Privacy Policy

Last updated: March 14, 2026

1. Data Controller

Pauhu Ltd (Y-tunnus: 0768171-8, "we", "us") is the data controller for personal data processed through pauhu.eu and the Pauhu European Language Data Space.

Contact: WhatsApp

Data Protection Officer: WhatsApp

2. Data We Collect

Category	Data	Purpose
Account	Email, name, company	Service delivery
Payment	Billing address, VAT ID	Invoicing (SEPA bank transfer)
Usage	API calls, data feed access	Billing, service improvement
Technical	IP address, browser	Security

Publicly available sources (GDPR Art. 14): Pauhu processes information that public authorities, open-data publishers and other public sources have made publicly available. Where such information incidentally contains personal data (for example names in published court decisions or in public-interest publications), it is processed under legitimate interest (GDPR Art. 6(1)(f)) and in accordance with the publishing source's terms. The Art. 14(5)(b) exemption applies as individual notice would involve disproportionate effort. Content from time-sensitive public sources is retained for no longer than 90 days. You may exercise your rights (including erasure) by contacting WhatsApp.

3. Legal Basis (GDPR Art. 6)

• Contract: Processing necessary for service delivery
• Legal obligation: Tax and accounting requirements
• Legitimate interest: Security and fraud prevention

4. Data Retention

• Account data: Duration of account + 2 years
• Payment records: 7 years (Finnish accounting law)
• Usage logs: 90 days

5. Data Sharing

We share data only with the following processors and sub-processors:

5.1 Infrastructure (EU)

• European infrastructure provider - Dedicated server infrastructure (compute, databases, object storage). Server location: EU/EEA. EU jurisdiction. DPA in place. Full subprocessor details available on request.

5.2 Authentication (third-country transfers - Art. 13(1)(f))

When you choose to sign in with a third-party identity provider, authentication tokens are exchanged with that provider. We receive only your name, email, and profile photo - no passwords are transmitted to or stored by Pauhu.

• Google LLC - Google OAuth 2.0 (accounts.google.com). US. Transfer safeguard: EU Standard Contractual Clauses (Commission Decision 2021/914, Module 3).
• GitHub, Inc. (Microsoft subsidiary) - GitHub OAuth (github.com). US. Transfer safeguard: EU SCCs Module 3.
• Microsoft Corporation - Microsoft OAuth / MS Graph (login.microsoftonline.com, graph.microsoft.com). US. Transfer safeguard: Microsoft DPA with EU SCCs.
• Apple Inc. - Sign in with Apple (appleid.apple.com). US. Transfer safeguard: Apple DPA with EU SCCs Module 3.

You are never required to use a third-party identity provider. Email/password authentication processes data entirely within the EU.

5.3 Email (EU)

• Mailtrap SIA (MailerSend) - Transactional email delivery. Riga, Latvia. EU jurisdiction. No third-country transfer.

5.4 Payment (EU only, no third-country transfer)

• SEPA bank transfer - Invoicing and payment are handled by SEPA bank transfer within the European Union. Payment data stays in EU jurisdiction; there is no transfer to a third country. The billing process receives only invoice and payment events, never query text, search results, or document content.

All processors are bound by data processing agreements (Art. 28 GDPR).

6. Data Location

Our primary infrastructure (databases, object storage, compute, models) is located exclusively within the European Union (EU data centers). Your queries, documents, and search results are processed entirely within the EU and never leave EU jurisdiction.

The only third-country transfer is the authentication tokens exchanged with third-party OAuth providers (Section 5.2), where EU Standard Contractual Clauses apply. Payment stays in the EU (SEPA bank transfer, Section 5.4). You can avoid all third-country transfers by using email/password authentication.

7. Your Rights (GDPR)

• Access your personal data
• Rectify inaccurate data
• Erase data ("right to be forgotten")
• Port data to another service
• Object to processing
• Lodge complaint with supervisory authority

To exercise these rights, contact WhatsApp.

8. Cookies & Tracking

This site uses no cookies, no analytics, and no tracking of any kind. We store only your theme and text size preferences in your browser's localStorage, which never leaves your device.

9. Regulatory Evaluation

Pauhu is currently under evaluation by the Finnish Transport and Communications Agency (Traficom) as part of the national AI solutions assessment programme under the Alt-EDIC (Alternative European Digital Infrastructure Consortium) initiative. This evaluation covers:

• Data sovereignty and EU jurisdiction compliance
• NIS2 Directive (EU) 2022/2555 conformance
• Browser-native data retrieval and privacy implications
• Suitability for public sector deployment across Finnish government organisations

During this evaluation, Traficom personnel may access Pauhu’s staging environment for testing purposes. No personal data from Traficom evaluators is retained beyond the evaluation period. Contact: kyberturvallisuus@traficom.fi

10. Supervisory Authority

Finnish Data Protection Ombudsman
tietosuoja.fi
tietosuoja@om.fi

Pauhu Ltd
Helsinki, Finland
EU jurisdiction