Your data, in full clarity

The controller of personal data collected on fisniku.art is:

GreenEcoGenius OÜ
Tornimäe tn 5, 10145 Tallinn, Estonia
Estonian registry code: 16917315
Legal representative: Ervis Ago, member of the management board

For any question related to data protection or to exercise your rights, please write to our dedicated contact point: info@fisniku.art.

We strictly limit collection to the data necessary for the proper operation of the service. The categories of data processed are as follows:

• Account: email address, optional display name, password stored in encrypted form (hashed and salted).
• Purchases: amount, currency, acquired format, work concerned, Stripe transaction identifier, IP address at the time of payment and inferred country for VAT calculation.
• Reading and listening: progress percentage, scroll position (reading) and time position (audio) saved in the reading_progress table so that you can resume exactly where you left off.
• Communications: messages sent through the contact form, content of your message and reply address.

No banking data is stored on our servers. All payment information is processed directly by Stripe.

The data collected is used to:

• ensure the creation, sign-in and security of your account;
• execute orders (payment, digital delivery, email confirmation, legal archiving);
• build and present your personal library, and remember your progress in each work;
• respond to your requests sent through the contact form;
• send strictly necessary transactional communications (purchase confirmation, security alert, password reset).

No data is used for advertising purposes, nor sold, nor transferred to a third party for commercial purposes.

In accordance with article 6 of the GDPR, processing is based on the following grounds:

• Performance of the contract (article 6, 1, b): account management, order processing, delivery and access to works, saving of reading progress.
• Legal obligation (article 6, 1, c): retention of accounting records and invoices for the duration prescribed by Estonian law.
• Legitimate interest (article 6, 1, f): service security, fraud prevention, internal product improvement based on anonymised logs.
• Consent (article 6, 1, a): occasional editorial newsletter, only after explicit opt-in and revocable at any time.

To operate the service we rely on the following processors. Each is bound to GreenEcoGenius OÜ by a data processing agreement compliant with article 28 of the GDPR.

• Supabase Inc. (database hosting, authentication and file storage). Data hosted in Ireland, European Union.
• Stripe Payments Europe, Limited (payment processing and VAT calculation through Stripe Tax). Data processed in Ireland, European Union.
• Resend, Inc. (delivery of transactional emails). Company established in the United States; transfer framed by the standard contractual clauses adopted by the European Commission (decision 2021/914).
• Vercel, Inc. (frontend application hosting, global distribution network). Company established in the United States; transfer framed by the standard contractual clauses adopted by the European Commission (decision 2021/914).

The retention periods applied are as follows:

• Account data: throughout the period the account is active, then three years after the last sign-in, after which the account is deleted.
• Purchase records and invoices: ten years from the end of the relevant accounting year, in accordance with the Estonian Raamatupidamise seadus (Accounting Act).
• Reading progress: as long as the work is in your library or until you request its deletion.
• Contact messages: three years after the last exchange, for evidence and follow-up purposes.

In accordance with articles 15 to 22 of the GDPR, you have the following rights over your data:

• Right of access: obtain a copy of the data concerning you.
• Right to rectification: correct any inaccurate or incomplete information.
• Right to erasure: request the deletion of your account and associated data (subject to legal retention obligations).
• Right to portability: receive your data in a structured, commonly used, machine-readable format.
• Right to object: object to processing based on legitimate interest.
• Withdrawal of consent: at any time, without affecting the lawfulness of prior processing.
• Right to lodge a complaint with a supervisory authority. As an Estonian company, we fall primarily under the Andmekaitse Inspektsioon (AKI), www.aki.ee. French residents may also seize the CNIL, www.cnil.fr.

The majority of your data is processed and hosted within the European Union (Supabase and Stripe in Ireland).

The Resend and Vercel services involve transferring some data to the United States. These transfers are framed by the standard contractual clauses adopted by the European Commission on 4 June 2021 (decision 2021/914), which provide an adequate level of protection in line with the requirements of the GDPR.

We implement the following technical and organisational measures:

• systematic encryption of communications via TLS 1.3 between your browser and our servers;
• encryption at rest of Supabase databases and storage files;
• passwords stored exclusively in hashed and salted form (bcrypt algorithm);
• row level security applied to all sensitive tables, guaranteeing that a user can only read or modify their own data;
• two factor authentication (TOTP) available on every account, activatable from your preferences;
• automatic password verification against the HaveIBeenPwned database at sign-up and at change, rejecting any password that has appeared in a known public breach.

To exercise any of the rights described above, or for any question relating to the processing of your data, please write to our dedicated contact point:

info@fisniku.art

We undertake to respond within a maximum period of thirty days from receipt of your request, in accordance with article 12, 3 of the GDPR.