Privacy Policy

1. Who we are

Asunto-Osake Tulkki (“the Service”) analyses Finnish housing company documents and apartment listings and produces a structured risk assessment for prospective buyers. This policy explains how we collect, use, store and share personal data under the EU General Data Protection Regulation (GDPR).

Data controller: Rhaetia Ventures Oy
Contact: info@asunto-osaketulkki.fi

2. What data we collect

We collect only what the Service needs to function. We do not ask for your name, phone number or home address when you register.

2.1 Account and billing data (web service and extension)

• Email address and password — to create and sign in to your account. You may sign in with Google instead, in which case we receive your email address from Google. Legal basis: performance of a contract.
• Authentication tokens — a session token is issued when you sign in and is sent with each API request to verify your identity. Legal basis: performance of a contract.
• Payment and subscription data — payments are processed by Paytrail Oyj. We never see or store your card number, card security code or online banking credentials. In our own systems we store the transaction identifier, the product purchased, the amount and the payment status. For monthly subscriptions we additionally store the payment instrument token issued by Paytrail (used to take the recurring charge), the subscription period start and end dates, and the cancellation date if any. Legal basis: performance of a contract. Paytrail acts as an independent controller for payment data.
• Referral programme data — if you use the referral programme we store your personal referral code, who invited whom, and the status and amount of any reward. We check that a user does not refer themselves. Legal basis: performance of a contract and legitimate interest (fraud prevention).
• Support correspondence — if you contact us by email or WhatsApp we process the content of your message and your contact details in order to handle the matter. Legal basis: legitimate interest (customer support).

2.2 Data collected by the web service

• Uploaded PDF documents — housing manager certificates and other housing company documents you submit for analysis. Legal basis: performance of a contract.
• Analysis content — the housing company name and address, postal code, construction year, apartment type and size, the structured financial figures extracted from your documents (fees, loan shares, renovation history and plans) and the resulting score. Legal basis: performance of a contract.

2.3 Data collected by the Chrome extension

• Website content from the listing page — when you are viewing an apartment listing on Oikotie.fi or Etuovi.com, the extension reads the text content of that listing (price, size, construction year, fees, renovation sections and the description) so that it can be analysed. The extension’s content script is installed only on those two sites and runs nowhere else.
• The address (URL) of the listing you analyse — recorded together with a timestamp each time you run an analysis.
• The active tab’s address — when you switch tabs, the extension checks the address of the active tab in order to determine whether it is a supported listing page. Addresses of other sites are evaluated in memory only and are never transmitted to us or stored anywhere.
• Analysis results — the address, postal code, asking price, overall score and timestamp of each analysis you run.

The extension contains no analytics or advertising tools. It does not embed PostHog, Google Ads or any third-party tracker, and it does not record your clicks, mouse position, scrolling or keystrokes. It does not read your browsing history, and it does not read content from any site other than Oikotie.fi and Etuovi.com.

3. How we use your data

• To produce the analysis — listing text and uploaded documents are processed into a score, risk findings and neighbourhood data that are shown to you.
• To show you your history — saved results let you return to earlier analyses in the extension’s home view and in your account on the web service.
• To authenticate you and manage your account — signing in, maintaining your session and handling account deletion requests.
• To bill you and verify entitlement — deducting credits, checking that a monthly subscription is valid, and processing purchases and refunds.
• To prevent abuse and enforce technical limits — the usage log is used to enforce a fair-use limit of 100 analyses per day, to detect referral abuse and to investigate errors.
• To communicate with you — sending account confirmation, password reset and welcome emails, and answering support requests.

We do not use your data for advertising, profiling or user tracking, and we do not use it to train AI models. We do not sell, rent or otherwise disclose your data to third parties beyond the processors listed in section 5.

4. How we store and retain your data

All traffic between your browser, the extension and our servers is encrypted with TLS. Account data is held in Supabase data centres in the EU. Passwords are stored only as hashes and cannot be recovered in plain text.

Stored on our servers

• Uploaded PDF documents — deleted immediately. Files submitted for analysis are removed from our servers and from the AI provider’s platform as soon as the analysis completes. We do not keep the original files or their raw text.
• Listing text read by the extension — not stored. It is processed in real time to produce the analysis and is not persisted.
• Analysis results (address, postal code, asking price, score, timestamp) — retained for as long as your account exists, so that you can return to earlier analyses.
• Usage log (the URL of the listing analysed, timestamp, and whether a credit or a subscription was used) — retained for as long as your account exists, for fair-use enforcement and error investigation.
• Account, credit, subscription and referral records — retained for as long as your account exists.
• Enrichment data retrieved from third parties (rents, public transport, population statistics) — fetched in real time and not stored against your account.

Stored locally in your browser by the extension

• Analysis cache — a completed analysis is stored in local extension storage, keyed by the listing address, so that revisiting the same listing does not consume another credit. This cache has no automatic expiry: it remains on your device until you clear the extension’s data or uninstall the extension. It is not cleared when you sign out.
• Your three most recent analyses — address, city, score and timestamp, kept locally for the extension’s home view.
• Session token — stored locally and refreshed automatically every 45 minutes. Removed when you sign out.

Deletion

You can request deletion of your account and your data at any time by emailing info@asunto-osaketulkki.fi. We handle deletion requests within 30 days as required by the GDPR. Deleting your account removes your analyses, your analysis history, the extension usage log, your credit and subscription records and your referral data.

Data the extension has stored locally in your browser lives on your own device and is removed when you uninstall the extension or clear its data in your browser settings.

