Privacy Policy

1. Controller and contact

Controller: Pähkinänsärkijä Oy, business ID 2800792-5, Mikonkatu 20 B 1, 00100 Helsinki, Finland.

Privacy questions and requests: support@pahkinansarkija.fi. We have not appointed a data protection officer, as we are not required to; the contact above handles privacy matters.

When an organisation (our customer) uploads personal data of other people to its workspace, for example colleagues' CVs in the bid assistant, the organisation is the controller of that data and we act as its processor under the Data Processing Agreement. Contact that organisation about such data.

2. What data we process

• Account: e-mail address, name, password hash (held by Firebase Authentication) or Google sign-in identifier, e-mail verification status, sign-in times, accepted terms and privacy policy versions.
• Profile and settings: title, company description, avatar picture, language, theme, notification preferences and time zone.
• Organisation membership: organisations you belong to, your role, invitations you sent or received.
• Your use of the Service: saved searches, alerts and their feedback, bookmarks, forecast watches, pipeline items, comments, tasks, bid drafts and answers you write, partner-search posts and requests.
• Uploaded documents: files you upload to the document vault, company knowledge (for example CVs and references) and tender documents. Where these concern other people, see section 1.
• Messages: conversations between members are end-to-end encrypted; we store only encrypted content and metadata (participants, times).
• Billing: organisation name, billing contact, address and VAT number, subscription and invoice details. Card data is handled by Stripe and never reaches us.
• Technical data: IP address and request logs (security and operations), app installation push tokens, device platform and app version, e-mail delivery events (sent, bounced, complained), AI usage counters (tokens per user and week).
• Analytics and advertising: only after your consent (see section 8 and the Cookie Policy).

3. Purposes and legal bases

Where we rely on legitimate interests, you may object (section 7). Providing account data is necessary to use the Service; analytics and advertising data are optional.

4. AI processing

AI features (bid assistant, smart search, company descriptions, the in-app assistant) send the relevant text to Google's Gemini models through Vertex AI on Google Cloud's EU endpoint. Google processes it as our subprocessor and does not use it to train its models. No decision with legal or similarly significant effects is made about you by automated means.

5. Recipients and transfers

We do not sell personal data. Data is processed by our subprocessors (hosting, authentication, e-mail, payments, analytics) listed on the Subprocessors page. Our main hosting is in the EU (Google Cloud, Hamina, Finland). Other members of your organisations see your member card (name, title, e-mail, avatar) and the content you share with them.

Some providers (Google, Stripe, Amazon Web Services) are part of groups based in the United States, and some data (for example Firebase Authentication and analytics) may be processed outside the EU/EEA. Such transfers rely on the EU-US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses with supplementary measures.

We may disclose data to authorities where the law requires it.

6. Retention

• Account and profile data: until you delete your account. Deletion removes your profile, saved searches, alerts, bookmarks, devices and memberships, and the organisations of which you were the last member, within 30 days from our live systems; backups roll off within a further 35 days.
• Content you created in a shared organisation (pipeline items, comments, bid texts) stays with the organisation, which controls it; your name is removed from conversations and partner-search records.
• Invoices and accounting records: the current year plus 6 years (Finnish Accounting Act).
• Trial registry: a pseudonymous record of the e-mail address, company domain or VAT number that used a trial, kept after account deletion to enforce one trial per company.
• Security logs: up to 30 days, longer when needed to investigate an incident.
• Analytics data: 14 months in Google Analytics.

7. Your rights

You have the right to access your data, to have it corrected or erased, to restrict or object to processing, to data portability, and to withdraw consent at any time without affecting earlier processing.

• Download your data: Profile → Download my data (a JSON file of your account data).
• Delete your account: Profile → Delete account (web and mobile apps).
• Correct your profile: edit it in your profile at any time.
• Withdraw cookie consent: "Cookie settings" in the site footer.
• Anything else: write to support@pahkinansarkija.fi. We answer within one month.

You may lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi) or the authority of your country of residence.

8. Cookies and similar technologies

We use strictly necessary storage (language, theme, sign-in session and your consent choice) without consent. Google Analytics and advertising measurement run only after you accept them in the consent banner, and you can change your choice at any time. Details are in the Cookie Policy.

9. Security

Data is encrypted in transit (TLS) and at rest, access is limited to people who need it, messages are end-to-end encrypted, and backups are kept in the EU. No system is perfectly secure; we notify you and the authorities of a personal data breach as the law requires.

10. Children

The Service is meant for businesses and is not directed at children under 16.

11. Changes

We will update this policy when our processing changes and tell you about material changes by e-mail or in the Service. The version date is shown at the top.