Skip to content
Pauhu

Privacy Policy

Last updated: October 18, 2026

Privacy Policy

Last updated: October 18, 2026

1. Data Controller

Pauhu Ltd (Y-tunnus: 0768171-8, "we", "us") is the data controller for personal data processed through pauhu.eu and the Pauhu European Language Data Space.

Contact: WhatsApp

Data Protection Officer: WhatsApp

2. Data We Collect

Category Data Purpose
Account Email, name, company Service delivery
Payment Company name, billing address, VAT or business ID (collected by Stripe on its hosted payment page) Payment, receipts and invoicing
Usage API calls, data feed access Billing, service improvement
Technical IP address, browser Security

Publicly available sources (GDPR Art. 14): Pauhu processes information that public authorities, open-data publishers and other public sources have made publicly available. Where such information incidentally contains personal data (for example names in published court decisions or in public-interest publications), it is processed under legitimate interest (GDPR Art. 6(1)(f)) and in accordance with the publishing source's terms. The Art. 14(5)(b) exemption applies as individual notice would involve disproportionate effort. Content from time-sensitive public sources is retained for no longer than 90 days. You may exercise your rights (including erasure) by contacting WhatsApp.

3. Legal Basis (GDPR Art. 6)

  • Contract: Processing necessary for service delivery
  • Legal obligation: Tax and accounting requirements
  • Legitimate interest: Security and fraud prevention
  • Consent: Analytics cookies (Section 8)

4. Data Retention

  • Account data: Duration of account + 2 years
  • Payment records: 7 years (Finnish accounting law)
  • Usage logs: 90 days

5. Data Sharing

We share data only with the following processors and sub-processors:

5.1 Infrastructure (EU)

  • European infrastructure provider - Dedicated server infrastructure (compute, databases, object storage). Server location: EU/EEA. EU jurisdiction. DPA in place. Full subprocessor details available on request.

5.2 Authentication (third-country transfers - Art. 13(1)(f))

When you choose to sign in with a third-party identity provider, authentication tokens are exchanged with that provider. We receive only your name, email, and profile photo - no passwords are transmitted to or stored by Pauhu.

  • Google LLC - Google OAuth 2.0 (accounts.google.com). US. Transfer safeguard: EU Standard Contractual Clauses (Commission Decision 2021/914, Module 3).
  • GitHub, Inc. (Microsoft subsidiary) - GitHub OAuth (github.com). US. Transfer safeguard: EU SCCs Module 3.
  • Microsoft Corporation - Microsoft OAuth / MS Graph (login.microsoftonline.com, graph.microsoft.com). US. Transfer safeguard: Microsoft DPA with EU SCCs.
  • Apple Inc. - Sign in with Apple (appleid.apple.com). US. Transfer safeguard: Apple DPA with EU SCCs Module 3.

You are never required to use a third-party identity provider. Email/password authentication processes data entirely within the EU.

5.3 Email (EU)

  • Mailtrap SIA (MailerSend) - Transactional email delivery. Riga, Latvia. EU jurisdiction. No third-country transfer.

5.4 Payment

  • Stripe - hosted checkout. Stripe collects payment details, company name, billing address and VAT or business ID on its own payment page and processes them under its own privacy terms, which describe its international transfers. Pauhu receives payment and receipt events, never card details, query text, search results or document content.

5.5 Analytics

  • Google Ireland Limited - Google Analytics 4, site usage measurement with consent (Section 8). Possible transfer to Google LLC, US, under the EU-US Data Privacy Framework and Standard Contractual Clauses.

All processors are bound by data processing agreements (Art. 28 GDPR), except Stripe, which processes payment data under its own terms (Section 5.4).

6. Data Location

Our primary infrastructure (databases, object storage, compute, models) is located exclusively within the European Union (EU data centers). Your queries, documents, and search results are processed entirely within the EU and never leave EU jurisdiction.

Third-country transfers are limited to the authentication tokens exchanged with third-party OAuth providers (Section 5.2), where EU Standard Contractual Clauses apply, the payment data Stripe handles under its own terms (Section 5.4), and site analytics measured by Google (Section 5.5). You can avoid the OAuth transfers by using email/password authentication.

7. Your Rights (GDPR)

  • Access your personal data
  • Rectify inaccurate data
  • Erase data ("right to be forgotten")
  • Port data to another service
  • Object to processing
  • Lodge complaint with supervisory authority

To exercise these rights, contact WhatsApp.

8. Cookies & Tracking

We store your theme and text size preferences, and your analytics choice, in your browser's localStorage, which never leaves your device. Analytics cookies are set only with your consent; we use no advertising cookies.

Analytics: We use Google Analytics 4, provided by Google Ireland Limited as our processor, to measure how this site is used. Our own tag sends the page viewed, scroll depth, time on page and the hour of the visit, and for clicks, form submissions and sections viewed a label taken only from the element's own data-action, id, name or data-section attribute (a section without one is labelled by its element type). A label value that looks like an email address, a token or a long id is dropped, not sent. Addresses of pages, links and the page you came from are sent without query strings or fragments; on our own sites a page that is not on the site's list of published pages is recorded as /:other, other sites are sent as their origin only, and email and phone links as their scheme only. These limits apply to our tag's own events, not to what Google's tag collects by itself: Google Analytics also records approximate location (city level) and device type and details, and Google's enhanced measurement is switched on for this site, which records scrolls, outbound clicks (clicks on links to other sites, with the link address and link text), site search (search words carried in a page address, for example ?q=), embedded video engagement, file downloads (with the link address and link text) and form interactions (form starts and submissions, with the form name and destination). Google's user-provided data collection is also switched on: where Google's tag detects an email address or phone number on a page, it may collect it in hashed form. Email addresses detected in collected data are redacted before they are sent. Analytics cookies are set only after you choose Accept in the banner; before you accept, or if you decline, no analytics cookies are stored on your device, but Google may still receive cookieless measurement pings. Your network address reaches Google when your browser loads the analytics script; Google Analytics 4 does not log or store IP addresses. Google signals, ad personalisation and Google data sharing are switched off, there are no advertising cookies and no ads, and analytics data is kept for 14 months. Google may process this data in the United States under the EU-US Data Privacy Framework and Standard Contractual Clauses. Change your analytics choice.

For API and MCP calls we record token usage only: for each call, the tool, the token counts and the time. Apart from that, our websites and MCP endpoint keep a standard access log of the requested path, the time and the response status; since 18 October 2026 it holds no IP address, port, request header or query string. The free daily allowance is counted in memory per network address, cleared every day and never written to disk.

9. Regulatory Evaluation

Pauhu is currently under evaluation by the Finnish Transport and Communications Agency (Traficom) as part of the national AI solutions assessment programme under the Alt-EDIC (Alternative European Digital Infrastructure Consortium) initiative. This evaluation covers:

  • Data sovereignty and EU jurisdiction compliance
  • NIS2 Directive (EU) 2022/2555 conformance
  • Browser-native data retrieval and privacy implications
  • Suitability for public sector deployment across Finnish government organisations

During this evaluation, Traficom personnel may access Pauhu’s staging environment for testing purposes. No personal data from Traficom evaluators is retained beyond the evaluation period. Contact: kyberturvallisuus@traficom.fi

10. Supervisory Authority

Finnish Data Protection Ombudsman
tietosuoja.fi
tietosuoja@om.fi

Pauhu Ltd
Helsinki, Finland
EU jurisdiction