Privacy notice

Depending on your use of the service, we process:

• customer name, email and phone number;
• property, location, contents, schedule and special-request details in quote requests;
• quotes, selections, booking status, service-message delivery data and reviews;
• company identity, contact, verified email, website, review-source URLs, services, service areas, billing and profile details;
• IP address, device and browser data, authentication and security logs, cookies and session identifiers; and
• consents, accepted-term versions and timestamps, and communications.

• Managing requests, quotes, selections, accounts and service messages is based on a contract or pre-contractual steps.
• Billing, accounting and authority obligations are based on legal obligations.
• Security, fraud prevention, support, service development without optional tracking and legal claims are based on legitimate interests.
• Optional analytics and marketing email are based on consent, which can be withdrawn at any time.

We do not make solely automated personal-data decisions with legal or similarly significant effects.

Data mainly comes from customers and companies through forms and use of the service. Mapbox supplements postcode and city location data; Clerk provides company authentication and verification data; Cloudflare Access provides corresponding administration data. Technical logs and events are created during use.

Work-related request details are shown to suitable companies without the customer’s name and contact details. After selection, contact details are exchanged between customer and selected company to perform the contract. The provider is an independent controller for customer data it receives.

Data may be disclosed where required by law or in a corporate transaction with suitable safeguards. We do not sell personal data.

We use Cloudflare (hosting, database connectivity, email, Turnstile and security), Cloudflare Access (admin authentication), PlanetScale (Postgres), Clerk (company authentication), Mapbox (location search), PostHog EU (consent-based analytics and masked session replay), and Google Tag Manager (consent-loaded tag management without advertising tracking in the current implementation). They process data according to their role, contracts and privacy obligations.

Some providers operate globally. Transfers outside the EU/EEA use mechanisms permitted by data-protection law, such as adequacy decisions, standard contractual clauses and supplementary safeguards.

We retain data only as long as needed for the purposes described, contracts, complaints, claims and legal duties. The first personal request link lasts 48 hours and a verified customer session seven days. Request, quote, selection and message records are retained as needed for the customer relationship and claims; company data for the account term and necessary legal period; accounting data for the statutory period; reviews while published unless removal or anonymisation is justified; and analytics according to PostHog settings. Data is then deleted or anonymised unless a lawful basis remains.

Necessary cookies support personal customer sessions, company sign-in, security and cookie choices. With consent, PostHog and Google Tag Manager help us understand use. Session replay is off by default and may start only after a key form is started or a result/error view is opened from an email link. Form values and sensitive text are masked, and token-bearing /open/ routes are excluded.

Change your choice through Cookie settings in the footer. See the cookie notice.

Depending on the circumstances, you may access and receive a copy of your data; correct it; request deletion or restriction; object to legitimate-interest processing; receive data you provided in portable form; withdraw consent; and complain to the competent supervisory authority, in Finland the Office of the Data Protection Ombudsman.

Send requests to tuki@puhtaat.fi. We may request information needed to verify identity, and statutory limitations may apply.

We use access controls, encrypted connections, personal access links, logging and other technical and organisational safeguards, although complete security cannot be guaranteed.

We update this notice when processing or law changes. The current version and update date are published here, and material changes may also be communicated in another suitable way.