Privacy Policy

1. Data Controller

The data controller responsible for your personal data is:

• Controller: FinnAdvisor Oy (Y-tunnus 3653078-3), Väliniitynkaari 8, 04330 Lahela, Finland.
• Website: finnadvisor.fi
• Contact: support@finnadvisor.fi

For all data protection enquiries — including requests to exercise your rights under GDPR — please contact us at the address above. We aim to respond within 30 days as required by Art. 12(3) GDPR. Where a request is complex or numerous, we may extend this by a further two months and will inform you of any such extension.

2. Data We Collect

We collect only the minimum data necessary to provide authentication and enforce service plan limits (data minimisation principle, Art. 5(1)(c) GDPR). We do not ask you for your name, address or phone number — your email address is the only identifying detail we request. Case text and documents you choose to submit may themselves contain identifying information; see §6.

What we do NOT collect

• Your password in readable form — if you set one, we store only a salted cryptographic hash of it (scrypt), never the password itself
• Payment card numbers or banking details — payments are handled entirely by Stripe
• Location data or device fingerprints
• Case analyses you do not save — these are processed to produce your result and are not kept against your account

3. Purpose and Legal Basis

We process your personal data only for specified, explicit, and legitimate purposes (Art. 5(1)(b) GDPR). The table below maps each processing activity to its legal basis under Art. 6 GDPR.

Where we rely on legitimate interests (Art. 6(1)(f)), you have the right to object to that processing at any time (see §11).

4. Special Category Data

The case descriptions you voluntarily submit for AI analysis may contain information that constitutes "special category data" under Art. 9 GDPR — for example, details relating to your health, religion, ethnicity, or immigration status. Such information is submitted entirely at your own discretion.

The legal basis for processing any special category data you voluntarily include in a case submission is Art. 9(2)(a) GDPR — your explicit consent, given at the point of submission by choosing to include such information. You may omit sensitive details at any time without affecting the usefulness of the analysis for most questions.

5. Automated Decision-Making

Certain decisions about your account are made automatically without human review:

• Plan limit enforcement: When you have used your plan's analysis allowance, the system automatically blocks further analyses until you buy more. The allowance does not renew monthly: a free trial's single analysis is counted from the day the account was created, and a paid pack's credits from the day it was bought. This is based solely on the usage counter stored in your account.
• Session validation: Your session token is automatically verified on each request; expired or invalid tokens result in automatic sign-out.

These automated decisions are necessary for the performance of your contract (Art. 22(2)(a) GDPR) and do not produce legal effects or similarly significant effects beyond temporary service restrictions. You have the right to request human review of any access decision you believe is incorrect by contacting support@finnadvisor.fi.

6. Storage and Infrastructure

FinnAdvisor is hosted on Vercel. The serverless functions that receive and process your case are pinned to the EU (Frankfurt) region, so your case content is processed within the European Economic Area. Static pages and files are served from Vercel’s global edge network and may be delivered from outside the EEA; those files contain no personal data, though the connection itself carries your IP address to the location serving them. Your account and case data are stored in Upstash Redis, in the EU (Frankfurt) region.

Email delivery (magic links) is handled by Resend. Resend processes your email address only to transmit the authentication email; no email content or address is retained by Resend beyond delivery.

AI analysis requests are sent to Anthropic’s API (United States — see §7 for transfer safeguards). The case text and any documents you upload are sent as you provide them. Because these are usually official letters and decisions, they may contain personal data about you — including your name, address and personal identity code. We do not remove these details before sending. You can reduce what you share: cover or black out details you do not want to submit. The analysis works from the substance of the decision, not from your identifying details. Anthropic does not use API inputs to train its models.

7. International Data Transfers

Some of our processors are located outside the European Economic Area (EEA). We ensure appropriate safeguards are in place for each transfer as required by Chapter V GDPR:

You may request a copy of the relevant SCCs by contacting support@finnadvisor.fi.

8. Data Retention

We retain personal data only for as long as necessary for the purpose for which it was collected (Art. 5(1)(e) GDPR — storage limitation):

To request deletion of your account and all associated data, email support@finnadvisor.fi with the subject line "Account Deletion Request". We will process the request within 30 days and confirm when completed.

9. Third-Party Processors

We engage the following sub-processors under data processing agreements consistent with Art. 28 GDPR. Each processor may only process data on our documented instructions:

We do not sell, rent, or trade your personal data to any third party for their own commercial purposes.

