller: the relevant Library / Consortium (details provided by that library)
- Data Processor: Raylab Oy (Biblioworks.ai)
Address: Ilmattarenkuja 22 – 00610 Helsinki – Finland
Privacy contact: loading…
In this model, Raylab Oy processes personal data only on documented instructions from the library under a Data Processing Agreement (DPA).
B. Direct Biblioworks/Raylab deployment
(Raylab Oy = Controller)
In some cases, Raylab Oy may operate the Navigator directly (for example, demos, pilots, or deployments where Raylab decides the purposes and means of processing).
- Data Controller: Raylab Oy (Biblioworks.ai)
Address: Ilmattarenkuja 22 – 00610 Helsinki – Finland
Privacy contact: loading…
2) What data we process
Depending on configuration, the Navigator may process:
A. Data you provide
- Chat messages you type into the Navigator
- Feedback you submit (e.g., thumbs up/down and optional text)
- Support requests if you contact us directly
B. Library data (only if enabled and only when needed)
If the deployment enables it, the Navigator may access:
- Current loans and Loan history
C. Technical and security data
- Timestamps, service events, error details
- Security/audit data for abuse prevention and reliability
- Limited device/browser metadata (e.g., user agent)
About identifiers and “anonymity”
The Navigator is designed to avoid stable identifiers:
- We do not use a stable patron identifier as a long-lived identifier in the Navigator.
- Where library integrations require a technical token to retrieve loan-related information, it is used session-scoped and not retained as a stable identifier.
3) Why we process data (purposes) and legal basis
| Purpose | Examples of data | legal basis |
|---|---|---|
| Provide the chat service and answers | Chat messages, session/security events | Contract, legitimate interests, or public task (depends on Controller) |
| Provide library-personalised features (if enabled) | Current loans; (optionally) loan history | Often public task for loans; consent is commonly used for loan history |
| Security and abuse prevention | Security logs, rate limiting signals | Legitimate interests / public task |
| Quality improvement & debugging | Error logs, feedback | Legitimate interests / public task |
Loan history: In deployments where loan history is used, the Controller will ensure an appropriate legal basis. Your consent is recorded and stored for this purpose.
4) AI model use and human review
The Navigator generates responses using AI. The Service:
- does not perform automated decision-making that produces legal or similarly significant effects on you.
- may be reviewed by authorised staff only where needed (e.g., support, security incidents, debugging), and subject to access controls.
5) Where data is processed (data residency)
Data is processed EEA-only. Storage and processing are configured to remain in the EU/EEA.
- Hosting: Google Cloud, Finland region (EEA)
6) Who we share data with (sub-processors)
Raylab Oy uses the following categories of service providers (“sub-processors”) to operate the Navigator:
- AI model providers: OpenAI, Anthropic
- Cloud hosting: Google Cloud (Finland)
For The Library Navigator for iOS and Android, the AI model providers are OpenAI, Anthropic and Google. Depending on the request and service configuration, a message and relevant conversation context may be processed by one or more of these providers.
We ensure appropriate contractual safeguards are in place (including DPAs/sub-processor terms as required). In library deployments, sub-processor use is covered by the DPA with the library.
7) International transfers
We aim for EEA-only processing, and the Service is configured accordingly. If a deployment ever required processing outside the EEA, we would implement appropriate safeguards (e.g., EU Standard Contractual Clauses) and update this policy and/or the relevant deployment documentation.
8) Data retention
Your stated retention settings are:
- Chat content: 1 year
- Technical/security logs: 1 year
- Feedback events: 1 year
- Consent records (for loan history and similar features): stored as long as needed to demonstrate consent and comply with legal obligations, and at least for the retention period of the related feature usage (typically aligned to the 1-year period unless a longer compliance need exists).
In library deployments, the Controller may specify different retention rules contractually; where so, Raylab Oy follows the Controller’s documented instructions.
9) Cookies and tracking
The Navigator does not use cookies for tracking.
10) Your rights (GDPR)
Depending on who is the Controller (Section 1), you may have the right to:
- Access your personal data
- Rectify inaccurate data
- Delete data (in certain cases)
- Restrict or object to processing (in certain cases)
- Data portability (in certain cases)
- Withdraw consent at any time (where consent is the legal basis)
- Lodge a complaint with a supervisory authority
How to exercise your rights
- If the Navigator is provided by a library: contact the library / consortium (they are typically the Controller).
- If Raylab Oy is the Controller for your deployment: contact loading… .
If you contact Raylab Oy about a library-controlled deployment, we will direct/route your request to the Controller where appropriate.
11) Security
We apply organisational and technical measures designed to protect data, including:
- Encryption in transit (TLS)
- Access controls and least-privilege
- Monitoring and incident response procedures
- EU/EEA-only processing configuration
12) Changes to this policy
We may update this Privacy Policy periodically. Updates will be published on this page with a new “Last updated” date.
