Privacy Policy

Version 1.4, August 2026

This Privacy Policy explains how Saunafinder.fi collects, uses, stores, and protects your personal data. We are committed to handling your data responsibly and in compliance with the EU General Data Protection Regulation (GDPR).

1. Who We Are

Saunafinder.fi is operated by Ricky Knowles, based in Finland.

Data Controller:

Ricky Knowles
Saunafinder.fi
info@saunafinder.fi
+358 40 484 2960

If you have any questions about how we handle your data, please contact us at the above address.

2. What Data We Collect

2.1 Booking data

When you make a booking, we collect:

• Full name
• Email address
• Phone number (if provided)
• Booking details (sauna, date, time, number of guests)
• Any special requests or notes you provide

2.2 Payment data

Payment is processed by Stripe. Saunafinder.fi does not store your card number, CVV, or full payment details. Stripe may collect and store payment data in accordance with their own Privacy Policy (stripe.com/privacy).

2.3 Website usage data

We do not use analytics or tracking tools. We do not collect data about how you browse this website: no page-view tracking, no tracking pixels, and no analytics cookies. If we ever introduce analytics in the future, we will update this policy first, and the tool will only run for visitors who have allowed it through the cookie consent banner (see Section 7).

2.4 Communications

If you contact us by email, we will retain that correspondence for customer service purposes.

2.5 Customer account data (optional)

You can create a free customer account to save favourite saunas and see your bookings in one place. An account is entirely optional: you never need an account to book a sauna. If you create one, we hold:

• Your email address
• A display name, if you choose to add one
• The saunas you have favourited
• When your account was created and when you last logged in

That is the full list. There is no password (you log in with a one-time link we email you, which works once and expires in 15 minutes), and your account holds no phone number, no address, and no payment details. While you are logged in, an essential cookie (sf_customer_session) keeps your session active for up to 30 days; see Section 7.

2.6 Booking records we keep ourselves

As well as the record Stripe holds, we keep a short record of each booking on our own systems. It exists so your account page can list your bookings reliably, rather than depending on a Stripe search that can lag behind by a minute or more and show you an out-of-date list. This record is created when you book, whether or not you have an account. For each booking it holds:

• Your name
• The email address the booking is filed under, and the address you entered at Stripe's checkout page if that was different
• The sauna you booked, including its map coordinates, and the date, time and number of guests
• The amount paid and the currency
• The sauna operator's contact email address, so the booking stays connected to the right operator
• Stripe's reference numbers for the payment, and the date and time the booking was made

That is the full list. It holds no card details, no phone number, and none of the notes or special requests you sent with your booking. It also holds no status: whether a booking is confirmed, cancelled or refunded is read from Stripe every time you open your account page, so you see Stripe's current answer rather than a stale copy of it.

2.7 Sauna stories

Anyone can send us a sauna story through our Sauna Stories page. You do not need an account and you do not need to have booked anything. If you send one, we collect:

• The name you want shown with your story
• The location you type in, in your own words
• The sauna you are writing about, in your own words
• Your story text
• Your email address, so we can reach you about your story
• A shortened version of your browser's user-agent string, and a one-way SHA-256 hash of your IP address. We do not store the IP address itself. Both exist only to stop the form being flooded by scripts.

What gets published: the name, location, sauna name, story text and the date you sent it. Stories appear on a public page that search engines are allowed to index, so a published story can be found through a search engine as well as on our site. Please do not put anything in a story that you would not want a stranger to read.

What never gets published: your email address, the user-agent string and the IP hash. The public stories feed is built from a fixed list of the five fields above, so the private ones cannot be sent to a browser by accident.

Nothing appears automatically. Every story is stored as pending and stays invisible until a signed-in administrator reads it and publishes it. A story we do not publish is not shown to anyone.

Our legal basis. Publishing your name, location and story is based on your consent, which you give by ticking the box on the form before you send it. Keeping the IP hash and the hourly submission counter is based on our legitimate interest in keeping a public form free of spam and abuse.

Changing your mind. Email us at info@saunafinder.fi and we will delete your story. Deleting it removes the whole record, including your email address and the story text, and it cannot be undone. All we keep afterwards is a line in our internal admin log recording that a story with a particular id was deleted and what its status had been. That line holds no name, no email address and none of your story.

How long we keep stories. We have not set a time limit. Stories are kept for as long as the site runs, whether they are published, still waiting to be read, or turned down. We would rather say that plainly than quote you a period we do not actually apply. You can ask us to delete yours at any time.

2.8 Sauna operator data

This section is about the businesses that list saunas with us, not about customers. If you apply to list a sauna, or you already do, we hold:

• Your contact name, business email address and phone number
• Your business address and the address guests arrive at
• Your business ID (Y-tunnus) and whether you are registered for VAT
• Your payout bank account (IBAN) and the account holder's name
• A record of your acceptance of our Operator Agreement, including the name you typed as your signature and the date and time you accepted
• Whether we have your liability insurance certificate on file

Most of this is personal data only where you trade as an individual or where a name and a personal contact detail identify you. We use it to run the listing, pass bookings to you, pay you, and show that you agreed to the terms you agreed to.

Our legal basis. Performance of a contract for the contact details, addresses, business details, bank details and acceptance record. Legal obligation for anything that forms part of our accounting records, which Finnish bookkeeping law requires us to keep. Under Section 7 of the Operator Agreement, operators are separately responsible for the customer data we pass them, including deleting it within 30 days of the booking date.

