Privacy policy
Haimoo Analytics privacy policy
This policy covers Haimoo Analytics user accounts, sign-in, contacts and service administration. For these, Haimoo Company Oy is the controller.
Controller
Haimoo Company Oy is responsible for account data.
The controller is Haimoo Company Oy, Business ID 3639335-2, Haimoontie 248, 03400 Vihti, Finland. Privacy requests: hello@haimoo.fi.
For analytics collected about visitors to a customer's website, the customer is the controller. Haimoo processes that data on the customer's behalf under the data processing agreement (DPA). If you visited a website and want to exercise your privacy rights, contact the owner of that website.
Data and legal bases
We process only the data needed to provide the service.
User account: email, name, language, a password stored as a bcrypt hash and email verification. If you sign in with Google, we receive your email and name from Google. The purpose is providing the service and sign-in. The legal basis is the contract.
Company and billing data: company name, Business ID, address, phone, billing email and trial and subscription status. The purpose is the customer relationship and billing. The legal basis is the contract, and keeping billing records is a legal obligation.
Business-representative confirmation: the version and time of the confirmation. It ensures the service is used by businesses. The legal basis is pre-contractual steps.
Service use and messages: added websites, goals, saved views, submitted feedback, and verification, password and trial reminder emails. The legal basis is the contract.
Search Console: if you connect Google Search Console, we store your Google account's email address and an encrypted access token and fetch your site's search statistics from Google as Google aggregates them (clicks, impressions, positions, search queries and page addresses). The statistics are kept for 16 months and deleted when you disconnect. Search queries and page addresses may in rare cases contain what visitors typed. The legal basis is the contract.
Security: sign-in and administration events and the server access log (IP address, time and requested address). The purpose is security and preventing misuse. The legal basis is legitimate interest.
Cookies
The service uses only necessary cookies.
The signed-in service uses sign-in session cookies and the cookies ha_site (selected website) and ha_tz (browser time zone for charts). No advertising or tracking cookies are used. The public website loads no third-party scripts.
Recipients and retention
The server and database are in Finland.
The providers named in the subprocessor list process data on Haimoo's behalf: Hetzner (servers), Sender (service emails), Google (Google sign-in only) and Stripe (payments, once paid plans are enabled). Data is not sold or shared for marketing. The server and database are in Hetzner's Helsinki data centre. Google and Stripe may also process data outside the EU and use the EU standard contractual clauses and the EU-US Data Privacy Framework for transfers.
User and billing data is kept while the service is in use and afterwards for the statutory accounting and claims periods. Account deletion and data restoration are done by hand on request. Server access logs are kept for 14 days, Stripe payment event contents are cleared after 90 days, and daily encrypted backups are kept for at most 14 days.
Your rights
You can request access to, correction or deletion of your data.
You can request access to your data and its rectification, erasure, restriction and portability. You can also object to processing based on legitimate interest. Send requests to hello@haimoo.fi. You can lodge a complaint with the Office of the Data Protection Ombudsman in Finland (tietosuoja.fi).
The trial ends automatically after 14 days under the terms. This is not a decision based on profiling within the meaning of Article 22 GDPR. This policy is updated on this page, which shows the date of the latest change.