Legal
Last updated: 23 October 2026 · Applies to all users of FinnAdvisor
Contents
The data controller responsible for your personal data is:
For all data protection enquiries — including requests to exercise your rights under GDPR — please contact us at the address above. We aim to respond within 30 days as required by Art. 12(3) GDPR. Where a request is complex or numerous, we may extend this by a further two months and will inform you of any such extension.
We collect only the data needed to run your account and to analyse the case you submit (data minimisation principle, Art. 5(1)(c) GDPR). We do not ask you for your address or phone number. Your email address is the only identifying detail we ask for to run your account; the form for withdrawing from a Guided contract also asks for your name, which is put in the acknowledgement and is not stored. Case text and documents you choose to submit may themselves contain identifying information; see §6. Your case is saved to your account only when you buy Guided for it; on the free plan it stays in your browser.
Remove personal details before you send. Before you write, upload or dictate a decision, a court judgment or another document, remove names, personal identity codes, addresses, phone numbers and any other detail that identifies you or anyone else in it. You can also send only the part of the document your question is about. FinnAdvisor does not need to know who anyone is to explain a decision. If such details still reach us, they are processed only as this Policy describes.
| Data item | Why we collect it | Stored where |
|---|---|---|
| Email address | Magic-link authentication; account identification | Google Cloud Firestore, Finland (europe-north1) |
| Usage counters | Tracking whether you have used the free analysis and, for a Guided case, how many questions, documents and analysis updates have been used from its allowance | Google Cloud Firestore, Finland (europe-north1) |
| Session token (fa_session cookie) | Keeping you logged in; identifying your session | Your browser (HttpOnly cookie) |
| Plan and subscription status | Determining which features are available to you, and for each case whether its Guided subscription is running and until when | Google Cloud Firestore, Finland (europe-north1) |
| Deadline reminders (opt-in) | Case name and appeal deadline — used only to send reminder emails you have enabled. One-click unsubscribe in every email. | Google Cloud Firestore, Finland (europe-north1) |
| Saved case text and documents (Guided cases) | The case description, any documents you upload and the analysis produced from them — saved to your account automatically when you buy Guided for the case, so you can reopen it later. Kept until you delete the case or your account. While a Guided subscription of yours is running, or the period you have paid for has not ended, it is not deleted for inactivity; after that, it is deleted 6 months after your last sign-in or, if later, the end of your last paid period, with an email a month before. An analysis that is not saved is kept only as an encrypted copy for 24 hours. | Google Cloud Firestore, Finland (europe-north1). The case description, the analysis, documents generated for you, the text of documents you upload and the case chat are encrypted by FinnAdvisor with AES-256-GCM before they are written, and are stored as ciphertext. Google Cloud also encrypts stored data at rest; our encryption is in addition to it. |
| Feedback you send (optional) | Your rating and message, and your email address if you give one; with them, the page you came from, your browser type and a keyed pseudonym of your IP address (a code computed from it with a secret key, not the address itself). Used to read and answer feedback: the message is sent to the AI provider, without your email address, to sort it, and the feedback is emailed to our own inbox. | Google Cloud Firestore, Finland. The message and your email address are encrypted by FinnAdvisor; the rest is not. |
| Refund requests | The case and the payment reference the request is about, the reason you choose, what you write, and your email address. Used to decide the request; it is also emailed to our own inbox. The refund itself is made in Stripe. | Google Cloud Firestore, Finland. What you write and your email address are encrypted by FinnAdvisor; the case, the payment reference and the reason are not. |
| Case chat (Guided cases) | The questions you ask in the chat of a Guided case and the answers to them, kept with the case so that you can read the conversation again. To answer, your question is sent to the AI provider (§6), without your email address. | Google Cloud Firestore, Finland (europe-north1). The chat is encrypted by FinnAdvisor; the usage counters are not. |
We process your personal data only for specified, explicit, and legitimate purposes (Art. 5(1)(b) GDPR). The table below maps each processing activity to its legal basis under Art. 6 GDPR.
