Privacy Policy

A simple, human-readable privacy policy under GDPR Article 13.

1. Data controller

Verrixa Point · Korvatunturintie 2 00970 Helsinki, Finland
General enquiries: [email protected]

Privacy enquiries: [email protected] (subject: GDPR). We reply within 30 days.

Account data: name, email address, bcrypt password hash.
Subscription data: Premium plan type (monthly/yearly/one-time), status, start and end dates and billing period dates.
Payment data: the payment provider's transaction ID, amount charged, payment method type and the last four card digits for the receipt. We never process or store full card numbers, CVC codes or bank credentials — they go straight to the payment provider's secure environment (PCI DSS).
Billing data: receipt number, billing address (if provided), VAT number (business customers), VAT country.
Technical data: language choice and cookie-notice choice in your browser's local storage.
Logs: login time and IP address for security (90 days).

We do not collect location data, profiling data, ad-tracking data or biometric data.

Contract (Art. 6(1)(b)): creating your account and signing in, delivering Premium, billing and handling cancellations.
Legal obligation (Art. 6(1)(c)): retaining accounting records, VAT obligations and other regulatory requirements.
Consent (Art. 6(1)(a)): sending the newsletter (withdraw anytime) and non-essential cookies.
Legitimate interest (Art. 6(1)(f)): service security and preventing abuse and payment fraud. We do not profile users or make automated decisions.

Account data: lifetime of the account; at most 30 days after a deletion request.
Accounting records (receipts, invoices, transaction IDs): 6 years from the end of the financial year.
Basic subscription data: lifetime of the subscription + 12 months for disputed charges.
Login logs and IP addresses: 90 days.
Newsletter subscription: until you unsubscribe.
Identifiers stored in your browser: see the cookie policy.

We never sell or rent personal data. Data is not shared with third parties for marketing or analytics.

We use the following processors (GDPR Art. 28):

A data processing agreement under GDPR Art. 28 is in place with every processor. An up-to-date list is available on request from [email protected].

Right of access to your data (Art. 15).
Right to rectification (Art. 16).
Right to erasure (Art. 17).
Right to restriction of processing (Art. 18).
Right to data portability (Art. 20).
Right to object (Art. 21), especially to direct marketing.
Right to withdraw consent at any time.
Right to lodge a complaint with the Office of the Data Protection Ombudsman.

Passwords are stored only as bcrypt hashes. Traffic is protected with TLS. Accounts are locked after repeated failed sign-in attempts.

We update this policy when needed. We notify registered users of material changes by email or on-site notice at least 14 days in advance.