Privacy Policy

1. Data Controller

The data controller responsible for your personal data is: Lokakuu Studio Oy · Hurjat.com Email: info@hunajata.com

2. Personal Data We Collect

We collect the following categories of personal data:

• Account data: name, email address, and hashed password when you create an account.
• Usage data: pages visited, features used, timestamps, and device/browser information.
• Sensor data: IoT sensor readings (temperature, humidity, weight, sound) linked to your hives.
• Apiary data: apiary locations (GPS coordinates), hive information, inspection records, treatment logs, feeding records, and harvest data.
• Payment data: when you subscribe to a paid plan, payment is processed by Stripe. We store only your subscription status and Stripe customer ID — we never store credit card numbers.
• Social login data: if you sign in with Google, we receive your name, email, and profile picture from Google. We do not access your Google contacts or other data.

3. Legal Basis for Processing

We process your personal data based on:

• Contract performance: processing necessary to provide our service to you (Article 6(1)(b) GDPR).
• Consent: when you opt in to marketing communications or optional analytics (Article 6(1)(a) GDPR).
• Legitimate interests: improving our service, preventing fraud, and ensuring security (Article 6(1)(f) GDPR).
• Legal obligation: when required by law, e.g., tax and accounting requirements (Article 6(1)(c) GDPR).

4. How We Use Your Data

We use your personal data to:

• Provide and maintain the Hunajata.com service.
• Authenticate your identity and manage your account.
• Process and display IoT sensor data from your hives.
• Generate analytics and insights about your beekeeping operation.
• Send alerts and notifications about your hives.
• Improve and develop our service.
• Respond to support requests.
• Process payments and manage subscriptions.

5. Data Sharing and Transfers

We do not sell your personal data. We may share data with:

• Infrastructure providers: Hetzner (servers in the EU), for hosting our service.
• Payment processor: Stripe, for processing payments (Stripe's privacy policy applies).
• Authentication provider: Google Firebase, when you use Google Sign-In.
• Error monitoring: Sentry, for application error tracking.
• Law enforcement: when required by applicable law or legal process.

All our primary infrastructure is located within the European Union (Hetzner, Germany/Finland). Where data is transferred outside the EU (e.g., Stripe, Firebase, Sentry), appropriate safeguards are in place, including Standard Contractual Clauses (SCCs).

6. Data Retention

We retain your personal data for as long as your account is active. If you delete your account, we will delete your personal data within 30 days, except where retention is required by law (e.g., invoicing records for 6 years under Finnish accounting law). Sensor data and inspection records are deleted together with your account.

7. Data Security

We implement appropriate technical and organizational measures to protect your data, including: encryption in transit (TLS), hashed passwords (bcrypt), access controls, and regular security reviews. However, no method of transmission over the Internet is 100% secure.

8. Your Rights Under GDPR

As a data subject, you have the following rights:

• Right of access: request a copy of your personal data.
• Right to rectification: correct inaccurate or incomplete data.
• Right to erasure: request deletion of your personal data ("right to be forgotten").
• Right to restriction: request limitation of data processing.
• Right to data portability: receive your data in a structured, machine-readable format.
• Right to object: object to processing based on legitimate interests.
• Right to withdraw consent: withdraw consent at any time without affecting the lawfulness of prior processing.

To exercise your rights, contact us at info@hunajata.com. We will respond within 30 days. You also have the right to lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi).

9. Cookies and Local Storage

We use essential cookies and localStorage to maintain your session and language preference. We do not use third-party advertising or tracking cookies. If we introduce optional analytics cookies in the future, we will request your consent.

10. Children's Privacy

Our service is not directed at children under 16 years of age. We do not knowingly collect personal data from children under 16. If you believe a child under 16 has provided us with personal data, please contact us.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes via email. The date at the top of this page indicates when this policy was last updated.

12. Contact Us

For questions about this Privacy Policy or your personal data, contact us at: Lokakuu Studio Oy · Hurjat.com Email: info@hunajata.com