| Processing activity | Legal basis | Detail |
|---|---|---|
| Authentication — sending magic-link emails; validating session tokens | Art. 6(1)(b) — contract performance | Necessary to provide the service you requested by creating an account. |
| Plan enforcement — storing usage counters and the state of your Guided subscriptions | Art. 6(1)(b) — contract performance | Necessary to enforce the free analysis and the allowance of each Guided subscription. |
| Payment processing — passing your email to Stripe on checkout | Art. 6(1)(b) — contract performance | Required to take your subscription payments through Stripe and link them to your account and case. |
| Case analysis — sending the text you submit to the AI provider (§6) for processing, and storing it for a Guided case | Art. 6(1)(b) — contract performance | Producing the analysis is the service you asked for, and keeping it is part of Guided, which you choose to buy for the case. Sensitive information (Art. 9) you choose to include is processed only on your explicit consent, given separately on the submission screen (Art. 9(2)(a)); where you are contesting a decision, we also rely on Art. 9(2)(f). Information about other people that a decision names (a spouse, a child, an employer) is processed on our legitimate interest in explaining a decision addressed to you (Art. 6(1)(f)), minimised by the guidance to remove details that identify others. We do not process information about criminal offences or convictions (Art. 10). See §4. |
| Seat and invoice requests from organisations — the organisation name, contact name, work e-mail, type of organisation, number of seats and message sent with the “Ask for an invoice” form | Art. 6(1)(f) — legitimate interest | Our legitimate interest in answering an organisation that asks us about seats or an invoice. The form is delivered to us by e-mail through Resend (§6) and is not saved in the service; it must not contain anyone’s case details. |
| Organisation seats: the buyer’s account — the account that buys seats (its e-mail address and pseudonym), the organisation name and Business ID (Y-tunnus) given at payment, and the order (seats, price, dates). The invitation codes themselves are not stored, only keyed codes (hashes) of them | Art. 6(1)(b) — contract performance | Selling and delivering the seats the organisation bought. Payment is processed by Stripe (§6). The organisation sees only counts: seats bought, used and available. The buyer receives one purchase e-mail (the order, its codes and invite link) and usage reminders about the order, sent through Resend (§6); the reminders contain counts only, never who used a seat. |
| Redeeming an organisation seat — your own account and case, as for Guided; the seat is not tied to any topic, and nothing about your matter is counted for the organisation | Art. 6(1)(b) — contract performance | The organisation pays for the seat; it cannot see your account or your case. No name, e-mail address, case or date of yours is given to the organisation, and nothing in its records points to you. |
Where we rely on legitimate interests (Art. 6(1)(f)), you have the right to object to that processing at any time (see §11).
Some decisions mention sensitive information — for example about health, religion, ethnic origin, political opinions or sexual orientation ("special category data", Art. 9 GDPR). You choose whether to include it: you can leave it out and still get an analysis of your decision, or include it for a more specific analysis.
You can withdraw your consent at any time by deleting the case; withdrawal does not affect processing that already took place. Where you are contesting a decision, we also rely on Art. 9(2)(f) — processing necessary for the establishment of your legal claim. Sensitive information about another person should be included only where you are contesting the decision; otherwise remove it. We do not process information about criminal offences or convictions (Art. 10): text that contains it is refused at intake and is not analysed.
With your choice we record a keyed pseudonym of your IP address (a code computed from it with a secret key, not the address itself), as evidence of when the choice was made. The record is kept for 365 days, and is deleted earlier if you delete the case or your account.
Remove personal details before you send. Before you write, upload or dictate a decision, a court judgment or another document, remove names, personal identity codes, addresses, phone numbers and any other detail that identifies you or anyone else in it. You can also send only the part of the document your question is about. FinnAdvisor does not need to know who anyone is to explain a decision. If such details still reach us, they are processed only as this Policy describes.
FinnAdvisor does not make decisions about you. The analysis is information; the decision remains the authority's, and what you do with the information remains yours. The system produces no score, no eligibility verdict and no decision with legal or similarly significant effect (Art. 22 GDPR).
Certain decisions about your account are made automatically without human review:
These automated decisions are necessary for the performance of your contract (Art. 22(2)(a) GDPR) and do not produce legal effects or similarly significant effects beyond temporary service restrictions. You have the right to request human review of any access decision you believe is incorrect by contacting support@finnadvisor.fi.
FinnAdvisor runs on Google Cloud in Finland. The application runs on Google Cloud Run, and your account and case data are stored in Google Cloud Firestore, both in the europe-north1 region (Hamina, Finland); backups are stored in Google Cloud Storage in the same region. Request logs, which include your IP address, are kept for 30 days in the EU. The scheduler that starts our daily jobs runs in Google Cloud's europe-west1 region (Belgium) and handles no case content.
