Privacy Policy

We collect pseudonymous analytics data via Google Analytics 4 and cookieless visitor statistics via Umami. If you subscribe to our newsletter, we store your email address securely. We do not collect any other personally identifiable information unless you contact us directly.

2a. Legal Basis for Processing (GDPR Art. 6)

We rely on the following legal bases for each processing activity:

for analytics cookies (Google Analytics 4) and any non-essential cookies. You give consent via the cookie banner and can withdraw it at any time.

for newsletter subscription. You give consent by submitting the signup form; you can withdraw at any time via the unsubscribe link.

for essential cookies (storing your consent preference) and for fraud-prevention / security logs. Our interest is operating a functioning website; this is balanced against your reasonable expectations.

for affiliate-link click attribution. Our interest is being paid the commission we have earned editorially; the data collected is minimal (referral source) and you can decline by not clicking affiliate links.

for cookieless visitor statistics with Umami (section 4). Our interest is knowing which pages and forms work; Umami stores nothing on your device and does not keep your IP address.

Our website uses cookies to improve your browsing experience and to collect pseudonymous analytics data. These include:

required for the website to function properly (consent preferences, session data).

used by Google Analytics 4 to understand how visitors interact with our site. Collected pseudonymously.

We use Google Analytics 4 with Consent Mode v2. If you decline cookies, no analytics data is collected. If you accept, usage data (pages viewed, time on site, device type, and location at country and city level) is sent to Google. The data is pseudonymous: we do not send your name, email address or other directly identifying information, but the random cookie ID and your IP address are personal data under the GDPR.

We also use Umami Cloud to count page views, clicks on some of our links and buttons (for example to our sister sites or our app) and the steps of our forms and tools, for example when a newsletter form is shown, started or submitted. Umami uses no cookies and stores nothing on your device, so it runs whether or not you accept cookies. It records the page address and title, the site you came from, your browser, operating system, device type, screen size, language and approximate location (country, region and city). Your IP address is used only to work out that location and an anonymous visit identifier, and it is never stored. The identifier is a hash that changes at the start of every month. These events record only what was clicked or chosen and which step it was (for example the sister site you opened) and, if a form stops you, the name of the field (for example "email"), never what you typed.

Analytics data is retained for 14 months in Google Analytics and for up to 2 years in Umami. Newsletter emails are retained until you unsubscribe.

We do not sell or share your personal data with third parties. However, the following third-party services process data as part of our operations:

Several of the third-party services we use are based in or transfer data to countries outside the European Economic Area (EEA), most commonly the United States:

(Google LLC, USA): covered by the EU–US Data Privacy Framework (DPF).

(Umami Software, Inc., USA; servers in the US and the EU): covered by Standard Contractual Clauses.

(Cloudflare Inc., USA): covered by the EU–US Data Privacy Framework and Standard Contractual Clauses (SCCs).

(Resend Inc., USA): covered by Standard Contractual Clauses.

(Supabase Inc., USA, with EU region hosting available): covered by Standard Contractual Clauses.

(GetYourGuide GmbH, Germany): within the EEA.

In each case the transfer is protected by an adequacy decision, the EU–US Data Privacy Framework, or Standard Contractual Clauses approved by the European Commission. You can request a copy of the relevant safeguards by contacting us.

As we operate from Finland and serve visitors from the European Union, the GDPR applies in full. You have the following rights:

request a copy of the personal data we hold about you.

ask us to correct inaccurate or incomplete data.

Right to erasure / "right to be forgotten" (Art. 17)