Privacy notice

1. Controller and contact

The controller of the PAKKA service is Kasviholding Oy, Finnish Business ID 3621222-4. Postal address: c/o Anniina Jääskeläinen, Sippulantie 4 A 18, 40520 Jyväskylä, Finland.

Privacy, data-subject, and support requests may be sent to support@gunvald.fi. We may reasonably verify the requester's identity before disclosing or deleting personal data.

2. Personal data processed

• Clerk user ID, name, email, authentication and session data, and tenant or organization memberships.
• WhatsApp phone number, messages, technical message identifiers, delivery status, and linking data.
• Language, card collection, deckbuilding requests, decks, revisions, validation results, and feedback.
• Technical logs, IP address where necessary, device and browser data, audit events, and error and performance data.
• Support messages and, if donations are enabled later, provider transaction references; PAKKA does not store full payment-card numbers.

3. Sources

Data comes from the user, a tenant administrator, Clerk, Twilio and Meta, integrations selected by the user, and the service's own security, logging, and audit systems. RingsDB data is processed only under an approved integration model and at the user's request.

4. Purposes and legal bases

• Contract and pre-contract steps: user account, tenant, deckbuilding, WhatsApp service, storage, export, and support.
• Legitimate interests: security, abuse prevention, audit, troubleshooting, and necessary service improvement, balanced against user rights.
• Consent: non-essential analytics, marketing messages, and other separately voluntary functions. Consent can be withdrawn as easily as it is given.
• Legal obligation: accounting, taxation, authority requests, and other applicable duties if paid functions are enabled.

5. Recipients, providers, and transfers

The service may use Clerk for authentication, Twilio and Meta for WhatsApp, OpenAI for user-requested generation, PostHog and Google Analytics for consent-based analytics, Sentry for error monitoring, and managed hosting, database, and backup environments. The production notice will list only services actually enabled.

Data is not sold. Providers receive only data necessary for the purpose. Transfers outside the EU/EEA will be mapped before production and protected by an applicable mechanism such as the European Commission's Standard Contractual Clauses.

6. Retention

• Raw WhatsApp message and webhook content: target maximum of 7 days after job completion.
• Safe message and job metadata: target of 90 days.
• Decks and revisions: until deleted by the user or the tenant is closed.
• Application access logs: target of 30 days; audit logs: target of 12 months.
• Backups: for the approved rotation period, after which deletions are overwritten.
• Records required by law: for the applicable statutory period.

7. Your rights

Where applicable, you have rights of access, correction, deletion, restriction, objection, portability of data you supplied, and withdrawal of consent. You may lodge a complaint with the competent supervisory authority; in Finland this is the Office of the Data Protection Ombudsman.

Send requests to support@gunvald.fi. We respond without undue delay and generally within one month.

8. Automation, security, and children

PAKKA uses automation to suggest decks and check rules. It does not make decisions about a person that produce legal or similarly significant effects.

Data is protected through tenant isolation, least privilege, encryption, signed webhooks, audit controls, backups, and monitoring. PAKKA is not marketed to children before a separate age and consent model is approved.