This translation is provided for readability. In case of any discrepancy, the Finnish version prevails.
1. Data controller
TaskuTalkkari
FinConsulting Tmi
Business ID: 3534220-3
Email: info@taskutalkkari.fi
The data controller is responsible for the lawfulness of the personal data processing described in this notice. The data controller has not appointed a separate data protection officer (DPO), because the scope of the processing does not require one under GDPR Article 37. Data protection enquiries can be sent to the email address above.
2. General information about the app's data processing
TaskuTalkkari is a mobile app that works even without an internet connection. The app's core features are free of charge and entirely device-based: all data the user enters — homes, devices, maintenance events, documents, energy data and other entries — is stored by default exclusively on the user's own device in a local SQLite database (WatermelonDB), and is not transferred to external servers in that case.
Some features do, however, process data on the data controller's servers or in third-party services, triggered by the user's own action:
- The website's feedback form (section 3.1).
- The app's optional web services: location, weather and building-data lookups (section 3.4).
- An optional user account, and with it AI-based reading of receipts and maintenance logs (section 3.5). The account is free of charge, and AI reading is available on a free account too, within a monthly quota.
- The optional PilviTalkkari cloud service: cloud sync of data between devices, storage of files (images/PDFs), shared homes and the web version (section 3.5). PilviTalkkari requires an account and is free during the beta period.
3. Personal data processed and the purposes of processing
3.1 Feedback form
| Data | Purpose | Legal basis (GDPR Art. 6) | Retention period |
|---|---|---|---|
| Name (optional) | Responding to the enquiry | Legitimate interest (6.1 f) | 12 months from receipt of the message |
| Email address (optional) | Sending a reply to the user | Legitimate interest (6.1 f) | 12 months from receipt of the message |
| Content and type of the feedback | Product development, bug fixing | Legitimate interest (6.1 f) | 12 months from receipt of the message |
| Time the form was sent | Technical record-keeping | Legitimate interest (6.1 f) | 12 months |
The Name and Email fields of the feedback form are optional. The form cannot be used for marketing communications, and email addresses are not added to any mailing list without separate consent.
3.2 Website technical data
The website does not use tracking cookies, analytics services (such as Google Analytics) or advertising-related cookies. The hosting provider, if any, may store server logs (IP address, browser type, page requested) to ensure technical operation and maintain information security. These logs are deleted automatically in line with the hosting provider's own practices, typically within 30–90 days.
3.3 Mobile app usage data
The app contains no tracking code for advertising or behavioural analytics (such as Firebase Analytics or Mixpanel) and does not track the user's activity for marketing purposes. In free, device-based use, the data controller does not receive the data the user has stored in the app.
If the user creates an account or enables PilviTalkkari, the data controller then processes data related to the account and synchronisation on its server as described in section 3.5. This also involves server-side error and stability monitoring (Sentry), limited to technical error data with identifying information filtered out; it is not used to track the user.
The App Store's (Apple) and Google Play's own data-collection practices are governed by each platform's own privacy policy and fall outside the data controller's responsibility.
3.4 The app's web services: location, weather and building data
The app works without an internet connection by default. Certain optional features do, however, fetch data from external interfaces at the user's explicit request or after separately given consent. In these cases the app sends a limited piece of data directly from the user's device to the relevant service over an encrypted (HTTPS) connection. The data is not sent to the data controller and is not used for analytics or tracking.
The user can set the home's location either by entering an address or postcode, or by using the device's positioning (GPS). Device positioning is used only when the user separately requests it; the GPS reading itself is momentary, but the home coordinate calculated from it is stored locally on the device for weather-corrected energy consumption.
| Service | Data sent | Purpose |
|---|---|---|
| Digitransit (Fintraffic) | Home address or postcode | Converting an address into coordinates (geocoding, a Finnish service) |
| Photon (komoot) | Home address or postcode | Geocoding fallback service |
| Finnish Meteorological Institute (FMI, open data) | Home coordinates | Fetching outdoor temperature and weather data for weather-corrected energy consumption |
| Ryhti building register (Ministry of the Environment) | Location/coordinates or property ID | Fetching basic building data |
| Electricity spot-price interface | No personal data (only date/region) | Displaying electricity exchange prices |
These features are optional: weather correction requires the user's consent, and the location lookup and building-data lookup start only from the user's own action. The legal basis for the processing is the user's consent (GDPR 6.1 a) for weather correction, and otherwise carrying out an app feature at the user's request (6.1 b/f). The services operate as independent data controllers or processors under their own privacy policies.
