Get started

Privacy policy

Updated 15 October 2026

This policy explains which personal data Houstie processes, why and for how long. The current version is always on this page, and the date of the last change is shown above.

1. Controller and contact

Kaupunkilounaat Oy (Houstie), business ID 3273666-1. Privacy matters: hello@houstie.fi.

This policy covers Houstie’s own operations: the houstie.fi website, customer relationships, the Houstie admin (admin.houstie.fi) and sales. On our customers’ websites (for example their contact forms) the site’s owner is the controller, and Houstie processes the data on its behalf. That is described in each site’s own privacy policy.

2. What data we process and where it comes from

Customers and their users. The order details (name of the company or association, business ID, contact person, e-⁠mail, phone number, billing details, the chosen plan and the wished-for domain). For admin users: name, e-⁠mail address, role (owner, publisher or editor) and sign-in times. Signing in uses a one-time code sent by e-⁠mail; we store no passwords.

Chat messages and images. Messages in which the customer asks for changes to their site, and the images attached to them. Location data and other metadata are removed from images before publishing.

Support requests. The messages, attachments and working time of support requests.

Orders and enquiries on houstie.fi. The order form, the contact-details form (lead) and the answers to its follow-up questions, messages sent with the contact form, and call bookings (name, phone number, optionally the name of the company or association and an e-⁠mail address, the booked time).

Sales (prospecting). We contact companies and associations that could benefit from our websites. We collect the organisation’s name, business ID, industry, address, website and public contact details from public sources: the Finnish Business Information System (YTJ), the organisation’s own website and public directories. We make an automatic assessment of the organisation’s website (for example speed and mobile usability). We record contacts (call, e-⁠mail, text message) and their outcome. The personal data here are contact persons’ names and work contact details.

Do-not-contact list. If you forbid contacts (houstie.fi/en/unsubscribe or by asking us), we record the ban permanently so that we do not contact you again. Only what is needed to honour the ban is kept.

Technical data. Server logs (IP address, time, request). If you accept analytics, houstie.fi measures visits with Google Analytics (section 6); otherwise visits are only counted from the server logs.

  • Performing and preparing a contract: handling the order, building and maintaining the site, admin users, chat changes, support requests and invoicing.
  • Legal obligation: accounting and tax records.
  • Legitimate interest: answering enquiries and bookings, the security of the service and preventing misuse, and direct marketing to companies and associations. We have weighed our interest against your rights: we only contact people in their work role, based on public information, and every message says how to forbid further contacts.
  • Consent: Google Analytics on houstie.fi (section 6), and other processing only where it is asked for explicitly.

Data is not sold and not disclosed to third parties for marketing. Data is not used to train language models.

4. How long data is kept

  • Customer data for the duration of the contract and after it for as long as settling claims requires. Invoicing and accounting records as the Accounting Act requires (usually 6–10 years).
  • Chat conversations are deleted 30 days after the last message; a conversation that led to a publish after 90 days. Published versions of the site are kept for restoring during the contract.
  • Support requests for the duration of the contract.
  • Contact form messages 180 days. Call bookings – cancelled ones too – 90 days after the booked time.
  • Leads (contact-details form) that did not become customers at most 24 months after the last contact. The follow-up questions link is valid for 90 days.
  • Sales data while the sale is in progress and at most 24 months after the last contact; the do-not-contact list permanently.
  • Server logs 14–30 days.
  • Google Analytics event data 14 months; the cookies are described in section 6.

5. Who processes data on our behalf

We use the following service providers, which process data only on our behalf:

  • Amazon Web Services EMEA SARL: servers, databases, files and e-⁠mail delivery (Amazon SES) in AWS’s Frankfurt region (eu-⁠central-⁠1), and language models (Amazon Bedrock) run in data centres within the EU.
  • Visma Netvisor: invoicing and accounting.
  • Google Ireland Limited: Google Analytics on houstie.fi, only with your consent (section 6).
  • Domain registration: new domains we register for customers are registered in the name of Houstie (Kaupunkilounaat Oy), so the registry (for example Traficom for .fi domains) receives Houstie’s details, not the customer’s.

Data is not transferred outside the European Economic Area, except for Google Analytics if you have accepted it (section 6). Some technical services (for example the certificates of the content delivery network) are managed in AWS’s global services, but the databases and files containing personal data are in the EU.

6. Cookies and analytics on houstie.fi

houstie.fi measures visitor numbers and how its pages are used with Google Analytics 4, but only if you have accepted it. Nothing is loaded from Google’s services before you accept.

The service is provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). Google Analytics stores the cookies _ga (kept for 2 years) and _ga_<id> (kept for 2 years) in your browser to tell visitors and visits apart. Google Analytics 4 does not store IP addresses. Google signals and ad personalisation are switched off, and the data is not used for advertising. Google may also process data outside the European Economic Area, for example in the United States; such transfers rely on the EU-U.S. Data Privacy Framework and the European Commission’s standard contractual clauses.

The legal basis for the processing is your consent. Your choice is stored in your browser’s local storage (localStorage, key houstie-consent) for 12 months, after which we ask again. You can change or withdraw your consent at any time with the Cookie settings link at the bottom of the page. Withdrawing your consent deletes the Google Analytics cookies.

7. Your rights

You have the right to

  • know what data we hold about you and get a copy of it,
  • have incorrect data corrected,
  • have your data erased when there is no longer a basis for processing it,
  • restrict processing and object to processing based on legitimate interest – you can object to direct marketing at any time, and it stops at once,
  • move data you have given us yourself to another service, when the processing is based on a contract or consent.

Send your request to hello@houstie.fi. We reply within one month. If you think your data is processed unlawfully, you can lodge a complaint with the Data Protection Ombudsman (tietosuoja.fi).