Privacy policy

1. General

This privacy policy explains how the Asunto-Osake Tulkki service (the “Service”) collects, processes and stores personal data in accordance with the EU General Data Protection Regulation (GDPR). It covers the web service (asunto-osaketulkki.fi), the Chrome extension and the MCP connection for AI assistants.

Controller: Rhaetia Ventures Oy
Contact: info@asunto-osaketulkki.fi

2. What data we collect, and on what basis

We collect only the data the Service needs to work. When you register, we do not ask for your name, phone number or home address.

• Email address and password: to create your account and sign you in. You can sign in with a Google account instead, in which case we receive your email address from Google. Legal basis: performance of a contract.
• Uploaded PDF documents: housing company manager’s certificates (isännöitsijäntodistus) and other housing company documents sent for analysis. Legal basis: performance of a contract.
• Analysis content: details of the property analysed: the housing company’s name and address, postcode, year of construction, flat type and size, the structured financial figures extracted from the documents (for example monthly charges, loan shares, renovation history and plans) and the score calculated from them. These are saved to your account so you can return to earlier analyses. Legal basis: performance of a contract.
• Payment and subscription data: payments are processed through Paytrail Oyj’s payment service. We do not see or store card numbers, card security codes or online banking credentials. In our own systems we store the transaction identifiers, the product bought, the amount and the payment status. For a monthly subscription we also store the payment method token issued by Paytrail, which is used for the recurring monthly charge, the start and end dates of the subscription period and the date of any cancellation. Legal basis: performance of a contract. Paytrail acts as an independent controller for payment data. More information: Paytrail’s privacy policy.
• Referral programme data: if you use the referral programme, we store your personal referral code, who invited whom, and the status and amount of the reward. To prevent misuse, we check that users do not refer themselves. Legal basis: performance of a contract and legitimate interest (preventing misuse).
• Usage log: to keep the Service working (for example the number of analyses and their timestamps; for the browser extension, also the address (URL) of the listing analysed). Legal basis: legitimate interest (keeping the Service working, investigating errors and preventing misuse).
• Enquiries: if you contact us by email or WhatsApp, we process the content of your message and your contact details to deal with your enquiry. Legal basis: legitimate interest (customer service).

3. Retention and deletion

We follow a Zero-Trace principle for uploaded files:

• PDF files sent for analysis are deleted automatically, both from our server and from the AI provider’s cloud platform, as soon as the analysis is complete. We keep neither the original document files nor their raw text.
• The result of the analysis (the property’s basic details, the financial figures extracted from the documents, the score and the enrichment data) is saved in structured form to your account, so you can return to earlier analyses and download the report again. You can delete a single analysis or your whole account at any time.
• Passwords are stored only as hashes and cannot be recovered as plain text.
• Data linked to your account is kept for as long as the account exists. The payment method token for a monthly subscription is used only while the subscription is active; once the subscription ends or is cancelled, no further charges are made with it.
• You can ask us to delete your account and all your data at any time by sending a request to info@asunto-osaketulkki.fi. We handle deletion requests within 30 days, as the GDPR requires. Deleting your account removes, in addition to the account itself, your analyses, analysis history, browser extension usage logs, credit and subscription data and referral programme data.
• Data the browser extension stores locally in your browser (the analysis cache and the sign-in token) stays on your own device. It is removed when you uninstall the extension or clear its data in your browser settings.
• Exception to the right to erasure: data about payment transactions is part of our accounting records, which the Finnish Accounting Act requires us to keep for at least six years from the end of the financial year in which the transaction was recorded. This data cannot be deleted on request; it is deleted once the statutory retention period has ended.

We do not sell, rent or disclose your data to third parties.