Exception to the right to erasure: records of payment transactions form part of our accounting material, which the Finnish Accounting Act requires us to retain for at least six years from the end of the financial year in which the transaction was recorded. These records cannot be deleted on request and are removed once the statutory retention period has expired.

5. Who we share your data with

We use established service providers to operate the Service. Each acts as a processor on our behalf, except Paytrail, which is an independent controller for payment data.

• Google (AI analysis) — we use Google’s enterprise APIs. The model processes submitted documents and listing text only for the duration of the analysis and does not retain them. The same API powers the follow-up chat feature on the web service. Your data is not used to train AI models.
• Supabase (user database, EU) — accounts, credits, subscriptions, analysis history and usage logs, stored encrypted in EU data centres.
• Paytrail Oyj (payments) — payment data is handled in Paytrail’s PCI DSS certified systems and stored on their servers. Paytrail Oyj, business ID 2122839-7.
• Digitransit / HSL — geocoding of the analysed property address and lookup of the nearest public transport stops.
• Statistics Finland — area rent, price and population data retrieved by postal code.
• Finnish Environment Institute (SYKE) — flood risk data retrieved by the property’s coordinates from the environmental administration’s spatial data service.
• Municipal map services (Helsinki, Espoo, Tampere) — noise zone data retrieved by the property’s coordinates from those cities’ open map services.
• Resend (email) — delivery of welcome, account confirmation and password reset emails. Your email address is processed.
• PostHog (analytics, EU) — website only — pseudonymised usage analytics for asunto-osaketulkki.fi, set only with your consent. The extension does not use PostHog.
• Google Ads (advertising measurement) — website only — conversion measurement on asunto-osaketulkki.fi, loaded only with your consent. The extension does not use Google Ads.
• WhatsApp / Meta (support) — website only — if you use the WhatsApp contact button, your message and phone number are processed by WhatsApp under Meta’s privacy policy. You can contact us by email instead.
• Google Cloud and Vercel (hosting) — our backend infrastructure runs on Google Cloud in the EU. Website delivery is handled by Vercel Inc.

Requests to Digitransit, Statistics Finland, SYKE and the municipal map services carry only the location of the property being analysed (address, postal code or coordinates). Your identity, email address and session token are never attached to them.

As with any internet traffic, our servers technically see the IP address that sent an API request. We do not link it to your account and do not use it for tracking or profiling.

We do not sell or rent your data, and we do not transfer it to third parties for advertising or any purpose unrelated to the Service’s single purpose.

6. Transfers outside the EU

We keep data in the EU where we can: the user database (Supabase), analytics (PostHog) and server infrastructure (Google Cloud) are located in the EU.

Some providers we use are US-based (Google Ads, Resend, Vercel, WhatsApp/Meta), which means personal data may be transferred outside the EU. Such transfers rely on the European Commission’s Standard Contractual Clauses and/or the EU–US Data Privacy Framework.

7. Cookies

Cookies are used on the website only. The Chrome extension does not set or read cookies.

• Strictly necessary cookies — for sign-in and session management (Supabase Auth) and to remember your cookie choice. No consent is required for these.
• Referral programme cookie — if you arrive via a referral link (a ?ref= parameter), we store the referral code in a first-party cookie (aot_ref, valid 30 days), used solely to attribute the referral when you register.
• Analytics cookies (PostHog) — to analyse site usage such as page views and interactions, valid 365 days. Legal basis: consent (GDPR Art. 6(1)(a)).
• Marketing cookies (Google Ads) — to measure whether a visit leads to a sign-up or a purchase. The tracking script is not loaded at all before you consent. Legal basis: consent (GDPR Art. 6(1)(a)).

Analytics and marketing cookies are not set before you consent via the cookie banner. You can withdraw consent at any time from the Cookie settings link in the site footer or by clearing cookies in your browser.

8. Automated decision-making and profiling

The Service produces an automated score and analysis from housing company documents and listings. This concerns the housing company, not you, and is not used to make decisions about you. We do not make automated decisions about you that produce legal effects or similarly significant effects, and we do not profile users for marketing purposes. We do not use your data to assess creditworthiness or for lending purposes.

9. Your rights

Under the GDPR you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Erase your personal data (“right to be forgotten”).
• Port your data to another service in a machine-readable format.
• Object to or restrict processing in certain situations.
• Withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before it.

To exercise your rights, email info@asunto-osaketulkki.fi. If you believe your data is not being processed lawfully, you have the right to lodge a complaint with the supervisory authority (Office of the Data Protection Ombudsman, tietosuoja.fi).

10. Chrome extension permissions and limited use

The extension requests the following Chrome permissions:

• activeTab — to read the content of the listing page you are currently viewing so it can be analysed.
• tabs — to detect the address of the active tab and notice when you navigate to a different listing, so the side panel can update.
• storage — to cache analysis results locally and to keep your session token across browser restarts.
• sidePanel — to display the analysis in the browser’s side panel.
• alarms — to wake the background worker periodically and refresh the session token before it expires.
• identity — to implement Google sign-in via a Chrome-managed authentication popup.
• Host permissions for oikotie.fi and etuovi.com — to inject the content script that reads listing data on those two sites. The extension has no access to any other website.

This extension’s use of data complies with the Chrome Web Store User Data Policy, including the Limited Use requirements.

The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.

11. Changes to this policy

We may update this policy. Registered users will be notified of significant changes by email. This policy was last updated on 28 July 2026.