Privacy Policy

Who we are

Tiny Books is run by Toni Väisänen, a private individual in Finland. There is no company behind it. Toni Väisänen is the data controller for personal data processed within Tiny Books.

Contact: hello@tinybooks.fi.

What we collect

• Account information. Email address, password (hashed), and the personal details you choose to enter for tax-export purposes (name, Y-tunnus).
• Receipts and tagged data. Files you upload (photos, PDFs, email forwards) and their derived data (vendor, amount, date, category).
• Service operation data. IP addresses, request logs, cookies strictly necessary for authentication.
• Payment data. Handled by Paddle.com Market Ltd, our merchant of record. Paddle sells the subscription, takes the payment, and handles sales tax; we receive a customer reference and subscription state, not card numbers.

We do not use third-party advertising trackers. We do not sell, share, or use your data to train AI models.

Why we collect it

• To provide the service.
• To produce your tax export.
• To bill you.
• To comply with legal obligations (e.g. accounting record retention).

How long we keep it

• Active accounts: as long as you have an account.
• Cancelled accounts: a grace window during which you can re-activate or download your archive, followed by deletion. Specifics in the Terms.
• Bookkeeping records on our side: the toiminimi proprietor is the legal record-holder under Kirjanpitolaki. Tiny Books does not offer a long-term retention guarantee — your archive export is the compliance feature.

Where it lives

Cloudflare data centers in the EU. The product runs on Cloudflare Pages and Cloudflare Workers; data is stored in Cloudflare D1 (database) and Cloudflare R2 (file attachments).

Sub-processors

• Cloudflare — hosting, storage, edge.
• Paddle — merchant of record: billing, payment processing, and sales tax. Paddle is the data controller for your payment information, not our processor (Paddle Privacy Policy).
• Resend — transactional email.
• Plausible — privacy-friendly, cookieless analytics on the marketing site only (not the product).

Your rights under GDPR

You have the right to access, rectify, export, and delete your data. To exercise any of these rights, email hello@tinybooks.fi. We respond within one month, as GDPR Article 12(3) requires.

Changes

We update this policy when our practices change. Material changes will be communicated by email and reflected here with a new updatedAt date.