Privacy policy

1. Data controller

Pipelytica Oy

Y-tunnus: 3620175-2

Lauri Järvinen

Hallamäentie 3, 37800 Akaa

Tel. 0400-167075

Data Protection Officer: info@pipelytica.com

2. Personal data collected

We collect the following data:

Basic information

Name, email, phone number, company name, business ID

User data

Project data

Inspection videos, reports, floor plans, findings, images

Technical data

IP address, browser, device, login timestamps

3. Purpose of processing

Providing, maintaining, and developing the service
User account management and authentication
Generating and delivering inspection reports
Training and improving AI models (anonymised)
Customer communication, billing, and technical support
Legal obligations and security

4. Legal basis for processing

The processing of personal data is based on:

Contract (Art. 6(1)(b)): Service delivery and user account management
Consent (Art. 6(1)(a)): Marketing communications
Legitimate interest (Art. 6(1)(f)): Service development, security, analytics
Legal obligation (Art. 6(1)(c)): Accounting, regulatory obligations

5. Data retention and location

The database and files are stored in Finland

The database, videos and reports are on Hetzner servers in Helsinki. Some sub-processors are US companies (see section 6), so some data may be processed outside the EU.

Personal data is retained for as long as the user account is active. After account deletion, data is erased within 90 days. Billing data is retained for 6 years in accordance with accounting legislation.

6. Data sharing

We do not sell or disclose personal data to third parties for marketing purposes. Data may be shared with:

Sub-processors: Hetzner (servers, database and files, Helsinki), Vercel (delivery of the website and the application), Resend (sending email) and Anthropic (AI-assisted report summary and quality check when the feature is enabled; report pages sent for the quality check can contain the customer details printed in the report)
Authorities: When required by law
At the customer's request: Delivery of reports to designated recipients

7. Cookies & browser storage

We use only the browser storage the service needs to function:

Login session management: a session token (JWT) in browser localStorage and a short-lived media_token cookie (at most 20 minutes) used to load videos, screenshots and report PDFs
Language preference (localStorage)

We do not use Google Analytics, advertising cookies, or profiling tools. Usage is measured with Vercel's built-in analytics (cookie-free, no personal data collection). The platform is hosted on Vercel (web) and Hetzner (API, database) – DPAs with these processors are in place.

8. Data subject rights (GDPR)

Under the EU General Data Protection Regulation (GDPR), you have the right to:

Right of access

Request a copy of all personal data stored about you

✏️

Right to rectification

Correct inaccurate or incomplete personal data

Right to erasure

Request deletion of your data ("right to be forgotten")

⏸️

Right to restriction

Restrict the processing of your data in certain circumstances

Right to data portability

Transfer your data in a machine-readable format to another service

🚫

Right to object

Object to the processing of your data in certain circumstances

Right to lodge a complaint

You have the right to lodge a complaint with the Finnish Data Protection Ombudsman: tietosuoja.fi

9. Security

We protect data through technical and organisational measures:

All traffic encrypted (TLS/HTTPS)
Passwords hashed with bcrypt (12 rounds)
Role-based access control (4 user roles)
Login attempt rate limiting and a temporary block after repeated failures
Audit logs of key actions
OWASP Top 10 protections (SQL injection, XSS, CSRF)
Regular internal security reviews

10. Changes to this privacy policy

We update this privacy policy as needed. Significant changes will be communicated by email or through the service at least 30 days in advance.

11. Contact for data protection matters

For all questions regarding the processing of personal data, please contact:

Pipelytica Oy – Data Protection Officer