Privacy notice

Draft – to be reviewed by a lawyer before publication.

Controller

[Company name], business ID [ ], [address]. Privacy matters: [email address].

What we process and why

We collect only what the service needs:

• Account data: email address, language and notification settings – to provide the service (contract).
• Phone number (SMS plans only) – to deliver morning messages and alerts (contract). The number is encrypted at rest.
• Channel data: Telegram ID, browser push subscription, ntfy topic – to deliver the notifications you choose (contract).
• Payment data: Stripe customer ID and subscription status. Card details are handled by Stripe and never reach our servers. Bookkeeping records are kept as the Accounting Act requires (legal obligation).
• Quote requests: organisation and contact details – to answer the request (legitimate interest).
• Log data: IP address and technical data – for security and abuse prevention (legitimate interest).

We use no tracking cookies and no ad networks. Visitor statistics are collected without cookies and without personal data. We use no cookies at all: a login is kept in the browser's own storage for 20 minutes.

Processors

• DigitalOcean – servers and backups (EU: Frankfurt or Amsterdam).
• Cloudflare – content delivery network and DDoS protection (processes IP addresses).
• Stripe – payments and invoicing.
• [SMS provider] – text message delivery.
• [Email provider] – email delivery (EU).
• Telegram – messages, if you choose the Telegram channel.
• Anthropic – AI models for classifying public news sources. Subscribers' personal data is not sent to the AI service.

Where data is transferred outside the EU/EEA, the transfer relies on the European Commission's standard contractual clauses or another basis under the GDPR. [Check and complete the transfer basis for each processor.]

Retention

• Account data: until you delete your account.
• Logs containing personal data: 90 days.
• Bookkeeping records: as required by the Accounting Act.
• Quote requests: [24 months] or until you ask us to delete them.

Your rights

You have the right to access, rectify and erase your data, to restrict processing, to data portability and to object. You can delete your account yourself on the Account page. You may lodge a complaint with the Data Protection Ombudsman (tietosuoja.fi).