Privacy Policy

A simple, human-readable privacy policy in line with GDPR Article 13.

1. Data controller

BlueOrbit Media Oy
Sanduddsgatan 7, 00100 Helsingfors, Finland
Business ID: 0770548-5 · 020 1750050 · [email protected]

Privacy enquiries: [email protected] (subject "GDPR"). We reply within 30 days.

2. What personal data we process

  • Account data: name, email address, bcrypt password hash.
  • Subscription data: Premium plan type (monthly/yearly/one-off), status, start and end date, billing period dates.
  • Payment data: transaction ID from our payment provider (Stripe), amount charged, payment method type and the last four card digits for receipts. We never process or store full card numbers, CVC codes or online banking credentials — they go directly to the provider's secure environment (PCI DSS Level 1).
  • Billing data: receipt number, billing address (if provided), VAT number (business customers), VAT country.
  • Technical data: language choice and cookie choice in your browser's local storage.
  • Logs: login time and IP address for security purposes (90 days).
  • Newsletter: email address and subscription time.

We do not collect location data, profiling data, ad-tracking data or biometric data.

3. Purpose and legal basis (GDPR Art. 6)

  • Contract (Art. 6(1)(b)): creating your account, delivering Premium, billing and handling cancellations.
  • Legal obligation (Art. 6(1)(c)): keeping accounting records under the Finnish Accounting Act (1336/1997) for 6 years after the end of the financial year, VAT obligations and other regulatory requirements.
  • Consent (Art. 6(1)(a)): sending the newsletter (withdraw any time); non-essential cookies.
  • Legitimate interest (Art. 6(1)(f)): service security, preventing abuse and payment fraud, handling disputed charges — no profiling and no automated decisions.

4. Retention periods

  • Account data: lifetime of the account; at most 30 days after a deletion request.
  • Accounting records (receipts, invoices, transaction IDs): 6 years from the end of the financial year.
  • Basic subscription data: lifetime of the subscription + 12 months for disputed charges.
  • Login logs and IP addresses: 90 days.
  • Newsletter subscription: until you unsubscribe.
  • Cookies: see the cookie policy (up to 365 days).

5. Recipients and transfers

We do not sell or rent personal data. Data is never disclosed to third parties for marketing or analytics purposes.

We use the following processors (GDPR Art. 28):

  • Stripe Payments Europe, Ltd. (Ireland) — payment processing, card charges, receipts. Transfers to the United States rely on EU Standard Contractual Clauses (SCC) and the EU-US Data Privacy Framework certification.
  • EU-based data centre — servers and hosting within the EU/EEA.
  • EU-based email service — delivery of transactional and receipt emails.

A data processing agreement (DPA) under GDPR Art. 28 is in place with every processor. An up-to-date list is available on request from [email protected].

6. Your rights (GDPR Art. 15–22)

  • Right of access to your data (Art. 15).
  • Right to rectification (Art. 16).
  • Right to erasure / to be forgotten (Art. 17).
  • Right to restriction of processing (Art. 18).
  • Right to data portability (Art. 20) — you receive your account data in JSON format.
  • Right to object (Art. 21), in particular to direct marketing.
  • Right to withdraw consent (Art. 7(3)) at any time.
  • Right to lodge a complaint with the Office of the Data Protection Ombudsman.

To exercise your rights: [email protected]. We verify your identity and reply without undue delay, within 30 days at the latest.

7. Consequences of not providing data

A name and email address are required to create an account. A Premium subscription additionally requires a valid payment method, entered directly with the payment provider. Public content (results, archive, statistics, history) is available without an account.

8. Automated decision-making and profiling

We make no automated decisions with legal or similarly significant effects for users (Art. 22). We do not profile users.

9. Security

Passwords are stored only as bcrypt hashes. Traffic is protected with TLS. Accounts are locked after repeated failed login attempts.

10. Changes to this policy

We update this policy when needed. Registered users are notified of material changes by email or an on-site notice at least 14 days in advance.

Last updated 21 October 2026