Privacy Policy
1. Data Controller
The data controller for peluka.info is:
2. What Data We Collect
We collect and process the following personal data:
2.1 Account Data (when you register via FusionAuth)
- Email address
- Display name
- User identifier (UUID)
2.2 Technical Data (automatically collected)
- Session cookies (strictly necessary for the service to function)
- IP address (in server access logs, retained for security purposes)
2.3 Service-Specific Data
- API keys and usage data (for API subscribers)
- Subscription tier information
3. Legal Basis for Processing (GDPR Art. 6)
We process your data based on:
- Contract performance (Art. 6(1)(b)) - To provide the services you have requested, including account management and API access.
- Legitimate interest (Art. 6(1)(f)) - For security, fraud prevention, and service improvement. Server logs containing IP addresses are retained for up to 30 days for security monitoring.
4. Cookies
We use only strictly necessary session cookies (JSESSIONID) required for the service to function. These cookies:
- Are deleted when you close your browser or log out
- Do not track you across websites
- Do not contain personal information
- Cannot be disabled as they are essential for the service
We do not use analytics cookies, advertising cookies, or any third-party tracking.
5. Data Storage and Security
- Location: All data is stored on a dedicated server hosted by Hetzner Online GmbH in the European Union (Finland/Germany).
- Encryption: All connections are encrypted via TLS/HTTPS.
- Access: Data access is restricted to the data controller only.
- Authentication: User authentication is handled by FusionAuth, hosted on the same infrastructure.
6. Data Sharing
We do not sell, share, or transfer your personal data to third parties, except:
- Hetzner Online GmbH - Infrastructure provider (data processor, subject to their DPA and GDPR compliance).
- Legal obligations - If required by law or court order.
7. Data Retention
- Account data: Retained as long as your account is active. Deleted upon account deletion request.
- Server logs: Retained for up to 30 days, then automatically deleted.
- API usage data: Retained for the duration of your subscription.
8. Your Rights (GDPR Art. 15-22)
Under the GDPR, you have the right to:
- Access - Request a copy of the personal data we hold about you.
- Rectification - Request correction of inaccurate data.
- Erasure - Request deletion of your personal data ("right to be forgotten").
- Restriction - Request restriction of processing of your data.
- Portability - Request your data in a structured, machine-readable format.
- Objection - Object to processing based on legitimate interest.
To exercise any of these rights, contactjose.perez@peluka.info. We will respond within 30 days.
9. Supervisory Authority
If you believe your data protection rights have been violated, you have the right to lodge a complaint with a supervisory authority. The relevant authority for Finland is:
- Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto)
- Website:tietosuoja.fi/en
10. Changes to This Policy
We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated date. We encourage you to review this policy periodically.
Last updated: October 2026