Email is sent through Resend, which delivers it using Amazon Web Services (Amazon SES). Besides sign-in links, this includes the emails you choose to receive or that your case produces: deadline reminders (the case name, the deadline and where to appeal), case updates (the case name and, for an added document, its file name), the notice before saved cases are deleted, the confirmation of a Guided order, the confirmation of a withdrawal from a Guided contract, with the name you give in the withdrawal form (we send no email when you cancel a subscription), and a thank-you if you send feedback. We also email you about a refund of a Guided payment. For an organisation that buys seats: the purchase email with its codes and invite link, and reminders with counts only — when half and when all of the seats are used, and before the codes expire — and the refund email. These emails never contain your analysis or your documents.
AI analysis requests are sent to Anthropic's Claude model on Google Cloud (Vertex AI), processed in the European Union (EU multi-region). The processing runs in the EU; prompts and outputs are not retained by the provider after your analysis is returned. The models are made by Anthropic but hosted and run by Google; Anthropic has no access to what we send to the model or what it returns. If Google's automated safety systems flag a prompt as potential abuse, Google may keep it for up to 90 days, in the EU, to check it against its usage policies. The case text, any documents you upload and your case-chat questions are sent as you provide them, so they may contain personal data about you and about others named in a decision — remove identifying details before you send. Your content is not used to train models. We send the AI provider no account identifiers: no email address, no user id and no session data. Uploaded images and scanned PDFs are first converted to text with Google Cloud Vision on its EU endpoint; only the text is sent to the AI model.
Some of our processors are, or may be, located outside the European Economic Area (EEA). Chapter V GDPR requires an appropriate safeguard for each transfer; the table shows the safeguard each transfer relies on:
| Processor | Country | Transfer safeguard |
|---|---|---|
| Google Cloud EMEA Limited | EU (Finland; AI on the EU multi-region) | Data is stored and processed in the EU. For any access from outside the EU by Google LLC, Google relies on the transfer mechanisms in its Cloud Data Processing Addendum: the EU-U.S. Data Privacy Framework and, as a fallback, the EU Standard Contractual Clauses. |
| Stripe Inc. | Ireland; transfers to the United States | Stripe Payments Europe, Limited (Ireland), with transfers to Stripe, Inc. (United States) under the EU-U.S. Data Privacy Framework and, as a fallback, the Standard Contractual Clauses in Stripe's Data Transfers Addendum. Stripe Privacy Policy. |
| Resend Inc. | United States | Resend, Inc. (United States) — EU-U.S. Data Privacy Framework (Resend is certified). Your email address and the emails listed in §6 are processed to deliver them. |
You may request a copy of the relevant SCCs by contacting support@finnadvisor.fi.
We retain personal data only for as long as necessary for the purpose for which it was collected (Art. 5(1)(e) GDPR — storage limitation):
| Data item | Retention period | Basis |
|---|---|---|
| Session data (fa_session cookie) | 30 days from last login | Automatic expiry (a time limit set when the record is written) |
| Usage counters | The free-analysis counter: 60 days, then automatically expired (the free analysis itself: one per account every 7 days — the 7-day window is kept as a key that expires with it). The question, document and analysis-update counters of a Guided case are kept with the case and deleted with it. | Automatic expiry for the free-analysis counter; the Guided counters follow the saved case (below) |
| Email address and account data | Until you request account deletion | Necessary for contract performance |
| Plan and subscription status | Until you request account deletion | Necessary for contract performance |
| Saved case text, documents and case chat | Until you delete the case or your account. While a Guided subscription of yours is running, or the period you have paid for has not ended, it is not deleted for inactivity. After your last paid period ends, it is deleted 6 months after your last sign-in or, if later, the end of that period. We email you at 5 months, and it is never deleted earlier than a month after that notice. | Storage limitation, Art. 5(1)(e) — enforced by an automated daily sweep. Signing in restarts the period. |
| Saved case text — accounts that have never had a Guided subscription | Until you delete it. Otherwise it is deleted once 1 month has passed since your last sign-in, without an advance email. | Storage limitation, Art. 5(1)(e). An account that has never paid is kept for a shorter period because the processing it justifies is shorter; no advance email is sent, as a 1-month warning does not fit inside a 1-month period. Buying Guided moves the account to the rule above. |
| Case text flagged by the AI provider's automated safety systems | Up to 90 days, held by Google in the EU | The provider's own abuse monitoring under its usage policies: a prompt is kept only if the provider's classifiers flag it. Not our store: our settings do not shorten it. |
