GDPR

Data controller

Opelli Crest · Larsgatan 55 08100 Lojo, Finland
Email: [email protected]

What we collect

• Account data: name, email and a password hash.
• Subscription and payment data: Premium plan type and status, the payment provider's transaction ID and the last four card digits for the receipt. We never process full card numbers or CVC codes.
• Billing data: receipt number, optional billing address and VAT ID.
• Technical data: browser storage used to remember your language and cookie choice.

We do not store location data, IP addresses for tracking purposes or biometric data.

Legal basis

• Contract (Art. 6(1)(b)) — user account, Premium delivery and billing.
• Legal obligation (Art. 6(1)(c)) — retention of accounting records under the Finnish Accounting Act.
• Consent (Art. 6(1)(a)) — newsletters and non-essential cookies.
• Legitimate interest (Art. 6(1)(f)) — service security and prevention of abuse and payment fraud.

Retention

Your account is kept until you ask us to delete it. Accounting records are kept for 6 years from the end of the financial year as required by law. Sign-in logs are kept for 90 days.

Your rights

• Request access to your data.
• Request rectification or erasure.
• Object to processing or request its restriction.
• Receive your data in a portable format.
• Lodge a complaint with the Finnish Data Protection Ombudsman.

To exercise your rights: [email protected]. We reply within 30 days.

Transfers

Servers are located in the EU/EEA. Payments are handled by a PCI DSS certified payment provider. Where data is transferred outside the EU/EEA, the transfer relies on EU Standard Contractual Clauses or an adequacy decision.