What happens to your data

What we process

You can use the service without an account, and we ask for neither your name nor your email address. This is what we process:

• Your company's basics

  You type in the company name, the website and a free description of what the company does. The website and the description are optional.

• Your answers to the background questions

  Company form, home municipality, industry and the size band of your headcount, for example. These are set options, never free text.

• Your legislation maps and their results

  Which legislation may apply to your company, and which of your answers the assessment rests on.

• Business ID lookup

  If you fetch your company's details with a business ID (Y-tunnus), we send that ID to the open interface of the Finnish Patent and Registration Office. What comes back stays in your browser's session memory until you accept it. Only accepting it stores it with us.

• Your IP address, to stop abuse

  We do not store the IP address itself. The server hashes it with a secret key, and only the hash is kept, to count how often the service has been used.

• The AI call log

  Time, model used, duration, size, outcome and identifiers. The log holds neither the call nor the answer: the database has no column the content would fit in.

The platforms we run on write technical logs of their own, and those can contain IP addresses. They are listed as processors below. We control neither what those logs hold nor how long they are kept, so we quote no retention times for them here.

Cookies

This site (lagatlas.fi) sets one cookie, which remembers the language the site is shown to you in. It holds the language code fi, en or sv and nothing else, no identifier, and it goes away when you close your browser.

The app (app.lagatlas.fi) sets one necessary session cookie. It holds a random identifier that lets the service find your unfinished legislation map when you come back. Browser JavaScript cannot read it, it travels only over an encrypted connection, and it is valid for no other address. On the server we keep only a hash of the identifier.

We use no visitor analytics, no advertising cookies and no other tracking on either site. That is why there is no cookie banner: nothing we set follows you around.

Our typefaces come from our own server. Opening this page makes no request to a third-party host at all.

The one third-party component that loads in the browser is Cloudflare's Turnstile bot check, and it sits only on the app page where a legislation map is started. It tells a human visitor from an automated one, so the service does not fall over under bulk use.

Artificial intelligence

Drafting the map uses an AI model to judge which legislation may apply to your company. What comes out is an assessment, never a legal opinion.

The model receives your confirmed background answers in coded form, such as the headcount size band and the industry, plus text from the legislation catalogue.

Your company name, your website and the description you wrote are not sent to the model.

The models run through Amazon Bedrock, as inference calls inside the EU.

We do not train AI models on your data.

Who your data goes to

We do not sell your data and we do not release it for marketing. These processors handle data on our behalf:

Vercel

Hosting and runtime for the service, EU region.

Supabase

Database, EU region (Stockholm).

AWS (Amazon Bedrock)

AI processing, as inference calls inside the EU.

Cloudflare

The Turnstile bot check.

A business ID lookup also goes to the open interface of the Finnish Patent and Registration Office. That is a public authority's own service, not a processor of ours.

We use no payment provider and no email provider yet. We will add them to this list before they start handling your data.

How long we keep it

The session and everything attached to it

7 days from your last visit, and a visit extends it. Expired sessions are deleted once a day, and the deletion takes the company basics, the answers, the legislation maps and the results with it.

The abuse-prevention counters

48 hours after the counting window closes. The IP address sits in them as a hash.

The AI call log

24 months. It outlives the session's deletion, but the identifiers in it no longer point at anything about you.

Background job rows

7 days for the ones that succeeded, 90 days for the ones that failed. They hold identifiers and nothing more.

These are the service's settings today. If we change them, the change shows up on this page.

The basis for processing

We process on the basis of our legitimate interest: running the service for you, and protecting it from abuse such as automated bulk use that would cost us money.

We do not profile users and we make no automated decisions about you as a person. What the map judges is the company, and those judgements are assessments rather than decisions.

Your rights

You have the right to know what data about you is processed, to have incorrect data corrected, to ask for your data to be deleted, and to object to the processing.

The fastest way to be rid of the data is to clear this site's cookies in your browser. Nothing can reach your session after that, and the data is deleted automatically once the session expires.

You can also ask us to delete it, by email to the address above. Since we collect no name and no other identifier, we need you to tell us which legislation map the request is about. Without that we cannot find the data, and we cannot be sure it is yours.

If you are unhappy with how we handle your data, you can complain to the Office of the Data Protection Ombudsman: tietosuoja.fi.