| Backups of account and case data | Made daily. Each backup is kept for 30 days and then deleted automatically. | Recovery after data loss, Art. 32(1)(c). Each backup file is encrypted by FinnAdvisor and stored in Google Cloud Storage in Finland (europe-north1); sign-in sessions and caches are not included. |
| Feedback and refund requests | 12 months after the request is closed, or earlier if you delete your account. If you gave us your e-mail address, we e-mail you a month before. | Storage limitation, Art. 5(1)(e). |
| Record of your sensitive-information choice (Art. 9) | 365 days, or until you delete the case or your account | Proof of consent, Art. 7(1): the 6-month case retention period plus 6 months in which the choice can still be questioned. |
| Pseudonymised IP counter for free analyses | 7 days, then automatically expired | Abuse prevention: limiting how many free analyses can be started from one network. Art. 6(1)(f) — legitimate interest. The counter holds a code computed from your IP address with a secret key, not the address itself. |
| Seat and invoice request e-mails (organisations) | Kept in our mailbox while the request is handled, and deleted at the latest 12 months after the last contact | Not saved in the service. Art. 6(1)(f) — legitimate interest; you can object at any time (§11) |
| Organisation orders (the buyer) | The order (organisation name, Business ID, seats, price, dates) and its receipts are kept as accounting records: receipts for 6 years and the books for 10 years from the end of the financial year (Accounting Act 1336/1997, chapter 2, section 10). When the buyer’s account is erased, the link from that account to its orders is deleted at once; codes already handed out stay redeemable until their window ends | Art. 6(1)(b) — contract performance; Art. 6(1)(c) — legal obligation (accounting) |
| Invitation code records | Deleted automatically when the 12-month redemption window ends | Only keyed hashes of the codes and a count of seats — never the codes themselves or anything about a person. Art. 6(1)(b) — contract performance |
To delete your account and all associated data, use your My Cases page. You can also email support@finnadvisor.fi with the subject line "Account Deletion Request"; we process an emailed request within 30 days and confirm when it is done. Data you delete may remain in our backups for up to 30 days, after which it is deleted automatically; backups are used only for recovery after data loss. When we delete data, Google completes its deletion from its own systems within at most 180 days (Google Cloud Data Processing Addendum, §6.1).
We use the following processors (Art. 28 GDPR):
| Processor | Role | Data shared |
|---|---|---|
| Google Cloud | Hosting (Cloud Run), database (Firestore), backups (Cloud Storage), secrets, logging and scheduling, in Finland (europe-north1) except the scheduler (Belgium, europe-west1); AI analysis with Anthropic's Claude models on Vertex AI, on the EU multi-region endpoint; text extraction from uploaded images and scanned PDFs with Cloud Vision, on its EU endpoint. The models are made by Anthropic but hosted and run by Google; Anthropic has no access to what we send to the model or what it returns | Your account and case data as stored (§2, §8); request logs, including your IP address (30 days); for AI analysis, the case text, documents and case-chat questions you submit — no account identifiers. |
| Stripe | Payment processing. Stripe Payments Europe, Limited (Ireland), with transfers to Stripe, Inc. (United States) under the EU-U.S. Data Privacy Framework and, as a fallback, the Standard Contractual Clauses in Stripe's Data Transfers Addendum. | Email address and payment details, and with the payment: a pseudonymous account code (not your email address), the Guided subscription bought and the case it is for, your language, and the record that you asked the service to start within the withdrawal period and acknowledged that, if you then withdraw, you pay for the part provided. Governed by Stripe's Privacy Policy. |
| Resend | Transactional email: sign-in links, Guided order and withdrawal confirmations, the email about a refund of a Guided payment, the reminders and case updates you receive, and, for an organisation that buys seats, the purchase email with its codes and invite link, the reminders with counts only (when half and when all of the seats are used, and before the codes expire) and the refund email | Your email address and the content of those emails (see §6). Resend delivers them through Amazon Web Services (Amazon SES). |
We do not sell, rent, or trade your personal data to any third party for their own commercial purposes.
These cookies are essential for the service to function. They are set automatically upon login and do not require separate consent under Art. 5(3) of the ePrivacy Directive:
| Cookie | Type | Duration | Purpose |
|---|---|---|---|
| fa_session | HttpOnly, Secure, SameSite=Lax, first-party | 30 days | Session authentication — required to keep you logged in. The service cannot function without this cookie. |
We do not use analytics cookies, third-party analytics services, advertising cookies, retargeting pixels, or cross-site tracking.