13) Contact details
Raylab Oy (Biblioworks.ai)
Address: Ilmattarenkuja 22 – 00610 Helsinki – Finland
Email:
loading…
Business ID: 3105533-8
14) The Library Navigator for iOS and Android
This section applies to The Library Navigator iOS and Android apps provided directly by Raylab Oy under Biblioworks.ai. Raylab Oy is the controller for these apps. The apps provide information about the Kyyti library network and are not official Kyyti apps. The direct-deployment terms above apply; the apps do not use library-account or loan-history features.
You can use the app without an account or library card. It does not request your library login, current loans or loan history. Please avoid putting personal or sensitive information in chat. Technical session and message identifiers let the service deliver and continue conversations; using the app without an account does not mean every message is free of personal information.
Messages, AI processing and feedback
When you agree to AI processing and send a question, the app sends your message and relevant conversation context to the Biblioworks service to generate an answer. Depending on the request and configuration, OpenAI, Anthropic and/or Google process this information. A request does not necessarily go to every provider. Conversations are not used to train AI models.
The service processes generated answers, technical session/message identifiers and any ratings you submit. Technical and security data support reliable operation and abuse prevention. Authorised staff may review content when needed for support, security incidents or debugging, subject to access controls, as described above. AI answers can be inaccurate; confirm important information with your library.
Your permission and choices
Before your first chat request, the app explains AI processing and asks you to agree. You may decline and still read Home and previously saved answers when access to those answers is enabled. Settings → AI and privacy lets you review the explanation and withdraw permission. Withdrawal stops an active response and new chat-service actions until you agree again; it preserves existing local chat and saved answers.
The device remembers your permission choice, the disclosure version and the time you agreed. You can clear local chat and delete saved answers separately in Settings. The purposes and legal bases described in section 3, and the AI-use and human-review terms in section 4, apply to this direct deployment. The iOS and Android apps’ AI permission does not enable loan-history access or unrelated data processing.
Data on your device
Local chat history is cleared when you open or return to the app after one hour without activity. A stored snapshot may remain while the app is closed until this cleanup runs. You can clear chat earlier in Settings. This local cleanup does not delete the server’s records.
Saved answer text stays on the device until you delete it, including after New Chat or when recommendation features are disabled. When enabled, Settings → Saved recommendations lets you read, share and delete saved answers. A saved-data deletion control remains available when recommendation features are disabled.
Saved text can be read offline. Images and external links may contact their hosting websites and need an internet connection. Sharing sends the selected text to the destination you choose, whose own privacy practices apply. The app securely stores an anonymous session credential for conversation continuity and stores local preferences and the AI permission record. These are not library-card credentials.
On Android, the app stores chat text, saved answers, preferences and the version and time of AI permission on your device. Anonymous service credentials are encrypted using Android Keystore. App data is excluded from Android backup and device transfer. Local chat is cleared when you open or return to the app after one hour without activity; a stored snapshot may remain while the app is closed. Saved text remains until you explicitly delete it and can be read offline. Images and source links may contact their respective hosts and need an internet connection. Clearing local data does not delete service records. Withdrawing AI permission stops an active response and prevents further chat, recovery, feedback and report requests; it does not delete earlier service records. On Android versions with a Send report button, you can choose to submit the selected reason, optional details, answer reference and anonymous service identifier directly to Biblioworks for review. This uses the existing feedback service and also records the answer as unhelpful. Please avoid including personal or sensitive information. Reports are sent only when you choose Send report and are retained with service feedback under the retention described above. Withdrawing AI permission prevents further in-app report requests; it does not remove reports already received. You can also prepare an email, copy or share draft that you review and choose to send. Sending an email exposes your sender information to your selected email service and Raylab Oy.
Server retention and locations
The one-year retention periods in section 8 apply to the iOS and Android service’s chat content, feedback and technical/security logs. The EU/EEA-only processing terms in sections 5 and 7 apply to the iOS and Android service, including its AI processing. Hosting is Google Cloud in Finland. Requests for deletion of server-held data can be made through the privacy contact below; clearing data on your phone alone does not make that request.
Answer reports, support and privacy requests
Report answer prepares a draft to loading… containing the selected reason, optional comments, the selected answer and its available message/conversation references. You review it and explicitly send it through your email app. The app does not send a report automatically. If Mail is unavailable, you can copy or share the draft and choose how to send it.
If you send a report, Biblioworks receives the message and sender information supplied by your email service, such as your email address. We use it to investigate the reported answer and respond where appropriate. Your chosen email or sharing service applies its own privacy practices. Reports and support emails are processed as support requests under this policy. Avoid including unnecessary personal or sensitive information.
General app support and TestFlight feedback: loading… . Privacy questions, answer reports and requests to exercise applicable data rights: loading… . To locate an account-free conversation and verify a privacy request, Raylab Oy may ask for relevant information; please do not send unnecessary personal information. The rights and supervisory-authority information in section 10 apply.