4. Cookies

The Service uses the following cookies:

• Strictly necessary cookies: to keep you signed in and maintain your session (Supabase Auth) and to remember your cookie choices. These cookies are required for the Service to work and do not need separate consent.
• Functional referral programme cookie: if you arrive on the site through a referral link (with a ?ref= code in the address), we store the referral code in a cookie set on our own site (aot_ref, valid for 30 days). The cookie is used only to attribute the referral when you register, so that both you and the user who invited you receive the benefit. The cookie is not set if you do not arrive through a referral link.
• Analytics cookies (PostHog): we use the PostHog analytics service to analyse how the site is used, such as page views and user actions. PostHog sets a cookie (valid for 365 days) to recognise a user between sessions. Legal basis: consent (GDPR Article 6(1)(a)).
• Marketing cookies (Google Ads): we measure how well our advertising works with Google Ads conversion tracking. Tracking records whether a visit to the site leads to an account being created or a purchase, and passes an identifier for that event to Google. The tracking script is not loaded at all before you consent. Legal basis: consent (GDPR Article 6(1)(a)).

Analytics and marketing cookies are not set until you have consented to them through the cookie banner. You can withdraw your consent at any time through the Cookie settings link in the site footer, or by deleting the cookies in your browser settings.

The demo video on the home page is embedded in YouTube’s privacy-enhanced mode (youtube-nocookie.com), so YouTube sets no tracking cookies until you start the video.

5. Security and technical partners

We use trusted, industry-standard partners to provide the Service. All data traffic is protected with SSL/TLS encryption.

• AI and analysis (Google): we use Google’s enterprise-grade APIs. The AI processes the files you send only for the duration of the analysis and does not store them permanently. The same API is used in the Service’s chat feature, where you can ask follow-up questions about an analysis: your question and the data of that analysis are sent to produce the answer. We do not use the data you send to train AI models.
• User database (Supabase): user data (email addresses, passwords) is stored encrypted in Supabase data centres in the EU.
• Payment processing (Paytrail Oyj): payment data is processed through Paytrail Oyj’s PCI DSS certified systems. Paytrail keeps the payment data on its own servers. Paytrail Oyj, business ID 2122839-7.
• Analytics (PostHog): we use PostHog on its EU servers to analyse how the Service is used. PostHog processes pseudonymised usage data (for example page views and clicks). More information: PostHog’s privacy policy.
• Advertising measurement (Google Ads): with your consent, we use Google Ads conversion tracking to measure how well our advertising performs. The data passed to Google is limited to the conversion event (account creation or purchase) and the technical identifiers linked to it.
• Email (Resend): emails sent by the Service, such as the welcome message and account confirmation and password reset messages, are delivered through Resend. These involve processing your email address.
• Area and public transport data (Digitransit / HSL, Statistics Finland): the address of the property being analysed is sent for geocoding and to find the nearest public transport stops. No personal data about the user is attached to these API calls.
• Technical platform (Google Cloud, Vercel): the Service’s technical infrastructure runs on Google’s cloud platforms in the EU. The website is delivered by Vercel Inc.
• Customer service (WhatsApp / Meta): the site has a WhatsApp button for getting in touch. If you use it, your message and phone number are processed in WhatsApp under Meta’s privacy policy. You can contact us by email only if you prefer.

6. Transfers outside the EU

We aim to keep data in the EU: the user database (Supabase), analytics (PostHog) and server infrastructure (Google Cloud) are located in the EU.

Some of the services we use are, however, based in the United States (Google Ads, Resend, Vercel, WhatsApp/Meta), so personal data may be transferred outside the EU. These transfers are based on standard contractual clauses approved by the European Commission and/or the EU-US Data Privacy Framework.

7. Automated decision-making and profiling

The Service produces an automated score and analysis from housing company documents. This concerns the housing company, not the user, and is not used to make decisions about the user. We make no automated decisions about you that have legal effects or similarly significant effects, and we do not profile users for marketing.

8. Your rights

Under the GDPR, you have the right to:

• Access the personal data collected about you.
• Have inaccurate or incomplete data corrected.
• Have your personal data erased (the “right to be forgotten”).
• Receive your data in a machine-readable format to move it to another service.
• Object to or restrict processing in certain situations.
• Withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before it.

You can exercise your rights by sending a request to info@asunto-osaketulkki.fi. If you believe your personal data is not being processed lawfully, you have the right to lodge a complaint with the supervisory authority (the Office of the Data Protection Ombudsman, tietosuoja.fi).