10. Cookies and Analytics

We use two categories of cookies:

Strictly necessary cookies

These cookies are essential for the service to function. They are set automatically upon login and do not require separate consent under Art. 5(3) of the ePrivacy Directive:

Analytics cookies

We use Google Analytics 4 on our landing page and application to measure aggregate, anonymous usage statistics. These cookies are set only after you consent via the cookie banner shown on your first visit.

Legal basis for analytics cookies: Art. 6(1)(a) GDPR — your consent, given via the cookie banner. You may withdraw consent at any time by:

• Using the Google Analytics opt-out browser add-on
• Blocking cookies in your browser settings
• Emailing support@finnadvisor.fi to request that we cease analytics tracking on your account

We do not use advertising cookies, retargeting pixels, or cross-site tracking.

11. Your Rights Under GDPR

As a data subject under GDPR you have the following rights. To exercise any of them, contact us at support@finnadvisor.fi. We will respond within 30 days (Art. 12(3) GDPR) at no charge.

• Right of access (Art. 15): Request a copy of the personal data we hold about you and information about how it is processed.
• Right to rectification (Art. 16): Ask us to correct inaccurate or incomplete personal data without undue delay.
• Right to erasure — "right to be forgotten" (Art. 17): Request deletion of your personal data where there is no overriding legitimate reason for us to continue processing it (e.g., where it is no longer necessary for the purpose it was collected).
• Right to restriction of processing (Art. 18): Ask us to restrict processing of your data — for example, while you contest its accuracy or object to our use of it. During restriction, we may store the data but not process it further without your consent (except for legal claims or to protect rights of another person).
• Right to data portability (Art. 20): Receive your data in a structured, commonly used, machine-readable format (e.g., JSON) and transfer it to another controller, where processing is based on consent or contract and carried out by automated means.
• Right to object (Art. 21): Object at any time to processing based on legitimate interests (Art. 6(1)(f)), including analytics. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Rights related to automated decisions (Art. 22): Request human review of any automated decision that affects you (see §5).

Supervisory authority complaint

You have the right to lodge a complaint with the Finnish Data Protection Ombudsman (Tietosuojavaltuutettu) if you believe we have processed your data unlawfully, without prejudice to any other administrative or judicial remedy:

• Website: tietosuoja.fi
• Email: tietosuoja@om.fi
• Postal address: Lintulahdenkuja 4, 00530 Helsinki, Finland

Judicial remedy

In addition to lodging a complaint with a supervisory authority, you have the right to an effective judicial remedy under Art. 79 GDPR and §16 of the Finnish Data Protection Act (Tietosuojalaki 1050/2018). You may bring proceedings against us before the competent courts in Finland (where we are established) or in the EU member state where you are habitually resident.

12. Security

We implement appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, or unauthorised disclosure (Art. 32 GDPR):

• All data in transit is encrypted via HTTPS (TLS 1.2 or higher).
• Session cookies are set with the HttpOnly and Secure flags, preventing client-side JavaScript access.
• You can sign in two ways: a one-time magic link sent to your email, or a password you set. If you set a password, we never store the password itself — only a salted scrypt hash, from which the password cannot be recovered.
• Access to Upstash Redis is restricted by secret credentials held only in server-side environment variables, never exposed to the client.
• Short-lived data is given an expiry when it is written: sign-in links, sessions and cached results are removed automatically. Your case content is not on a timer — it remains until you delete it, or until the retention periods in section 8 are reached.
• Access to production credentials is limited to the minimum number of personnel necessary.
• What is not encrypted: your plan, the language you chose, consent and account timestamps, case identifiers and case type, counters for the analyses and searches you have used, and your email preferences. None of these describes your legal situation. Your email address is stored encrypted, and the keys your data is stored under are derived from a pseudonym, not from your address.

No method of transmission over the internet is 100% secure. In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify you and the Finnish Data Protection Ombudsman within 72 hours as required by Art. 33–34 GDPR.

13. Data Protection Officer

We have not appointed a Data Protection Officer. You can raise any data protection question with us at support@finnadvisor.fi. You also have the right to contact the Finnish Data Protection Ombudsman (tietosuoja.fi) at any time.

All data protection enquiries should be directed to the data controller at support@finnadvisor.fi.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. When we make material changes, we will:

• Update the "Last updated" date at the top of this page;
• Notify registered users by email where the change is material and affects their rights;
• Where required by law (e.g., a change in legal basis), obtain fresh consent before the change takes effect.

We encourage you to review this policy periodically. Questions? Contact us: support@finnadvisor.fi