Privacy policy

1. Controller

Noxisfin Oy (business ID 3584061-6). For privacy matters, contact info@noxisfin.com.

2. What data we process

• Browsing: IP address, browser details and technical request logs on our servers. The website does not use analytics or advertising cookies.
• Maps: map tiles are loaded from OpenStreetMap servers, which passes your IP address to the OpenStreetMap Foundation.
• Bookings: name, email address, phone number, the service address where needed, the booked service and time, and the payment status and transaction ID. Your card details are handled by Stripe and never reach Koillishub.
• Mobile app: your location only if you allow it. It is used on your device to show services on the map and sort them by distance, and it is not stored on our servers.
• Business customers: company and contact person details, login details and the information the business publishes itself.
• Enquiries: email messages and their content.

3. Purposes and legal bases

• Passing on, confirming and paying for bookings – performance of a contract.
• Operating the service, security and preventing misuse – legitimate interest.
• Bookkeeping and retaining payment records – legal obligation.
• Using location in the app – consent, which you can withdraw in your device settings.
• Answering enquiries – legitimate interest.

4. Disclosures

Booking details are passed to the business providing the service so it can deliver it. The business is an independent controller of that data. Payment data is processed by Stripe. Data may be disclosed to authorities where the law requires.

5. Our service providers (processors)

We use the following providers, which process data on our behalf under contracts and our instructions:

• MongoDB Atlas (MongoDB, Inc.) – the database storing services, companies and bookings.
• Render (Render Services, Inc.) – servers for the Koillishub API.
• Vercel (Vercel Inc.) – servers for the koillishub.fi website.
• Stripe (Stripe Payments Europe Ltd.) – payment processing and payouts to service providers.
• Cloudinary (Cloudinary Ltd.) – storage of images uploaded by businesses.
• Resend (Resend, Inc.) – sending booking confirmations and other service messages.
• Sentry (Functional Software, Inc.) – monitoring of technical errors.
• Google (Google Ireland Ltd.) – converting business and service addresses into map coordinates.

6. Transfers outside the EU and EEA

Some providers are based in the United States, so data may be processed outside the EU and EEA. Transfers rely on the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.

7. Retention

• Booking and payment records: six years from the end of the year in which the financial period ended, as required by the Finnish Accounting Act.
• Server technical logs: short-term, at most 12 months.
• Business account data: while the account is active and thereafter for as long as accounting obligations require.
• Email enquiries: for as long as handling the matter requires.

8. Your rights

You have the right to access, rectify and erase your data, to restrict or object to processing, and to data portability. You can withdraw consent at any time. Send requests to info@noxisfin.com.

If you believe your data is processed unlawfully, you can lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi).

9. Changes

We update this policy when the service or our providers change. The date of the latest update is shown at the top of the page.