3.5 User account, AI-based document reading and PilviTalkkari
Using the app does not require an account. The user account is optional and free of charge, and is needed for two things: AI-based reading of receipts and maintenance logs, and joining a shared home. PilviTalkkari is a separate, likewise optional, cloud service (sync, backups, cloud files, ownership of a shared home and the web version); it is free during the beta period, and its planned price will be announced in the app before charging begins.
AI reading therefore does not require PilviTalkkari. On a free account too, a receipt or document the user sends is passed to the Google Cloud Vertex AI service for reading, within a monthly quota, as described below.
When the user enables an account or PilviTalkkari, the data controller processes personal data on its server as described below. The main legal basis is performance of a contract (GDPR 6.1 b), i.e. providing the service at the user's request; for security logs the legal basis is legitimate interest (6.1 f). The user's core data — account, synced data and files — and AI reading are processed within the EU/EEA. The processors used and their locations are listed in section 4.3.
| Data / feature | What is processed | Purpose | Retention |
|---|---|---|---|
| User account | Email address and password hash, or an identifier from a supported third-party sign-in service (e.g. Google) | Sign-in and account security | Until the user deletes the account |
| Cloud sync | The user's homes, devices, maintenance events, receipts and other entries | Backing up data and syncing between devices (and shared homes) | Until the user deletes the data or the account |
| Files | Images and PDF files the user uploads (e.g. receipts, documents) | Storing files in the cloud | Until the user deletes the file or the account |
| Files archived in the Vault | Documents the user chooses, in a separate cold archive (EU) | Long-term retention at the user's request; archiving is locked, so the file cannot be deleted from the app | The lock period the user chose (10 years, renewable) or a maximum of 30 days from account deletion |
| AI-based reading | The receipt or maintenance-log image/PDF the user sends (passed to Google's Vertex AI service) | Extracting structured data (e.g. vendor, amount, date) for the user to confirm | Not stored on the data controller's server — processing is momentary |
| Subscription | Subscription status and identifier (payment is made through the app store) | Managing the PilviTalkkari subscription | For the duration of the subscription; removed when the account is deleted |
| Push notifications | The device's push identifier (optional) | Notifications (e.g. maintenance reminders, shared homes) | Until the identifier expires or the account is deleted |
AI-based reading. The document the user sends is passed for reading to the Google Cloud Vertex AI service. Google acts as a data processor (GDPR Art. 28), processes the data within the EU and does not use the data to train AI models. The data controller does not store the submitted document — only the result the user has confirmed is saved to their data. The AI makes no automated decisions about the user (GDPR Art. 22): the user reviews and approves the extracted data before it is saved.
Security logs. The service records security logs (including sign-in attempts and security events: IP address, account identifier, event type and timestamp) to protect accounts and the service from misuse. Sign-in attempts are retained for approximately 30 days; the security audit log is retained for longer for security reasons.
Location of data. The application server is located in Finland (Tuusula). The database, file storage and AI processing are located elsewhere within the EU/EEA; exact locations and processors are listed in section 4.3.
4. Disclosure of data and third parties
4.1 Web3Forms
The website's feedback form uses the Web3Forms service to forward email. Submitting the form transfers the entered data to Web3Forms' servers for processing. Web3Forms acts as a data processor (GDPR Art. 28) in this processing.
Web3Forms' servers are located within the EU/EEA and the service is GDPR-compliant. Data sent through the form is used only to forward the message to the data controller and is not used for other purposes. Feedback can also be sent directly to info@taskutalkkari.fi.
4.2 Interfaces the app uses and other third parties
The optional app features described in section 3.4 send limited data (home address, postcode or coordinates) directly from the user's device to third parties' open interfaces for geocoding and for fetching weather and building data. This data is not sent to the data controller. Otherwise, personal data is not disclosed for marketing purposes, sold or rented to third parties. Data may be disclosed to authorities where Finnish law or an EU regulation requires it.
