GDPR

Data controller

BlueOrbit Media Oy
Sanduddsgatan 7, 00100 Helsingfors, Finland
Business ID: 0770548-5 · 020 1750050 · [email protected]

What data we collect

• Account data: name, email address, password hash.
• Subscription and payment data: Premium plan type and status, payment provider transaction ID, last four card digits for receipts. We never process full card numbers or CVC codes.
• Billing data: receipt number, optional billing address and VAT ID.
• Technical data: local browser storage used to remember your language and cookie choice.

We do not store location data, IP addresses for tracking purposes or biometric data.

Legal basis for processing

• Contract (GDPR Art. 6(1)(b)) — user account, delivery of Premium and billing.
• Legal obligation (Art. 6(1)(c)) — retention of accounting records under the Finnish Accounting Act.
• Consent (Art. 6(1)(a)) — newsletters and non-essential cookies.
• Legitimate interest (Art. 6(1)(f)) — service security, preventing abuse and payment fraud.

Retention

Your account is kept until you ask us to delete it. Accounting records (receipts, transaction IDs) are kept for 6 years from the end of the financial year as required by the Accounting Act. Login logs are kept for 90 days.

Your rights

• Request access to your data.
• Request correction or erasure.
• Object to processing or request restriction.
• Lodge a complaint with the Office of the Data Protection Ombudsman.

To exercise your rights: [email protected]. We reply within 30 days.

Data transfers

Servers are located in the EU/EEA. Payments are processed by Stripe Payments Europe, Ltd. (Ireland), which may transfer data to Stripe Inc. in the United States based on EU Standard Contractual Clauses (SCC) and the EU-US Data Privacy Framework certification. Transactional emails are sent via EU-based email services.

Last updated 21 October 2026