Privacy Policy

Last updated: 1 August 2026

This Privacy Policy explains how InSisu (“we”, “us”, the “platform”) collects, uses, and protects your personal data when you use insisu.fi. We are committed to handling your data in line with the EU General Data Protection Regulation (GDPR) and Finnish data protection law.

Who we are

InSisu is the data controller for the personal data processed through this platform. For any privacy questions or to exercise your rights, contact us at info@insisu.fi.

What we collect

We collect only what we need to run the service:

• • Account data: your email address, a securely hashed password, an optional display name, and your profile type (Student, Worker, Family, or Refugee).
• • Onboarding progress: which checklist steps you have marked complete.
• • Feedback: whether you found a guide helpful and any optional comment you leave. This is linked to your account only if you are logged in.
• • Messages: if you use the contact form, the name, email, and message you provide, so we can reply.

We do not use advertising or third-party tracking cookies. The only cookie we set is a strictly necessary session cookie that keeps you logged in.

How we use it and our legal basis

We process your data to create and secure your account, provide your personalised onboarding checklist, record feedback to improve our guides, and respond to your messages. Our legal bases are your consent (given at registration) and our legitimate interest in operating and improving a safe, useful service.

Who processes your data

We use trusted service providers who process data on our behalf under data-processing agreements: Supabase (database and file storage, hosted in the EU), Vercel (application hosting), and Resend (transactional email such as password resets and contact replies). Where a provider processes data outside the EU/EEA, appropriate safeguards (such as Standard Contractual Clauses) apply.

How long we keep it

We keep your account data until you delete your account. You can delete your account and personal data at any time from your Profile settings page. Feedback may be retained in aggregate to improve our content, and contact messages are kept only as long as needed to handle your enquiry.

Your rights (GDPR)

You have the right to access, correct, or delete your data, to restrict or object to its processing, to data portability, and to withdraw consent at any time. You can delete your account yourself from Profile settings, or contact us at info@insisu.fi. You also have the right to lodge a complaint with the Finnish Data Protection Ombudsman (Tietosuojavaltuutetun toimisto).

Security

Passwords are stored only as bcrypt hashes, never in plain text. Access to the admin area is role-restricted, and data is transmitted over encrypted connections.

Children

This platform is intended for adults and is not directed at children under 16 without the consent of a parent or guardian.

Changes to this policy

We may update this policy from time to time. We will revise the “Last updated” date above when we do.

Contact

Questions about this policy or your data: info@insisu.fi