4.3 Sub-processors for the account and PilviTalkkari
To provide the account, AI reading and PilviTalkkari, the data controller uses the following data processors (GDPR Art. 28). Each processes data only on the data controller's behalf and in accordance with its instructions. The user's core data (account, synced data, files) and AI reading are processed within the EU/EEA. Some support services (email, subscriptions, push) process limited data in the United States; these transfers rely on the EU–US Data Privacy Framework (DPF) and the EU's Standard Contractual Clauses (SCC), and a data processing agreement (DPA) is in place with each processor.
| Processor | Role | Location |
|---|---|---|
| Hetzner | Hosting the application server | Finland (Tuusula) |
| Neon | Database (synced data, account) | Germany (EU) |
| Scaleway | Storage of files (images/PDFs) | France (EU) |
| Google Cloud (Vertex AI) | AI-based document reading | Belgium (EU); company based in the US (DPA + SCC) |
| Sentry | Server-side error and stability monitoring (identifying data filtered) | EU (Frankfurt); company based in the US (DPA + SCC) |
| Resend | System emails (e.g. confirmation and password-reset messages) | United States (DPF + SCC) |
| RevenueCat | Subscription management | United States (DPF + SCC) |
| Expo | Delivering push notifications (push identifiers; message content is not retained) | United States (DPF + SCC) |
5. Information security
The data controller implements appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure or destruction. Feedback messages are delivered over an encrypted connection (TLS) and stored in a secured email service.
The mobile app's local data is protected by the app-level isolation the operating system provides (iOS App Sandbox, Android's application sandbox). In free, device-based use, the data controller has no access to the data held on the device.
For the account and PilviTalkkari, data is transferred over an encrypted connection (TLS), and the user's core data is retained within the EU/EEA. Access to the server systems is restricted, and identifying information has been filtered out of the logs.
6. The data subject's rights (GDPR Articles 15–22)
The data subject has the following rights over all personal data the data controller processes — data submitted through the feedback form, account-related data, and data and files synced to PilviTalkkari:
- Right of access (Art. 15): You can request confirmation of whether personal data about you is being processed, and a copy of that data.
- Right to rectification (Art. 16): You can request that inaccurate or incomplete data be corrected.
- Right to erasure (Art. 17): You can request that your data be deleted (the "right to be forgotten") once there is no longer a basis for processing it.
- Right to restriction of processing (Art. 18): You can request that processing be restricted in certain situations, for example while the accuracy of the data is disputed.
- Right to data portability (Art. 20): You can request the data you have provided, in a structured, commonly used format.
- Right to object (Art. 21): You can object to the processing of your personal data where the processing relies on legitimate interest. Processing does not continue unless there are compelling grounds to do so.
- Automated decision-making (Art. 22): The service makes no automated decisions about you and carries out no profiling. AI reading extracts data from a document, which you review and approve before it is saved.
Requests are answered without undue delay and within one month at the latest. Contact: info@taskutalkkari.fi.
Deleting the account and data: step-by-step instructions are on the page Deleting the account and data.
In free use, the data stored in the app resides exclusively on the user's own device, so the user has full control over it. It can be edited and deleted directly in the app. Uninstalling the app from the device deletes all data stored there.
If the user has created an account, they can delete their account directly in the app, which also deletes the data and files synced to the server. Files archived in the Vault are deleted through a separate procedure within 30 days, because the archive lock prevents their immediate deletion. Requests concerning data stored in the cloud (including access and portability) can also be sent by email to info@taskutalkkari.fi.
7. Right to lodge a complaint with a supervisory authority
The data subject has the right to lodge a complaint with the competent data protection authority if they consider that the processing of personal data infringes applicable data protection law. The competent authority in Finland is:
Office of the Data Protection Ombudsman
Lintulahdenkuja 4, 00530 Helsinki
Telephone: 029 566 6700
tietosuoja.fi
8. Minors
TaskuTalkkari is not directed at people under 16. Personal data of people under 16 is not knowingly collected. Anyone who becomes aware that a child has submitted personal data should contact the email address above so that the data can be deleted.
9. Changes to this privacy policy
The right to update this privacy policy is reserved. Material changes are announced on the website and/or with app updates. The effective date of an updated notice is stated in this document. Reviewing the notice periodically is recommended.
Last updated: 6 September 2026