TuntiTassu Soolo – privacy notice

Version 1.5, effective from 24 September 2026

This is a translation of the Finnish privacy notice, version 1.5. It is provided for information. If the versions differ, the Finnish version prevails.

This notice explains what personal data is processed in the TuntiTassu Soolo service, why and for how long. The notice has been drawn up in accordance with Article 13 of the General Data Protection Regulation (EU) 2016/679 (GDPR).

This notice applies to the TuntiTassu Soolo service. TuntiTassu Tiimi, which is intended for organisations, falls outside the scope of this notice.

1. Controller

Digitahti Oy
Business ID 3514735-2
Metsäkulmankatu 38, 48910 Kotka, Finland
Telephone +358 41 327 4360
tuki@tuntitassu.fi

The contact person for data protection matters is Kai Nyyssönen. No data protection officer has been designated, because the conditions laid down in Article 37 of the General Data Protection Regulation are not met.

2. When we are the controller and when we are the processor

Our role depends on whose data is concerned.

We are the controller when we process your own data: your email address, your profile, your subscription and your own time entries. For this data, we decide why and how it is processed. This notice explains how that is done.

We are the processor when you enter personal data concerning third parties in the service. This happens, for example, if you write the name of your own client in a task description or a project name. For this data, you are the controller, and we process it on your behalf and in accordance with your instructions. In that case, the data processing agreement annexed to the terms of service applies.

In practice, the difference means this: we do not decide what you write in a task description, and we do not read it. You are responsible for ensuring that there is a basis for recording data concerning third parties. We are responsible for keeping the data secure.

3. What data we process

Authentication

Email address. It is the only mandatory item of data and serves as your identifier in the service. There is no password, and no password is stored. Sign-in takes place with a one-time link or code.

Data you provide

Display name, hourly rate and language selection. All of these are optional. The hourly rate is needed only if you want billing amounts on your reports.

Time entries

Date, project name, number of hours, task description, category, breakdown by category, billable setting, remote-work flag and entry-specific hourly rate.

The task description and the project name are free text, the content of which you choose yourself. They may contain the names of your clients or other data concerning third parties. For this data, the division of roles under section 2 applies.

Subscription and billing data

Subscription status, billing period, subscription and transaction identifiers, and the timestamp of your acceptance of the terms and the version identifier of the accepted terms.

When subscribing, you may also voluntarily provide your company name and Business ID so that they are printed on receipts. These are stored in Stripe’s customer data.

Trial data

The start and end time of the free trial, the version identifier of the terms of service accepted at the start of the trial, and information on when the trial reminder messages have been sent. The start time of the trial is also the timestamp of your acceptance of the terms.

Technical data

Logs of the service and its subcontractors, which record the IP address and information about the browser. These are used only for security and troubleshooting.

In addition, on the subscription start page, the email address and IP address are stored for one day in order to limit the number of requests – even if the subscription is not completed and no account is created.

Payment data

Payment card data is not processed or stored in the service at all. It is processed by Stripe on its own page. Only the subscription status and the transaction identifier are passed to the service.

No payment details at all are collected for the free trial. They are provided to Stripe only if you decide to continue using the service on a paid basis.

4. What the data is used for and on what legal basis

A balancing test has been carried out for processing based on legitimate interest. You can request information about it by emailing tuki@tuntitassu.fi.

Messages about the trial. When the trial starts, we send you a confirmation stating the start and end date of the trial and the version of the terms of service you accepted, with the terms of service attached. If you do not have a valid subscription, we also send you two reminders: about three days before the trial ends, and after the trial has ended, when your account is locked. The reminders state when the trial ends and the account is locked, when the data will be deleted at the earliest, and how you can download your data or continue using the service.

The legal basis is the performance of a contract. The messages are notifications relating to the provision of the service and the deletion of data, which inform you in good time of the consequences under the terms of service: the end of the trial, the locking of the account and the deletion of data. The reminders and the deletion warning described in section 8 do not contain marketing, prices or offers.

The deletion warning is also linked to the principle of storage limitation (Article 5(1)(e)): data is deleted when it is no longer needed, and the warning gives you the opportunity to download it before it is deleted.

The data is not used for profiling or for automated decision-making that would have legal effects concerning you or otherwise significant effects on you.

The data is not sold or disclosed for marketing purposes.

The data is not used to train AI models. The service has an interface for task suggestions, but it is a feature of the Tiimi version, and the server rejects requests from personal workspaces. The data of Soolo users is not sent to a language model.

5. Whether providing data is mandatory

Providing an email address is a prerequisite for starting a trial and for entering into the contract. Without it, you cannot try or subscribe to the service or sign in to it, because the address serves as your identifier.

All other data is optional. You can use the service without a name, hourly rate or company details. In that case, some functions are not available: without an hourly rate, your reports will have no billing amounts, and without a company name and Business ID, these will not be printed on receipts.

You decide the content of your time entries yourself.

