Privacy policy | Nopsa.io

Last updated: 1 June 2026

This policy describes what information the Nopsa.io site collects and how it is processed. The policy applies to the marketing site nopsa.io. A separate privacy policy applies to the Nopsa application (app.nopsa.io) and is shown inside the application.

1. Data controller

Datahaltuun Oy (Finnish business ID 3146498-3) is the data controller for information covered by this policy.

Contact for privacy matters: hei@nopsa.io.

2. Data we process

The marketing site processes the following information:

Technical server logs. IP address, user agent, requested URL and timestamp. Generated by the normal operation of the hosting service.
Email communication. Contents of any message you voluntarily send us and the contact details you include.
Cookie data. Only with your consent. Category details are listed below.

3. Cookies

We use cookies in the categories described below. You can change your choices at any time via the "Manage cookies" link in the site footer.

Essential

Purpose: Basic site functionality, remembering language choice and your cookie consent.
Cookies: No third-party cookies. Consent state is stored in your browser's localStorage under the key nopsa.consent.
Duration: 12 months

Analytics — Google Analytics 4

Purpose: Understanding how the site is used so we can improve the content.
Cookies: _ga, _ga_*
Duration: Up to 14 months
Recipient: Google LLC, United States
Transfer: Data is transferred to the United States. Transfer basis: EU Standard Contractual Clauses (SCC) and the Google EU-US Data Privacy Framework.

Marketing — Meta Pixel

Purpose: Ad targeting and campaign measurement.
Cookies: _fbp, _fbc
Duration: Up to 90 days
Recipient: Meta Platforms Ireland Ltd (EU), Meta Platforms Inc (United States)
Transfer: Data may be transferred to the United States. Transfer basis: EU Standard Contractual Clauses (SCC) and the Meta EU-US Data Privacy Framework.

Change your choice via the "Manage cookies" link in the site footer.

4. Legal basis for processing

The legal basis for processing is:

Consent (GDPR Art. 6(1)(a)). Analytics and marketing cookies and the related processing.
Legitimate interest (GDPR Art. 6(1)(f)). Technical server logs (security and incident analysis) and email communication to respond to messages you send us.

5. Recipients of data

We use the following processors:

Hetzner Online GmbH. Hosting in Germany (EU). Technical server logs are generated by the normal operation of the hosting service.
Google LLC (Google Analytics 4). Only if you have consented to analytics. United States. Transfer basis: SCC and EU-US DPF.
Meta Platforms Ireland Ltd and Meta Platforms Inc (Meta Pixel). Only if you have consented to marketing. EU and United States. Transfer basis: SCC and EU-US DPF.

6. Retention periods

Server logs. 30 days.
Email messages. Until the matter has been handled, plus a reasonable period afterwards for follow-up questions.
Analytics cookies (_ga, _ga_*). Up to 14 months or until you withdraw your consent.
Marketing cookies (_fbp, _fbc). Up to 90 days or until you withdraw your consent.
Consent state (localStorage). 12 months or until you change your choice.

7. Your rights

The EU General Data Protection Regulation (GDPR) gives you the following rights regarding personal data we process:

Right of access (GDPR Art. 15). You can request information about which of your data we process.
Right to rectification (GDPR Art. 16). You can request that inaccurate data be corrected.
Right to erasure (GDPR Art. 17). You can request that your data be deleted if there is no longer a basis for processing it.
Right to restriction (GDPR Art. 18). You can request that processing be restricted in defined situations.
Right to data portability (GDPR Art. 20). You can request data processed on the basis of consent in a machine-readable format.
Right to object (GDPR Art. 21). You can object to processing based on legitimate interest.
Right to withdraw consent (GDPR Art. 7(3)). You can withdraw consent at any time via the "Manage cookies" link in the site footer. Withdrawal does not affect the lawfulness of processing before withdrawal.
Right to lodge a complaint. You have the right to lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi).

To exercise your rights: send an email to hei@nopsa.io. We will respond within 30 days.

8. Changes to this policy

We may update this policy when our processing activities or applicable law change. The date at the top of this page shows when the policy was last updated.