Privacy notice

Updated 20 October 2026 · Hercules, Midas and Nexus

This notice covers Hercules, Midas and Nexus, operated by Yasa Oy (Yasa Ltd.), Finland. It explains what we process, why, and how you can exercise your rights.

Who is responsible

Yasa Oy (Yasa Ltd.), Business ID 3381986-4, is the controller for account administration, service security, support and its own customer relationship records. Contact: info@yasa.fi. Our business contact information is available on Yasa.fi.

When a business or organisation uses a workspace to manage its customers, team members, invoices or hosted content, that organisation normally determines why that information is used. It is the controller and Yasa processes the workspace information on its instructions. Contact the workspace owner about its activities; you may also contact us and we will help route your request. The data-processing terms explain this relationship.

The information we use and why

• Accounts and access: name, email address, account identifiers, password hashes where password sign-in is used, verification and recovery records, invitations, memberships and preferences. We use these to provide your account and requested services under our contract with you. For an organisation's users, we also rely on our legitimate interest in administering that organisation's service and controlling access.
• Hercules: projects, tasks, subtasks, dependencies, comments, assignments, work estimates, schedules, notifications and saved views provided by you or workspace members.
• Midas: company and customer details, products, invoices, payment records, attachments, billing history and reports. Selected billable Hercules work can be added to a Midas draft when an authorised user requests it.
• Nexus: invited users, roles, assigned resources, hosting and infrastructure settings, files and operational records. Every Nexus login requires an invitation; a Hercules or Midas account does not grant Nexus access.
• Security and support: request information, including IP addresses, authentication events, operational logs and correspondence. Our legitimate interests are protecting accounts, investigating incidents and keeping the services reliable. We use relevant records to meet legal obligations or establish, exercise or defend legal claims where necessary.

We obtain information from you, your organisation and collaborators, your chosen sign-in provider, and the service operations you request. Account and access information is necessary to provide an authenticated service; without it, we cannot create or maintain that access. Workspace owners decide which additional information to enter and must have a lawful basis for it. We do not sell personal information or use account or workspace content for advertising. We do not make decisions with legal or similarly significant effects solely through automated profiling.

Google sign-in

Google sign-in requests only openid, email and profile. We receive your Google identifier, verified email and profile information, including your name, to verify identity and connect your account. Google handles your Google password. We do not request access to your Gmail, Google Drive, contacts or Calendar. Authentication credentials and tokens are used to complete and protect sign-in; they are not exposed to other workspace members.

Hercules and Midas share an account identity, with separate app sessions and workspace permissions. Nexus has its own invitation and permission checks. Signing in to one app does not grant access to another organisation's records. You can review or remove Google's access grant in your Google Account connections. Revoking it stops future Google authorisation but does not erase records already held by Yasa. Contact us for account closure or erasure. Where available, account settings let you connect Google or set a separate Yasa password.

Who can receive information

Workspace members see information allowed by their roles. Authorised Yasa personnel may access information when needed for service delivery, support, security or legal obligations. We use these infrastructure providers:

• Hetzner: server hosting and infrastructure in Finland for the deployed services.
• Cloudflare: DNS, HTTPS proxying and network protection; requests pass through its network.
• Google: Google sign-in and Google Workspace SMTP relay for account messages, invitations and requested email deliveries. Email recipients and their providers receive messages that authorised users send.

Core application storage is on our Finnish hosting infrastructure. Google and Cloudflare operate internationally and may process information outside the European Economic Area. Their applicable data-processing terms provide transfer safeguards, including standard contractual clauses where required. See Cloudflare's data-processing terms and Google Workspace's data-processing terms. Google sign-in is also subject to Google's privacy policy. Contact us for information about the safeguards applicable to your service. We disclose information to authorities only when lawfully required.

How long information is kept

Account information is kept while your account or workspace needs it. Closing an account does not automatically remove records belonging to a shared workspace. Session and verification credentials expire after their configured validity periods; ordinary Hercules and Midas app sessions expire after eight hours. Expiry prevents further use even where a diagnostic record remains.

Midas preserves business records, original documents and revision history; archive and cancellation actions do not erase them. Its current storage has no automatic business-record deletion schedule. This supports recordkeeping, but does not make indefinite retention of every personal detail necessary or lawful. Workspace owners must determine their applicable retention duties. Finnish accounting rules generally require core accounting records for at least ten years and vouchers and related material for at least six years, calculated as specified in the Accounting Act. Other obligations may differ.

We assess closure and erasure requests against the relevant purpose, controller instructions, statutory retention periods and legal claims. Records no longer needed must be removed or anonymised through a controlled process; records that must be retained are restricted to the continuing purpose. Recovery copies are separate from live data and are not immediately changed by an account closure. A request includes review of relevant retained copies and safeguards against reintroducing erased information. Contact us before relying on an archive or account action as deletion.

Your rights and requests

Depending on the legal basis and circumstances, you can request access, correction, erasure, restriction, portability, and object to processing based on legitimate interests. Where processing relies on consent, you can withdraw it without affecting earlier lawful processing. These rights are not absolute: for example, required accounting records may need to be retained.

Email info@yasa.fi, identify the app and workspace, and tell us what you need. Do not send passwords. We may ask for proportionate identity or authority verification. We respond without undue delay, normally within one month; if a lawful extension is needed, we explain it within that month. You can complain to Finland's Office of the Data Protection Ombudsman or the supervisory authority where you live or work. Contacting us first is optional.

Cookies and browser storage

The apps use cookies needed for sign-in, request protection and service operation. These include the app session cookie, short-lived sign-in state and, in Hercules, the native session. Nexus uses its own Google gateway and application sessions. Browser storage retains interface choices such as language, display preferences and saved-view state. Blocking essential storage can prevent sign-in or saving those choices.

The current apps do not use advertising cookies or third-party marketing analytics. Links to Google reviews or another external website open that provider's service; its own privacy and cookie rules apply there. Optional tracking would require a separate choice before activation. We will update this notice when processing changes and give additional notice where required.