9. Browser extension (Chrome Extension)

Asunto-Osake Tulkki is also available as a Chrome extension. This section describes the extension’s privacy practices in line with Google’s Chrome Web Store requirements.

What data does the extension collect?

• Property listing data: the extension reads the text of the open Oikotie.fi or Etuovi.com listing (price, size, year of construction, monthly charges and so on) for the analysis. Data is read only from pages the user has actively open that are supported property listing sites.
• Account data: sign-in details (email and password, or Google sign-in) are kept on Supabase’s EU servers. The sign-in token is stored in the browser’s local storage (chrome.storage) to keep the session.
• Analysis results: the results of a completed analysis are cached temporarily in the browser’s local storage (chrome.storage). This prevents the same listing being analysed again and saves credits when switching tabs. The cached data stays until the user clears the extension data in the browser or the data expires.
• Subscription and credit data: one-off purchases and the monthly subscription in the extension are handled in the same way as in the web service (see section 2). Subscription details and the credit balance are stored in your account in Supabase.

What data is sent to our servers?

• The listing text is sent to our server (asunto-osaketulkki.fi) for analysis. The server returns the score and enrichment data; the listing text itself is not stored permanently.
• The analysis result is saved to your account: the address, postcode, asking price, overall score and timestamp of the property analysed. This lets you return to earlier analyses.
• Usage log: for each analysis run, we store the address (URL) of the listing analysed, a timestamp and whether a credit or the monthly subscription was used.
• Your sign-in token (Bearer token) is sent with every API call to verify your identity.

How is the data used?

• To produce the analysis: the listing text is used to produce the score, risk findings and area data shown to you in the side panel.
• To show your analysis history: saved results are shown in the extension’s start view and in your analyses in the web service.
• For billing and to check access: to deduct from your credit balance or check that your monthly subscription is active.
• To prevent misuse and enforce the technical limit: the usage log is used to enforce the fair use limit (at most 100 analyses per day) and to investigate errors.

The data is not used for advertising, profiling, tracking users or training AI models.

What data does the extension NOT collect?

• We do not read your browsing history. The extension checks the address of the active tab only to tell whether it is a supported property listing page. Addresses of other sites are not sent or stored anywhere. The addresses of listings you analyse are, however, saved in the usage log, as described above.
• We do not read content from sites other than the supported property listing sites (Oikotie.fi, Etuovi.com). The extension’s content reader is installed only on these sites.
• We do not collect location data or device identifiers. The extension has no analytics or advertising tracking: PostHog, Google Ads and other third-party tracking tools are not included in it. We do not track your clicks, mouse movements, scrolling or keystrokes.
• We do not collect personal data that the user has not provided when registering.

As with all web traffic, our server can technically see the IP address an API call came from. We do not link it to your account or use it for tracking or profiling.

Sharing data with third parties

The extension sends data to the following third parties only to produce the analysis:

• Supabase (EU servers): user authentication, credit management and storing usage logs.
• Digitransit / HSL (through our server): geocoding the address of the property analysed and finding the nearest public transport stops.
• Statistics Finland (through our server): looking up the area’s rent and population data by postcode.
• Finnish Environment Institute SYKE (through our server): a flood risk lookup in the environmental administration’s spatial data service, using the property’s coordinates.
• Municipal map services (through our server): noise zone data looked up with the property’s coordinates from the open map services of Helsinki, Espoo and Tampere.
• Google (through our server): AI analysis using Google’s enterprise-grade API.
• Paytrail Oyj: processing payments and the monthly subscription (the user is taken to Paytrail’s payment page).

Only the location of the property analysed (address, postcode or coordinates) is sent to Digitransit, Statistics Finland, SYKE and the municipal map services. The user’s identity, email address and sign-in token are not attached to these calls.

We do not sell, rent or disclose user data to any other third parties. The data is not used for advertising, profiling or any purpose other than the extension’s primary purpose.