How long we keep it. We keep operator data for as long as you are listed with us and while any obligations under the Operator Agreement are still running, and after that for as long as Finnish bookkeeping law (Kirjanpitolaki) requires us to keep the payment and invoicing records it forms part of. We have not fixed a single number of years for the rest of it, and we are not going to state one here that we do not apply. If you want to know exactly what we hold about you and what we can delete, email info@saunafinder.fi and we will tell you.

3. How We Use Your Data

We use your personal data for the following purposes:

We will never sell your personal data to third parties or use it for unsolicited marketing without your explicit consent.

4. Who We Share Your Data With

4.1 Sauna operators

Your name, email, phone number, and booking details are shared with the relevant sauna operator solely for the purpose of fulfilling your booking.

4.2 Stripe

Payment processing is handled by Stripe, Inc. Your payment information is subject to Stripe's Privacy Policy.

4.3 Resend

We use Resend to send transactional emails (booking confirmations, operator notifications, and account login links). Your email address is processed by Resend for this purpose.

4.4 Netlify

Our website runs on Netlify. Four sets of data are stored on Netlify's infrastructure (Netlify Blobs): your customer account data if you create an account (Section 2.5), the booking records we keep ourselves (Section 2.6), sauna stories both before and after they are published (Section 2.7), and the hourly submission counter that keeps the story form from being flooded, which holds only hashed IP addresses and timestamps. See Section 9 on international transfers.

4.5 Legal requirements

We may disclose your data to law enforcement or regulatory authorities where required by law.

We do not share your data with any other third parties.

5. How Long We Keep Your Data

After the relevant retention period, your data is securely deleted. The booking-record retention above covers both copies of a booking: the one Stripe holds and the one we keep ourselves (Section 2.6).

One honest caveat about account deletion: deleting your account immediately erases the account data listed above, but it does not erase your booking records. Those exist in two places, with our payment processor Stripe and in our own booking records, and we are legally required to keep them for bookkeeping purposes under Finnish law (Kirjanpitolaki), whether or not you have an account. Deleting your account removes neither copy.

A second honest caveat, about those records coming back: an automated job rebuilds our booking records from Stripe once a day, so even if we did erase one when you closed your account, that job would write it again from the Stripe record we have to keep anyway. In practice that means if you delete your account and later create a new one with the same email address, or simply book with us again, bookings you made before can show up on your account page again. You can always ask us what we hold and ask for erasure (Section 6), and we will tell you plainly what we can remove and what the bookkeeping rules require us to keep.

6. Your Rights

Under GDPR, you have the following rights regarding your personal data:

• Right of access: you can request a copy of the personal data we hold about you
• Right to rectification: you can ask us to correct inaccurate data
• Right to erasure: you can ask us to delete your data, subject to legal retention requirements
• Right to restriction: you can ask us to limit how we use your data
• Right to data portability: you can request your data in a portable format
• Right to object: you can object to processing based on legitimate interests

If you have a customer account, you can delete it yourself at any time using the "Delete my account" button on your account page. Deletion is immediate. It removes your account data (email, display name, favourites). It does not remove the booking and payment records we must keep by law, which are held both by Stripe and by us; see Sections 2.6 and 5.

If you have sent us a sauna story and want it taken down, email info@saunafinder.fi. We delete the whole record, including the email address you sent it with, and the story comes off the public page. See Section 2.7.

To exercise any of these rights, including requesting a copy of your data, contact us at info@saunafinder.fi. We will respond within 30 days.

If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi).

7. Cookies and Browser Storage

Saunafinder.fi sets two cookies, both essential:

• sf_admin_session keeps the site administrator signed in to the admin panel. Only the administrator ever receives it.
• sf_customer_session keeps you signed in if you choose to create a customer account. It is set only when you log in and lasts up to 30 days.

If you browse and book without signing in, we set no cookies on your device. We also use your browser's localStorage for two small preferences: your chosen language (sf_lang) and your cookie consent choices (sf_consent). These stay on your device and are not sent to us.

We do not use advertising, analytics, or tracking cookies of any kind. The site shows a consent banner so that if we ever add such tools, they stay off unless you allow them; you can change your choices at any time via the "Cookie settings" link in the footer. When you pay, Stripe may set cookies on its own checkout domain (checkout.stripe.com). Some pages also load content from third-party servers (OpenStreetMap map tiles, the Leaflet map library from unpkg.com, Google Fonts, and Unsplash images), which sends your IP address to those servers as with any web request, but to our knowledge none of them set cookies on our site. For more details, see our Cookies Policy.

8. Data Security

We take the security of your personal data seriously. We use HTTPS encryption on our website, and access to personal data is restricted to authorised personnel only. Card details are handled exclusively by Stripe and are never stored on our servers. The booking records described in Section 2.6 are stored on our own infrastructure and include the amount you paid, but they contain no card details of any kind.

9. International Transfers

Our platform is hosted on Netlify (USA). Netlify participates in the EU-US Data Privacy Framework, ensuring adequate protection for data transferred to the US. Email services (Resend) use EU-based infrastructure where possible.

10. Changes to This Policy

We may update this Privacy Policy from time to time. The current version will always be available at saunafinder.fi/privacy.html. We will notify you of significant changes by email where we hold your contact details.

Last updated: August 2026
Saunafinder.fi, info@saunafinder.fi