Besides the session cookie, the site stores some information on your device, in your browser's local storage and session storage (Art. 5(3) of the ePrivacy Directive). It is not a cookie and is not sent to us on its own. If you only open and read pages, without signing in or choosing anything, nothing is stored: each item below is written only when you do what its row says — sign in, analyse a case, pick a language, close a notice. The main item is a copy of each case you analyse on this device — the text you entered and the analysis — so that you can reopen it; while you are signed in, your email address and plan are kept as well. Your language is stored only after you pick one; until then, pages read your browser's language without storing it. No item is used for analytics, advertising or tracking. These are all the items:
| Item | Where | What it holds, and when it is written | How long it stays |
|---|---|---|---|
fa_lang |
Local storage | The language you picked. Written only when you pick a language yourself. | Until you clear your browser's data |
fla_user |
Local storage | Your email address and plan, so that pages show you as signed in. Written when you sign in. | Until you sign out or delete your account |
fla6_…, cloud_…, case_… |
Local storage | A copy of a case — the text you entered, the analysis and the documents prepared for it — so that you can reopen it. Written when you analyse a case on this device and, while you are signed in, for the cases saved to your account. | Until you delete the case or your account; signing out does not remove it |
fla_dl_… |
Local storage | The result of a deadline check on a decision letter, so that the same letter is not checked again. Written when you run the check. | Until you delete your account |
fa_terms_accepted |
Local storage | That you accepted the Terms of Service in this browser, so that the notice is not shown again. Written when you accept. Your consent itself is recorded with your account. | Until you clear your browser's data |
fa_pending_type, fa_guided_pick |
Local storage | Where to continue: the case type you chose on the case-types page, or, when you sign in from a Guided offer, the time and the page to return to. Written when you make that choice. | Until the next page has read it |
auth_dismissed, fa_onboarded, fa_assist_bubble, fa_assist_seen, fa_guide_nudged, fa_beta_hidden |
Local storage | Only a mark that you closed or hid something — the sign-in window, the introduction, the help assistant or its bubble, the guide's tip, the beta banner — so that it is not shown again. Written when you close it, or, for the introduction, when you arrive from a case-type link. | Until you clear your browser's data |
fa_updates_seen |
Local storage | Only a mark that you closed the notice about a change to our Terms or Privacy Policy, so that it is not shown again. Written when you close it. | Until you clear your browser's data |
fa_ws |
Local storage | Turns on the workspace view that FinnAdvisor's owner uses to review the site. Written only when a page is opened with that workspace link. | Until you clear your browser's data |
fa_input_consent |
Session storage (this tab only) | Your choice about sensitive information (§4) for the case you are about to send: the time, the notice version and the language. Written when you make the choice. | Until you close the tab |
faIntent, openSection, fa_livehelp_off, fa_gresume_… |
Session storage (this tab only) | Short-lived state of the open tab: what you chose in the guide's quick start, which part of the app to open next, that you hid live help, and that the first analysis of a Guided case has already been started. Written when you do these things, or, for the last, when the case page starts that analysis. | Until you close the tab |
A case's copy is removed from this device when you delete that case in the app, and every case copy and deadline-check result is removed when you delete your account. Signing out does not remove them: on a shared device, delete your cases or use a private browsing window.
As a data subject under GDPR you have the following rights. To exercise any of them, contact us at support@finnadvisor.fi. We will respond within 30 days (Art. 12(3) GDPR) at no charge.
You have the right to lodge a complaint with the Finnish Data Protection Ombudsman (Tietosuojavaltuutettu) if you believe we have processed your data unlawfully, without prejudice to any other administrative or judicial remedy:
In addition to lodging a complaint with a supervisory authority, you have the right to an effective judicial remedy under Art. 79 GDPR. You may bring proceedings against us before the competent courts in Finland (where we are established) or in the EU member state where you are habitually resident.
We implement appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, or unauthorised disclosure (Art. 32 GDPR):
No method of transmission over the internet is 100% secure. If a personal data breach occurs, we will notify the Finnish Data Protection Ombudsman within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to your rights and freedoms (Art. 33 GDPR). If the breach is likely to result in a high risk to your rights and freedoms, we will also notify you without undue delay (Art. 34 GDPR).
We have not appointed a Data Protection Officer. Whether Art. 37 requires one is assessed in writing and re-run every quarter, or as soon as saved cases reach 500 in a month. You can raise any data protection question with us at support@finnadvisor.fi. You also have the right to contact the Finnish Data Protection Ombudsman (tietosuoja.fi).
All data protection enquiries should be directed to the data controller at support@finnadvisor.fi.
We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. When we make material changes, we will:
We encourage you to review this policy periodically. Questions? Contact us: support@finnadvisor.fi
Language versions. This Privacy Policy is published in Finnish, Swedish, English, Arabic and Russian. The Finnish and English versions are equally authoritative. If they differ, the interpretation more favourable to the user applies.