Privacy notice

Version 1.1 · in force from 21 September 2026. What we store about you, why, and for how long.

Controller

Sanni Pauliina Härkönen, a sole trader established in Finland, Business ID 3518859-2, Heikinpohjantie 23 as. 4, 57100 Savonlinna, Finland. Contact for all privacy matters: support@getsigila.com or the support form. We have not appointed a data protection officer.

A note on legal bases

Where this notice says "contract", it means the situation where you yourself are our customer, for example as a sole trader. When the customer is your organisation and you are its contact person, the basis is our legitimate interest in performing the agreement with your organisation (GDPR art. 6(1)(f)).

What we process and why

• Web addresses you scan and the scan results (screenshots of the public pages, failing elements' HTML, technical details of the page load). Purpose: providing the service. Legal basis: contract, or for free scans our legitimate interest in offering a trial. Personal data of other people that happens to be visible on a scanned page is covered under "Scanned sites" below.
• Your email address and account: your email address, the name of your organisation and its VAT number if you give one, the version of the terms you accepted and when, Stripe customer and subscription identifiers, and sign-in tokens (stored only as hashes). Purpose: your account, sign-in links, weekly reports, invoices. Legal basis: contract; for invoices and bookkeeping, our legal obligation under the Accounting Act.
• Payment details are handled by Stripe; we never see your full card number. Stripe acts partly as our processor and partly as an independent controller, for example for fraud prevention and its own legal obligations (stripe.com/privacy).
• Server logs with IP addresses, requested pages, time and response code, kept for 30 days for security and troubleshooting. Legal basis: our legitimate interest in keeping the service secure.
• Visitor statistics. When you open a page on getsigila.com we record the date, the page, the site that linked to it (its domain only), campaign tags in the link (utm_source, utm_campaign, utm_content), and whether you use a computer, phone or tablet. We set no cookie. To count daily visitors, your IP address and browser identifier are used once, at the moment of your visit, to compute a code with a key that is replaced every day and then deleted; the address itself is not stored, and once the key is deleted the code can no longer be linked to you or to your visits on other days. Purpose: knowing which channels bring visitors. Legal basis: legitimate interest.
• Campaign tags in the link you arrived through are stored with your free scan and, if you subscribe, with your subscription, so we can see which campaigns lead to subscriptions. Legal basis: legitimate interest.
• The email address you enter to have a free result sent to you: we send one email with the link to that result. We store a one-way code computed from the address with a secret key, solely to prevent repeated sends; the code is deleted with the result after 30 days, and we do not use it to recover or look up your address. No list, no further email. Legal basis: carrying out your request (GDPR art. 6(1)(b)); for the code, our legitimate interest in preventing misuse.
• Messages you send through the support form: your email address, the message and, if you give it, the page or result it concerns. They are emailed to our support mailbox and kept there for 12 months after the matter is closed, then deleted; messages about billing are kept with the bookkeeping where the law requires it. Legal basis: contract, when you write about your subscription; otherwise our legitimate interest in answering people who contact us.

Processors, other recipients and transfers

Hosting and backups: UpCloud (Finland). Payments: Stripe (Ireland; group companies in the USA). Email delivery: Resend (USA). Domain name service and forwarding of email sent to our support and reports addresses: Cloudflare (USA). Support mailbox: Help Scout (USA). Bookkeeping: UKKO Yrittäjyyspalvelut Oy, UKKO.fi (Finland). We disclose data to authorities only where the law requires it, for example to the Tax Administration.

Transfers outside the EU/EEA rely on the European Commission's adequacy decision for the EU–US Data Privacy Framework where the provider is certified under it, and otherwise on the EU standard contractual clauses in the provider's data processing agreement; you can ask us for a copy of the safeguard.

Visitor statistics and campaign tags stay on our own server. We do not sell or share your data for advertising, and we use no advertising pixels. If the Sigila business is transferred to a company that continues it, customer data moves to that company, and we tell customers beforehand.

Cookies

Sigila sets one cookie, sigila_session, only after you sign in, to keep you signed in for 30 days. It is necessary for signing in, so no consent is asked. No analytics or advertising cookies; visitor statistics store nothing in your browser.

Retention

Free scan results, and the code of an address a result was emailed to: 30 days. Server logs: 30 days. Our own research scans of public sites: the findings for 24 months, screenshots only from the latest scan of each site. Subscription data and reports: while the subscription is active and 90 days after it ends, after which they are deleted. Support messages: 12 months after the matter is closed. Invoices and other bookkeeping material: six years from the end of the year in which the financial year ended (Accounting Act). Visitor statistics: 24 months.

Your rights

You can ask to see, correct or delete your data, to restrict its processing, and to receive the data you gave us in a machine-readable form, through the support form or by writing to support@getsigila.com. We answer within one month.

Right to object: where we rely on legitimate interest (server logs, visitor statistics, campaign tags, free scans, contact persons, support messages, scanned sites and research scans) you can object at any time on grounds relating to your situation. We then stop, unless we have compelling grounds to continue.

You need to give an email address to subscribe or to have a result emailed to you; without it we cannot provide those. We make no automated decisions with legal or similarly significant effects on you, and we do no profiling.

You can complain to the Finnish Data Protection Ombudsman (tietosuoja.fi) or to the data protection authority of your own EU country.

Scanned sites

Scans load public pages only, the way a browser does; nothing is submitted or signed in to, and no visitor data of the scanned site is collected. Scans come from the address 94.237.112.217; see about the scanner. Scanned pages are processed only to produce the report and for nothing else; screenshots are not published or reused.

A screenshot or a piece of HTML can include personal data that the site itself has published, such as names or staff photos. We process it only as part of the page, to show where an accessibility failure is; we never search for, index or identify people from it. Legal basis: our and our customer's legitimate interest in checking the accessibility of a public page (GDPR art. 6(1)(f)). Source: the public page. Retention: free scans 30 days, subscribers' scans for the subscription and 90 days after it, research scans as described under Retention. Access: we, and whoever holds the private link to the result. If you appear on a scanned page, you have the rights described above; write to us.

Site owners who do not want their site scanned can say so through the support form (topic "Do not scan my site") from an address at the site's own domain; we then block the site and its subdomains from all scans.

We also run research scans of public sites on our own initiative, for example the front pages of Finnish municipalities, and publish aggregated statistics from them. Research scans respect robots.txt. We never publish a named site's results without its owner's permission.

Changes to this notice

We update this notice when our processing changes. The version and date at the top show the current version, and we tell subscribers by email about material changes.