Storage and retention periods

The extension processes and stores data as follows:

• Listing text (price, size, monthly charges and so on): processed in real time to produce the analysis. Not stored permanently on our servers.
• Analysis result cache (chrome.storage): a completed analysis is stored in the browser’s local storage by listing address, so viewing the same listing again does not use a credit. The cache has no automatic expiry: the data stays on your device until you clear the extension data or uninstall the extension. It is not removed when you sign out.
• List of the three most recent analyses (chrome.storage): the address, city, score and timestamp are kept locally for the start view.
• Sign-in token (chrome.storage): stored locally and renewed automatically every 45 minutes. Removed when you sign out.
• Analysis history (Supabase): the address, postcode, asking price, score and timestamp of the property analysed are kept for as long as your account exists. You can remove them by deleting your account.
• Usage logs (Supabase): the URL of the listing analysed, the timestamp and the billing method are kept to enforce the fair use limit and to investigate errors for as long as your account exists. They are deleted when the account is deleted.
• Enrichment data fetched from third parties (rents, public transport, population data): fetched in real time and not stored permanently.

All data traffic between the extension and our servers is protected with HTTPS/TLS encryption.

Permissions

The extension requests the following Chrome permissions:

• activeTab & tabs: to recognise the listing URL and read the page content for the analysis.
• storage: to store analysis results and the sign-in token in the browser’s local storage.
• sidePanel: to show the side panel on the right of the browser window.
• alarms: to renew the sign-in token automatically in the background (every 45 minutes).
• identity: to run the Google sign-in OAuth flow.

The extension can access only the content of asunto.oikotie.fi and www.etuovi.com. It has no access to other sites.

Payments and monthly subscription

Payments are processed through Paytrail Oyj’s payment service. The extension does not handle card details itself: the user is taken to Paytrail’s payment page to make a purchase. For the monthly subscription, the recurring charge is made with the payment method token issued by Paytrail, which we keep while the subscription is active. See section 2 for how payment and subscription data is handled.

Referral programme

The extension includes a referral programme in which you can share your personal referral link. Referrals are attributed on our website (see sections 2 and 4); the extension does not read browser cookies or data from other sites.

Limited Use requirements

The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.

10. Connection to AI assistants (MCP)

You can connect Asunto-Osake Tulkki to an AI assistant such as Claude or ChatGPT through an MCP (Model Context Protocol) connection. The assistant can then fetch area data, calculations and your own analyses from the Service during a conversation.

What data do we process?

• Account identity (OAuth): you set up the connection by signing in to your Asunto-Osake Tulkki account and approving the connection on our own consent page. The assistant receives an access token issued by our user database (Supabase). With each call, the token tells us your account’s internal identifier and the assistant service’s client identifier. We do not receive your password from the assistant, or any details of your account with the assistant service.
• Tool calls and search terms: we see only the tool calls the assistant sends to the Service and their search terms, such as a postcode, address, municipality or the figures for a calculation. We do not see your conversation with the assistant. Search terms are used to produce the answer and are not stored in our database. If a lookup fails for a technical reason, the search term (for example a postcode or address) may be recorded in the server’s error log.
• Call log and usage limits: for each call served, we store your account identifier, the name of the tool, a timestamp and whether the call counted towards the free allowance. We use this log to enforce the free weekly allowance (3 calls in 7 days) and the usage limits (30 calls a minute and 400 an hour). Search terms and answers are not stored in the call log.
• Subscription: payments and subscription data for the MCP subscription are handled as described in section 2.

Legal basis: performance of a contract. For enforcing usage limits and for error logs, the legal basis is legitimate interest (keeping the Service working and preventing misuse).

Answers sent to the assistant service

The Service’s answers are passed to the assistant service you have chosen. When you ask the assistant to fetch your own analyses, their data is passed to it too. The assistant service (for example Anthropic or OpenAI) processes your conversation and the answers it receives under its own terms and privacy policy, and it may process data outside the EU.

Retention periods

• Search terms: not stored in our database. Server error logs are kept in Google Cloud’s logging service for 30 days.
• Call log: we keep the call log for 8 days. After that, only a daily call count per tool remains, with no user details. When you delete your account, your call log is deleted too.

11. Changes to this privacy policy

We reserve the right to update this policy. Data subjects will be notified of significant changes by email. This policy was last updated on 12 October 2026.