Last updated: 28 October 2026
This policy explains what personal data Sustifi processes when you use our website and service, why and on what legal basis, who receives it, how long we keep it and what rights you have under the EU General Data Protection Regulation (GDPR).
The controller of your personal data is Sustifi.
Contact for all privacy matters, including requests to exercise your rights: info@susti.fi
We have not appointed a Data Protection Officer, as our processing does not require one. The contact above handles all privacy questions.
We process only the data each purpose below needs.
Data: Email address, password (stored hashed), name, business name and type, country, sign-in and session data, plan details.
Legal basis: Performance of a contract, GDPR Art. 6(1)(b).
Data: What you enter or upload: bank statements and transactions (descriptions and counterparty names are stored encrypted), receipts including their images, shopping loyalty-card reports, energy and heating data, manual activities, projects and the emission figures we calculate from them.
Legal basis: Performance of a contract, Art. 6(1)(b).
Data: If you connect Procountor or Lilith (or Netvisor, once it opens): your access credentials (stored encrypted; your Lilith username and password are passed on once to open a session, and only the encrypted session is stored) and the invoices, transactions and receipt files imported.
Legal basis: Performance of a contract, Art. 6(1)(b).
Data: The parts of your data a feature needs, as described in section 3.
Legal basis: Performance of a contract, Art. 6(1)(b); for other people named in your records, legitimate interest, Art. 6(1)(f).
Data: Organisation details, members and roles, invitations, report content, Carbon Footprint Statements and badges. A Statement's lookup page and its badge are public by design.
Legal basis: Performance of a contract, Art. 6(1)(b); for an invited person's email before they accept, legitimate interest, Art. 6(1)(f).
Data: If you choose to list your business: business name, description, address, contact details, website and photos, and what the listing shows about it: your footprint figures (current monthly footprint, trend and reduction percentage), your rating and reviews, and how many times the listing has been viewed. Reviewers: name, email, rating and comment.
Legal basis: Your listing: consent, Art. 6(1)(a), which you withdraw by unpublishing it. Reviews: legitimate interest, Art. 6(1)(f).
Data: Name, email, company, how you heard about us, your reason for applying, language and the website you came from (its address only, without the page).
Legal basis: Steps taken at your request before entering into a contract, Art. 6(1)(b).
Data: Security events of your account, such as sign-ins, data exports and deletion requests, with IP address and user agent.
Legal basis: Legitimate interest in protecting accounts and the service, Art. 6(1)(f).
Data: When someone opens a Statement's lookup page or a directory listing, or searches the business directory: a hash of the IP address made with a salt that is replaced and destroyed every day, the browser family, the website they came from (its address only), the time and, for searches, the search terms. The IP address itself is not stored.
Legal basis: Legitimate interest in preventing misuse of public Statements and in aggregate statistics, Art. 6(1)(f).
Data: IP address and, when you are signed in, your user ID and a hash of your API key, held as short-lived counters.
Legal basis: Legitimate interest in security, Art. 6(1)(f).
Data: Technical request data, including IP address, in our hosting provider's logs; aggregated, cookieless usage and performance statistics.
Legal basis: Legitimate interest in operating a secure website, Art. 6(1)(f).
Data: Your email address and what you write to us.
Legal basis: Art. 6(1)(b) when it concerns your account; otherwise legitimate interest, Art. 6(1)(f).
Data: Records of data export, deletion and restore requests, including any reason you give and, for 90 days, the IP address and user agent.
Legal basis: Legal obligation, Art. 6(1)(c).
Your records may contain data about other people, such as the counterparties of your bank transactions or the people named on a receipt or invoice. Your organisation decides what it enters and is the controller of that data; we process it on its behalf to provide the service.
Account data is needed to use the service. Everything else is optional, but the features that rely on it will not work without it.
Some features use AI models from external providers. Anthropic (Claude) suggests transaction categories and recommendations, reads bank statements we cannot parse otherwise, classifies receipt lines and products, and powers the prediction chat, the VS and CSRD assistants and the mapping of information requests. Anthropic (Claude) also reads receipt images, and Microsoft (Azure AI Document Intelligence, in the EU) reads them a second time to check that reading. OpenAI turns your question to the CSRD assistant into a search vector. Each provider receives only the text or image the feature needs, which may include transaction descriptions, counterparty names and receipt details. We do not make decisions about you that have legal or similarly significant effects by automated means.
We use the service providers below to run Sustifi. They process personal data on our behalf and only for the function listed. Our sub-processor list shows each provider's purpose, the data it receives, its region and the transfer mechanism.
We do not sell your personal data or use it for advertising.
Your account and service data are stored in the EU (Ireland). Data leaves the EU/EEA when you use AI-assisted features (Anthropic and OpenAI, USA) and when you apply as a beta tester or an operational alert is sent (Slack, USA). Supabase, Vercel, Upstash and Microsoft are US companies whose staff may access data for support and operations. These transfers are to be covered by the EU-US Data Privacy Framework where the provider takes part in it, and otherwise by the European Commission's Standard Contractual Clauses. We have not yet confirmed which applies to each provider, nor their data processing agreements; the sub-processor list shows the status and is updated as each is confirmed.
| Data | Kept for |
|---|---|
| Account and service data, including uploads, imports, reports and Statements | While your account exists. After you delete your account, 30 days; then it is permanently deleted (section 7). |
| Security events of signed-in users | IP address and user agent are removed after 90 days; your user ID is removed when your account is permanently deleted. |
| Account deletion and restore log | IP address and user agent are removed after 90 days; your user ID is removed at permanent deletion. |
| Visitor statistics on public pages (daily-salted IP hash, browser family, referring website, directory searches) | Removed after 90 days. The salt is destroyed every day, so hashes cannot be linked across days. |
| Rate-limit counters (IP address, user ID) | Only for the rate-limit window; they expire automatically within two hours. |
| Beta-tester applications | 12 months, then deleted. |
| Prompts and error messages in our AI usage logs | 90 days. |
| Records of your data export requests | 2 years. |
| Emails to us | As long as needed to handle your matter. |
| Backups | Deleted data disappears from our hosting provider's backups as they are rotated. |
Under the GDPR you have the right to:
To exercise your rights, email info@susti.fi. We answer within one month.
You can also lodge a complaint with a supervisory authority. In Finland it is the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto), tietosuoja.fi. You can also complain in the EU country where you live or work.
We use only the cookies and browser storage the service needs to work or to remember a choice you made. We use no advertising or tracking cookies.
We use Vercel Web Analytics and Speed Insights to measure page views and performance in the app and on public Statement pages. They use no cookies, and we see only aggregated figures.
Data is encrypted in transit and at rest. Bank-transaction descriptions and counterparty names, and the credentials of the services you connect, are additionally encrypted field by field. Database access rules let each organisation see only its own data.
We may update this policy. We publish every change on this page and update the date above. If a change significantly affects how we use your data, we will also tell you in the service.