Privacy Policy

Kotireitti.fi is committed to protecting your privacy. This Privacy Policy explains what data we collect, how we use it, and what rights you have.

Data Controller

The data controller is kotireitti.fi. You can contact us regarding privacy matters by email at tuki@kotireitti.fi.

Data We Process

• Technical data: IP address, browser type and version, operating system, cookies
• Usage data: pages visited, search queries, time spent on site
• Map interaction data: coordinates for isochrone queries (travel-time distance calculations)

Purposes and Legal Bases

• Service delivery and technical operation — legal basis: legitimate interest (GDPR Art. 6(1)(f))
• Personalising search results and map views — legal basis: legitimate interest (GDPR Art. 6(1)(f))
• Storing language preference in a cookie — legal basis: consent (GDPR Art. 6(1)(a))

Retention Periods

Technical log data is retained for 30 days. The language preference cookie persists in your browser until you clear it. Because the service does not require registration, we do not retain user account data. Analytics data (PostHog) is retained for 12 months.

Your Rights

• Right of access (GDPR Art. 15)
• Right to rectification (Art. 16)
• Right to erasure (Art. 17)
• Right to restriction of processing (Art. 18)
• Right to data portability (Art. 20)
• Right to object (Art. 21)

You also have the right to lodge a complaint with the Office of the Data Protection Ombudsman (tietosuoja.fi) if you believe that the processing of your data infringes your rights.

Sub-processors and Third Parties

• Vercel Inc. — service hosting (USA/EU, EU–US Data Privacy Framework)
• Supabase Inc. — database (EU region, Frankfurt)
• Geoapify GmbH — map and isochrone API (EU/Germany)
• PostHog Inc. — analytics (EU region, Frankfurt)

Cookies

We use necessary cookies (Supabase session, language preference) and optional analytics cookies (PostHog, opt-in only) and session replay (PostHog, opt-in only). Analytics data is retained for 12 months. In accordance with Finnish data protection authority guidance, strictly necessary cookies do not require separate consent.

International Data Transfers

Vercel may process technical data in the United States under the EU–US Data Privacy Framework. The Supabase database is located in the EU (Frankfurt). Geoapify operates within the EU.

Data Protection Enquiries

Send data subject rights requests to tuki@kotireitti.fi. We aim to respond within one month.