Skip to content

Privacy Policy

A simple, human-readable privacy policy in line with Article 13 GDPR.

1. Controller

Opelli Crest · Larsgatan 55 08100 Lojo, Finland · [email protected]

Privacy enquiries: [email protected] (subject "GDPR"). We reply within 30 days.

2. What personal data we process

  • Account data: name, email address, password hash.
  • Subscription data: Premium plan type (monthly/yearly/one-off), status, start and end dates and billing periods.
  • Payment data: the payment provider's transaction ID, amount charged, payment method type and the last four card digits for the receipt. We never process or store full card numbers, CVC codes or bank credentials.
  • Billing data: receipt number, billing address (if given), VAT number (business customers).
  • Technical data: language and cookie choice in browser storage.
  • Logs: sign-in time and IP address for security (90 days).

We do not collect location data, profiling data, ad-tracking data or biometric data.

3. Purpose and legal basis

  • Contract: creating your account, delivering Premium, billing and cancellations.
  • Legal obligation: keeping accounting records and VAT obligations.
  • Consent: newsletter and marketing messages (withdraw at any time).
  • Legitimate interest: service security and prevention of abuse and payment fraud — no profiling and no automated decisions.

4. Retention

  • Account data: for the lifetime of the account; at the latest 30 days after a deletion request.
  • Accounting records: 6 years from the end of the financial year.
  • Basic subscription data: for the subscription + 12 months.
  • Sign-in logs and IP addresses: 90 days.
  • Newsletter subscription: until you unsubscribe.
  • Cookies: see our cookie policy.

5. Recipients

We never sell or rent personal data and never share it for marketing or analytics purposes. We use processors under Article 28 GDPR: an EU/EEA hosting provider, a PCI DSS certified payment provider and an EU email delivery service. An up-to-date list is available on request.

6. Your rights

  • Right of access to your data.
  • Right to rectification.
  • Right to erasure.
  • Right to restriction of processing.
  • Right to data portability.
  • Right to object, in particular to direct marketing.
  • Right to withdraw consent at any time.
  • Right to lodge a complaint with the Data Protection Ombudsman.

7. Consequences of not providing data

A name and email are required to create an account. Without them we cannot provide Premium features or the newsletter. Public information (results, archive, statistics, history) is available without an account.

8. Automated decision-making

We do not make automated decisions with legal or similarly significant effects, and we do not profile users.

9. Security

Passwords are only stored as hashes. Traffic is protected with TLS. Accounts are locked after repeated failed sign-in attempts.

10. Changes

We update this policy when needed. Registered users are notified of material changes at least 14 days in advance.