1. Data Controller

Flube Oy, Business ID (Y-tunnus): 3641560-3, tuki@flube.fi is the data controller for personal data collected directly through Paloturva.app (e.g., user account data, usage data). Where your organization processes personal data about your customers through the Service (e.g., customer contact details), your organization is the data controller and Flube Oy acts as a data processor on your behalf.

2. Data We Collect

We collect and process the following categories of personal data:

• Account data: name, email address, role, and organization membership of registered users.
• Customer records: company name, business ID, contact person name, street address, postcode, city, country, phone number, email address, billing details, and preferred language.
• Device data: serial number, device type and model, location description, GPS coordinates (latitude and longitude), inspection intervals, service intervals, and maintenance due dates.
• Inspection records: task type, date and time, inspector identity, checklist results, notes, and photos of equipment.
• Usage and log data: IP address, browser and device type, timestamps, and technical event logs for security and support purposes.
• Locally cached data: the app stores a copy of your work data in your browser's IndexedDB for offline functionality. This data remains on your device.

We collect data about how the service is used, such as when a user last used the service and which actions they have taken. We use this data to operate and support the service and to improve the service and the user experience. We report the data only in aggregate.

3. Legal Basis for Processing (GDPR Art. 6)

We rely on the following legal bases to process personal data:

• Contract (Art. 6(1)(b)): processing necessary to provide and administer the Service to you and your organization.
• Legitimate interest (Art. 6(1)(f)): service security, fraud prevention, system monitoring, and improving the Service.
• Legal obligation (Art. 6(1)(c)): compliance with Finnish and EU law, including accounting and tax obligations.
• Consent (Art. 6(1)(a)): sending email notifications and maintenance reminders to your end-customers. Recipients may withdraw consent at any time via the unsubscribe link included in every email.

4. How We Use Your Data

We use the data we collect to:

• Provide, operate, and maintain the Service.
• Send inspection reports and maintenance reminder emails to your customers on your behalf via our email delivery provider.
• Authenticate users and enforce role-based access control.
• Provide technical support and resolve incidents.
• Monitor and improve Service performance and security.
• Manage billing, subscriptions, and invoicing.
• Comply with applicable legal and regulatory obligations.

5. Data Retention

We retain personal data only for as long as necessary for the purposes described in this policy:

• Account and customer data: retained for the duration of the active subscription plus 3 months after termination, to allow for data export and dispute resolution.
• Inspection records and photos: retained for the duration of the subscription. Data export is available upon request within 30 days of account termination.
• Billing and financial records: 7 years, as required by the Finnish Accounting Act (Kirjanpitolaki).
• Technical log data: 90 days on a rolling basis.

6. Your Rights

Under the GDPR and Finnish data protection law, you have the following rights:

• Right of access: obtain a copy of the personal data we hold about you.
• Right to rectification: request correction of inaccurate or incomplete data.
• Right to erasure: request deletion of your personal data where there is no longer a legal basis for processing.
• Right to restriction: request that we limit processing of your data in certain circumstances.
• Right to data portability: receive your data in a structured, machine-readable format.
• Right to object: object to processing based on legitimate interest.

To exercise any of these rights, contact us at tuki@flube.fi. You also have the right to lodge a complaint with the Finnish Data Protection Ombudsman (Tietosuojavaltuutettu) at tietosuoja.fi.

7. Data Transfers

Your data is stored within the EU/EEA by default through our infrastructure provider Supabase (EU region). Where sub-processors operate outside the EEA — for example, Google Cloud Vision, which processes device images momentarily for OCR and does not store them — transfers are governed by Standard Contractual Clauses (SCCs) approved by the European Commission or an EU adequacy decision. A list of sub-processors is provided below.

8. Sub-processors

We use the following third-party processors to operate the Service:

9. Cookies & Local Storage

The Service uses session cookies for user authentication (managed by Supabase Auth). These cookies are strictly necessary for the Service to function and do not require consent under applicable law. We do not use third-party advertising or tracking cookies. The app uses your browser's IndexedDB for offline caching of your work data — this data remains on your device and is not transmitted to third parties.

10. Contact

For data protection inquiries or to exercise your rights, contact: tuki@flube.fi
Finnish supervisory authority: Tietosuojavaltuutettu — tietosuoja.fi