Privacy notice
This explains what the site collects, why, where it is kept and for how long. There are no advertising cookies and no tracking that identifies visitors.
Controller
Joel Matikainen, sole trader. Business ID: 3550308-9.
Privacy matters: joel.matikainenmusic@gmail.com
What is collected
From a booking: name, email address, the time booked and whether the lesson is on-site or online.
From a gift certificate: the recipient’s name and a greeting, if the buyer writes them. They pass through Stripe and are printed on the gift certificate.
From a quote request: name, email address, a date if you give one, and whatever you write in the message field.
From a payment: Stripe handles the payment and the card details. The site receives no card data.
From a bug report: the description you write, the page address, the name of your browser and operating system, the window size and your email address.
From loading a page: Vercel, which runs the site, technically processes your IP address, and server logs are kept for about 12 hours.
The site collects no location and no browsing history.
Why, and on what basis
Booking details are processed to perform the contract. Without them a lesson cannot be booked.
A quote request is handled to take steps at your request before a contract.
Accounting records are kept because the law requires it.
Bug reports, analytics and server logs rest on legitimate interest: keeping the site working and secure.
Where the data is
The database runs on Supabase and the site on Vercel, both in Stockholm.
Email goes out through Resend, which keeps messages in the United States for 30 days.
Payments are handled by Stripe.
Finished recordings are delivered through Google Drive to the email address you give.
Notifications of bookings and enquiries reach my Gmail inbox.
Resend, Stripe and Google also process data outside the EU under safeguards approved by the Commission.
For how long
Accounting records are kept six years from the end of the financial year.
Details of an abandoned payment are deleted after 30 days.
Quote requests are deleted after 12 months, or sooner on request.
A cancelled booking stays in the accounts.
Notifications that reach my email are kept as part of customer correspondence. I delete them on request unless the accounts require them to be kept.
Cookies
The site sets one cookie: your language choice.
Signing in to the admin area sets a session cookie, which applies to me only.
Vercel Web Analytics counts page views without cookies and does not identify visitors.
There are no advertising or tracking cookies, so no consent is asked.
Your rights
You have the right to see what is stored about you, to have incorrect information corrected and to ask for your data to be deleted.
You can also ask for processing to be restricted, object to processing based on legitimate interest, and receive the details you gave in a machine-readable form.
Deletion does not cover accounting records that the law requires to be kept.
An email is enough. I answer within a month.
If you are not satisfied, you can complain to the Finnish Data Protection Ombudsman (tietosuoja.fi).
Security
Traffic to the site is encrypted, and the database can only be reached through the server.
No automated decision-making and no profiling take place.