6. Who processes data on our behalf

An up-to-date list with contact details is available on the subprocessors page.

A data processing agreement in accordance with Article 28 of the General Data Protection Regulation has been concluded with each subcontractor.

No time tracking data passes through Resend. No time tracking data is passed to Stripe.

Support requests are a separate matter. A support request contains your name and email address and whatever you yourself write in or attach to the message. Your time entries are not transferred to the support system automatically – they end up there only if you yourself attach, for example, a screenshot. A support request can be sent by email, using the form on the support site or via the “Help and support” item in the app.

The part of Vercel’s processing that takes place in the United States concerns bot detection on the subscription page and the platform’s management and logging interfaces. The server functions are locked to Stockholm, and no time tracking data is processed in the United States (see section 7).

Stripe has a dual role. Stripe acts as a processor to the extent that it processes data on our behalf, and as an independent controller with regard to the processing of payment transactions, the prevention of misuse and its own statutory obligations. Stripe’s own processing is governed by Stripe’s privacy policy: stripe.com/privacy

Data may also be disclosed to authorities in order to fulfil statutory obligations.

The static content of the service, such as page templates, styles and images, is distributed from a global content delivery network. No personal data is transmitted with it.

The marketing website contains no third-party content. No visitor tracking, no embedded content and no externally loaded fonts.

7. Whether data is transferred outside the EU

The service’s data is processed mainly in the EU:

• database and authentication in Stockholm;
• functions executed on the server in Stockholm; and
• sending of emails in Ireland.

The first exception is payment processing. Stripe also processes payment transactions in the United States. The transfer is based primarily on European Commission Implementing Decision (EU) 2023/1795 of 10 July 2023, which found the EU-US Data Privacy Framework to be adequate. Stripe Inc. is certified under this framework.

On a secondary basis, the transfer is subject to the standard contractual clauses approved by the European Commission, which are included in Stripe’s Data Transfers Addendum.

The second exception is Vercel’s platform. Detection of automated traffic (BotID) on the subscription start page and the platform’s management and logging interfaces may also process data, such as IP addresses, in the United States. The application’s server functions and database remain in Stockholm, and no time tracking data is processed in the United States. The transfer is based primarily on the same Implementing Decision (EU) 2023/1795 – Vercel Inc. is certified under the Data Privacy Framework – and secondarily on the standard contractual clauses included in Vercel’s Data Processing Addendum.

The third exception is the handling of support requests. Support tickets are stored in Zoho’s data centres in the European Economic Area, but Zoho group companies in India may access them where support and troubleshooting so require. The transfer is based on the standard contractual clauses approved by the European Commission, which are included in the data processing agreement signed on 24 August 2026 (Zoho Corporation B.V., Utrecht, the Netherlands). The EU-US Data Privacy Framework does not apply to the agreement, because the transfer is not to the United States.

You can request a copy of the safeguards applicable to transfers by emailing tuki@tuntitassu.fi.

8. How long data is retained

Account data

Your data is retained for as long as your account exists.

When you delete your account yourself

When you delete your account using the function in the settings, the data is deleted from the production database immediately. Deletion is irreversible. The data deleted comprises your account, profile, entries and settings.

A record of the deletion is kept for 30 days, containing only the account identifier and the reason for and time of the deletion – no name or address. It is used to carry out the deletion again if the database has to be restored from a backup.

A break is a different matter. It does not delete anything immediately – see below.

Locked account

When the subscription has ended or a payment has failed, the account is locked. The data is retained, and you can download it at any time.

A locked account and its data are deleted when the account has not been used for 12 months. Creating or changing time entries and having a valid subscription are each deemed to be use. Merely signing in or downloading your own data does not count as use.

You will be notified of the deletion by email well in advance, so that you have time to download your data or resume your subscription. Deletion takes place at the earliest 30 days after the notification and at the latest 13 months after the last use. The upper limit exists so that the data of an address that cannot be reached is not retained indefinitely. If deletion is delayed due to a technical fault, it is carried out without delay once the obstacle has been removed.

This clause also applies to an account that started with a trial if you have provided your payment details and have not withdrawn from the contract during the trial. The following clause applies to an account for which payment details have never been provided and to an account whose contract you have withdrawn from during the trial.

Account locked after the trial has ended

If the trial ends and you have not provided your payment details, the account is locked. The same applies to an account whose contract you have withdrawn from during the trial. The data is retained, and you can view it and download it.

The account and its data are deleted when three months have passed since the end of the trial. You will be notified of the deletion by email at least 30 days in advance, and deletion takes place at the earliest 30 days after the notification and at the latest four months after the end of the trial. If deletion is delayed due to a technical fault, it is carried out without delay once the obstacle has been removed.

The retention period is shorter than for a paying customer’s locked account, because a trial account has not been in paid use. Three months is enough for you to download your data or decide whether to continue.

