Privacy Policy

1. Data Controller

The data controller responsible for your personal data is:

• Service name: FinnAdvisor
• Website: finnadvisor.fi
• Contact: support@finnadvisor.fi

For all data protection enquiries — including requests to exercise your rights under GDPR — please contact us at the address above. We aim to respond within 30 days as required by Art. 12(3) GDPR. Where a request is complex or numerous, we may extend this by a further two months and will inform you of any such extension.

2. Data We Collect

We collect only the minimum data necessary to provide authentication and enforce service plan limits (data minimisation principle, Art. 5(1)(c) GDPR). We do not collect names, addresses, phone numbers, or any other identifying information beyond your email address.

What we do NOT collect

• Passwords — authentication is passwordless (magic link only)
• Payment card numbers or banking details — payments are handled entirely by Stripe
• Location data or device fingerprints
• Case content submitted for AI analysis — analysis requests are processed ephemerally and are not stored against your account by FinnAdvisor

3. Purpose and Legal Basis

We process your personal data only for specified, explicit, and legitimate purposes (Art. 5(1)(b) GDPR). The table below maps each processing activity to its legal basis under Art. 6 GDPR.

Where we rely on legitimate interests (Art. 6(1)(f)), you have the right to object to that processing at any time (see §11).

4. Special Category Data

The case descriptions you voluntarily submit for AI analysis may contain information that constitutes "special category data" under Art. 9 GDPR — for example, details relating to your health, religion, ethnicity, or immigration status. Such information is submitted entirely at your own discretion.

The legal basis for processing any special category data you voluntarily include in a case submission is Art. 9(2)(a) GDPR — your explicit consent, given at the point of submission by choosing to include such information. You may omit sensitive details at any time without affecting the usefulness of the analysis for most questions.

5. Automated Decision-Making

Certain decisions about your account are made automatically without human review:

• Plan limit enforcement: When your monthly usage count reaches your plan's limit, the system automatically blocks further analyses until the next calendar month or until you upgrade. This is based solely on the usage counter stored in your account.
• Session validation: Your session token is automatically verified on each request; expired or invalid tokens result in automatic sign-out.

These automated decisions are necessary for the performance of your contract (Art. 22(2)(a) GDPR) and do not produce legal effects or similarly significant effects beyond temporary service restrictions. You have the right to request human review of any access decision you believe is incorrect by contacting support@finnadvisor.fi.

6. Storage and Infrastructure

FinnAdvisor is hosted on Vercel (serverless functions and static assets, EU edge network). User account data is stored in Upstash Redis, configured to use the EU (Frankfurt) region to ensure data residency within the European Economic Area.

Email delivery (magic links) is handled by Resend. Resend processes your email address only to transmit the authentication email; no email content or address is retained by Resend beyond delivery.

AI analysis requests are sent to Anthropic's API (United States — see §7 for transfer safeguards). Case text you submit is processed ephemerally; no personally identifiable data is knowingly included in requests to Anthropic, and Anthropic does not use API inputs to train its models.

7. International Data Transfers

Some of our processors are located outside the European Economic Area (EEA). We ensure appropriate safeguards are in place for each transfer as required by Chapter V GDPR:

You may request a copy of the relevant SCCs by contacting support@finnadvisor.fi.

8. Data Retention

We retain personal data only for as long as necessary for the purpose for which it was collected (Art. 5(1)(e) GDPR — storage limitation):

To request deletion of your account and all associated data, email support@finnadvisor.fi with the subject line "Account Deletion Request". We will process the request within 30 days and confirm when completed.

9. Third-Party Processors

We engage the following sub-processors under data processing agreements consistent with Art. 28 GDPR. Each processor may only process data on our documented instructions:

We do not sell, rent, or trade your personal data to any third party for their own commercial purposes.