Other retention periods

Logs are listed by subcontractor because their retention periods differ and no single figure would describe them correctly. Logs are a different matter from payment, customer and billing data: the latter are not deleted along with these time limits but are retained in accordance with the lower rows of the table.

Data relating to payment transactions is retained by Stripe even after the account has been deleted. This material cannot and may not be deleted on request, because its retention is based on a statutory obligation.

Backups

Data is deleted from the production database immediately. Backups follow their own cycle, and deleted data disappears from them as the cycle runs. The maximum length of the cycle is 7 days.

Backups are used only to restore the service in the event of a disruption. No individual data is retrieved from them, and they are not used for any other purpose. If a restore has to be carried out, the deletions made after the backup was taken are carried out again after the restore.

9. Your rights

You have the right to:

1. be informed of what data about you is processed and obtain a copy of it (Article 15);
2. receive the data you have provided in a machine-readable format and transmit it to another service provider (Article 20);
3. have inaccurate or incomplete data rectified (Article 16);
4. have your data erased (Article 17);
5. restrict processing (Article 18);
6. object to processing based on legitimate interest (Article 21); and
7. lodge a complaint with a supervisory authority (Article 77).

How to exercise your rights

Points 1, 2, 3 and 4 can be exercised directly in the service. In the settings, you can download your own data in a machine-readable format (CSV and JSON), change your profile and entries, and delete your account. No fee is charged for downloading.

For other matters, contact tuki@tuntitassu.fi.

Response time. Requests are answered within one month at the latest. Where necessary, this period may be extended by two months, in which case we will inform you of the extension and the reasons for the delay (Article 12(3)).

The right to erasure is not tied to any time limits. You can require us to erase your data at any time, including when your account is on a break or locked. The time limits described in section 8 do not restrict this right.

Supervisory authority

If you consider that your data is being processed unlawfully, you can lodge a complaint with the supervisory authority. In Finland, the supervisory authority is the Data Protection Ombudsman:

Office of the Data Protection Ombudsman
Visiting address: Lintulahdenkuja 4, 00530 Helsinki
Postal address: P.O. Box 800, 00531 Helsinki
Telephone: +358 29 566 6700
Email: tietosuoja@om.fi
tietosuoja.fi

We hope that you will contact us first. That is usually the quicker way to get the matter put right.

10. Security

Connections are encrypted. Traffic between the browser and the service, and between the service and its subcontractors, is encrypted.

Access rights are restricted at database level. The restriction is based on the database’s row-level security policies and not merely on the user interface. Each user sees only their own data.

There are no passwords, so they cannot leak. Sign-in takes place with a one-time link or code, both of which expire after a short time. You can request that all your sessions be invalidated by emailing tuki@tuntitassu.fi.

The service provider’s access to data

This should be stated openly, because it is the single most important question from a security point of view.

The administrator role does not give read access to entries. The service provider has an administrator account used to manage organisations and access rights. It is necessary for creating accounts and handling support requests. It does not give access to the time entries in personal workspaces or to their task descriptions. The restriction is implemented at database level.

A direct database connection exists. As the system administrator, the service provider has a technical database connection that is needed for troubleshooting and backups. It cannot be removed for technical reasons – the same applies to every service provider that administers its own system. In this respect, the protection is procedural:

• the connection is used only for troubleshooting and backups;
• access is limited to named individuals, currently one;
• the content of entries is not read;
• the content is not used for marketing, profiling, statistics or training AI models.

The Soolo version does not show the consent option at all, so you cannot grant read access through the app even if you want to. This means that we cannot access the content of your entries through the app in any way.

Personal data breaches

If a personal data breach occurs, we will notify the Office of the Data Protection Ombudsman without undue delay and no later than 72 hours after becoming aware of it. The only case in which no notification is made is where the breach is unlikely to result in a risk to the rights and freedoms of natural persons. If the breach is likely to result in a high risk to your rights, we will also notify you without undue delay.

11. Data stored on your device

Only data necessary for the service to function is stored in the browser’s local storage: the sign-in session and functional choices, such as language selection or dismissing a notification. This data is not used for tracking.

Because storage is limited to what is strictly necessary to provide the service you have requested, no consent is required. The legal basis is section 205(2) of the Act on Electronic Communications Services (917/2014).

There are no tracking cookies, advertising cookies or visitor tracking in the service.

Detection of automated traffic. The subscription start page uses Vercel’s BotID detection, which distinguishes automated traffic from human users. The check is invisible, it is used only on the subscription start page, and its signals are used only to prevent misuse. The data is not used for advertising, tracking or identifying individual users in other contexts.

12. Changes to this notice

You will be notified of material changes by email before they take effect. The current version of the notice is always available on our website.

Each version is numbered and dated. Earlier versions are available on request from tuki@tuntitassu.fi.

Digitahti Oy · Business ID 3514735-2 · Metsäkulmankatu 38, 48910 Kotka, Finland · +358 41 327 4360 · tuki@tuntitassu.fi