10. Cookies and Analytics

We use two categories of cookies:

Strictly necessary cookies

These cookies are essential for the service to function. They are set automatically upon login and do not require separate consent under Art. 5(3) of the ePrivacy Directive:

Analytics cookies

We use Google Analytics 4 on our landing page and application to measure aggregate, anonymous usage statistics. These cookies are set only after you consent via the cookie banner shown on your first visit.

Legal basis for analytics cookies: Art. 6(1)(a) GDPR — your consent, given via the cookie banner. You may withdraw consent at any time by:

• Using the Google Analytics opt-out browser add-on
• Blocking cookies in your browser settings
• Emailing support@finnadvisor.fi to request that we cease analytics tracking on your account

We do not use advertising cookies, retargeting pixels, or any other tracking technology beyond those described above.

11. Your Rights Under GDPR

As a data subject under GDPR you have the following rights. To exercise any of them, contact us at support@finnadvisor.fi. We will respond within 30 days (Art. 12(3) GDPR) at no charge.

• Right of access (Art. 15): Request a copy of the personal data we hold about you and information about how it is processed.
• Right to rectification (Art. 16): Ask us to correct inaccurate or incomplete personal data without undue delay.
• Right to erasure — "right to be forgotten" (Art. 17): Request deletion of your personal data where there is no overriding legitimate reason for us to continue processing it (e.g., where it is no longer necessary for the purpose it was collected).
• Right to restriction of processing (Art. 18): Ask us to restrict processing of your data — for example, while you contest its accuracy or object to our use of it. During restriction, we may store the data but not process it further without your consent (except for legal claims or to protect rights of another person).
• Right to data portability (Art. 20): Receive your data in a structured, commonly used, machine-readable format (e.g., JSON) and transfer it to another controller, where processing is based on consent or contract and carried out by automated means.
• Right to object (Art. 21): Object at any time to processing based on legitimate interests (Art. 6(1)(f)), including analytics. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Rights related to automated decisions (Art. 22): Request human review of any automated decision that affects you (see §5).

Supervisory authority complaint

You have the right to lodge a complaint with the Finnish Data Protection Ombudsman (Tietosuojavaltuutettu) if you believe we have processed your data unlawfully, without prejudice to any other administrative or judicial remedy:

• Website: tietosuoja.fi
• Email: tietosuoja@om.fi
• Postal address: Lintulahdenkuja 4, 00530 Helsinki, Finland

Judicial remedy

In addition to lodging a complaint with a supervisory authority, you have the right to an effective judicial remedy under Art. 79 GDPR and §16 of the Finnish Data Protection Act (Tietosuojalaki 1050/2018). You may bring proceedings against us before the competent courts in Finland (where we are established) or in the EU member state where you are habitually resident.

12. Security

We implement appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, or unauthorised disclosure (Art. 32 GDPR):

• All data in transit is encrypted via HTTPS (TLS 1.2 or higher).
• Session cookies are set with the HttpOnly and Secure flags, preventing client-side JavaScript access.
• Passwords are never stored — authentication is exclusively via time-limited magic links.
• Access to Upstash Redis is restricted by secret credentials held only in server-side environment variables, never exposed to the client.
• Redis keys are automatically expired using TTL, minimising the volume of data retained at any time.
• Access to production credentials is limited to the minimum number of personnel necessary.

No method of transmission over the internet is 100% secure. In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify you and the Finnish Data Protection Ombudsman within 72 hours as required by Art. 33–34 GDPR.

13. Data Protection Officer

FinnAdvisor is a small-scale service that does not carry out large-scale systematic monitoring of individuals or large-scale processing of special categories of data. Consequently, we are not required to appoint a Data Protection Officer under Art. 37 GDPR and the Finnish Data Protection Act.

All data protection enquiries should be directed to the data controller at support@finnadvisor.fi.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. When we make material changes, we will:

• Update the "Last updated" date at the top of this page;
• Notify registered users by email where the change is material and affects their rights;
• Where required by law (e.g., a change in legal basis), obtain fresh consent before the change takes effect.

We encourage you to review this policy periodically. Questions? Contact us: support@finnadvisor.fi