Privacy Policy

Version 1.3 — August 2026

This Privacy Policy explains how Saunafinder.fi collects, uses, stores, and protects your personal data. We are committed to handling your data responsibly and in compliance with the EU General Data Protection Regulation (GDPR).

1. Who We Are

Saunafinder.fi is operated by Ricky Knowles, based in Finland.

Data Controller:

Ricky Knowles
Saunafinder.fi
info@saunafinder.fi
+358 40 484 2960

If you have any questions about how we handle your data, please contact us at the above address.

2. What Data We Collect

2.1 Booking data

When you make a booking, we collect:

• Full name
• Email address
• Phone number (if provided)
• Booking details (sauna, date, time, number of guests)
• Any special requests or notes you provide

2.2 Payment data

Payment is processed by Stripe. Saunafinder.fi does not store your card number, CVV, or full payment details. Stripe may collect and store payment data in accordance with their own Privacy Policy (stripe.com/privacy).

2.3 Website usage data

We do not use analytics or tracking tools. We do not collect data about how you browse this website: no page-view tracking, no tracking pixels, and no analytics cookies. If we ever introduce analytics in the future, we will update this policy first, and the tool will only run for visitors who have allowed it through the cookie consent banner (see Section 7).

2.4 Communications

If you contact us by email, we will retain that correspondence for customer service purposes.

2.5 Customer account data (optional)

You can create a free customer account to save favourite saunas and see your bookings in one place. An account is entirely optional: you never need an account to book a sauna. If you create one, we hold:

• Your email address
• A display name, if you choose to add one
• The saunas you have favourited
• When your account was created and when you last logged in

That is the full list. There is no password (you log in with a one-time link we email you, which works once and expires in 15 minutes), and your account holds no phone number, no address, and no payment details. While you are logged in, an essential cookie (sf_customer_session) keeps your session active for up to 30 days; see Section 7.

2.6 Booking records we keep ourselves

As well as the record Stripe holds, we keep a short record of each booking on our own systems. It exists so your account page can list your bookings reliably, rather than depending on a Stripe search that can lag behind by a minute or more and show you an out-of-date list. This record is created when you book, whether or not you have an account. For each booking it holds:

• Your name
• The email address the booking is filed under, and the address you entered at Stripe's checkout page if that was different
• The sauna you booked, including its map coordinates, and the date, time and number of guests
• The amount paid and the currency
• The sauna operator's contact email address, so the booking stays connected to the right operator
• Stripe's reference numbers for the payment, and the date and time the booking was made

That is the full list. It holds no card details, no phone number, and none of the notes or special requests you sent with your booking. It also holds no status: whether a booking is confirmed, cancelled or refunded is read from Stripe every time you open your account page, so you see Stripe's current answer rather than a stale copy of it.

3. How We Use Your Data

We use your personal data for the following purposes:

We will never sell your personal data to third parties or use it for unsolicited marketing without your explicit consent.

4. Who We Share Your Data With

4.1 Sauna operators

Your name, email, phone number, and booking details are shared with the relevant sauna operator solely for the purpose of fulfilling your booking.

4.2 Stripe

Payment processing is handled by Stripe, Inc. Your payment information is subject to Stripe's Privacy Policy.

4.3 Resend

We use Resend to send transactional emails (booking confirmations, operator notifications, and account login links). Your email address is processed by Resend for this purpose.

4.4 Netlify

Our website runs on Netlify. Two sets of data are stored on Netlify's infrastructure (Netlify Blobs): your customer account data if you create an account (Section 2.5), and the booking records we keep ourselves (Section 2.6). See Section 9 on international transfers.

4.5 Legal requirements

We may disclose your data to law enforcement or regulatory authorities where required by law.

We do not share your data with any other third parties.

5. How Long We Keep Your Data

After the relevant retention period, your data is securely deleted. The booking-record retention above covers both copies of a booking: the one Stripe holds and the one we keep ourselves (Section 2.6).

One honest caveat about account deletion: deleting your account immediately erases the account data listed above, but it does not erase your booking records. Those exist in two places, with our payment processor Stripe and in our own booking records, and we are legally required to keep them for bookkeeping purposes under Finnish law (Kirjanpitolaki), whether or not you have an account. Deleting your account removes neither copy.

A second honest caveat, about those records coming back: an automated job rebuilds our booking records from Stripe once a day, so even if we did erase one when you closed your account, that job would write it again from the Stripe record we have to keep anyway. In practice that means if you delete your account and later create a new one with the same email address, or simply book with us again, bookings you made before can show up on your account page again. You can always ask us what we hold and ask for erasure (Section 6), and we will tell you plainly what we can remove and what the bookkeeping rules require us to keep.

6. Your Rights

Under GDPR, you have the following rights regarding your personal data:

• Right of access — you can request a copy of the personal data we hold about you
• Right to rectification — you can ask us to correct inaccurate data
• Right to erasure — you can ask us to delete your data, subject to legal retention requirements
• Right to restriction — you can ask us to limit how we use your data
• Right to data portability — you can request your data in a portable format
• Right to object — you can object to processing based on legitimate interests

If you have a customer account, you can delete it yourself at any time using the "Delete my account" button on your account page. Deletion is immediate. It removes your account data (email, display name, favourites). It does not remove the booking and payment records we must keep by law, which are held both by Stripe and by us; see Sections 2.6 and 5.

To exercise any of these rights, including requesting a copy of your data, contact us at info@saunafinder.fi. We will respond within 30 days.

If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi).

7. Cookies and Browser Storage

Saunafinder.fi sets two cookies, both essential:

• sf_admin_session keeps the site administrator signed in to the admin panel. Only the administrator ever receives it.
• sf_customer_session keeps you signed in if you choose to create a customer account. It is set only when you log in and lasts up to 30 days.

If you browse and book without signing in, we set no cookies on your device. We also use your browser's localStorage for two small preferences: your chosen language (sf_lang) and your cookie consent choices (sf_consent). These stay on your device and are not sent to us.

We do not use advertising, analytics, or tracking cookies of any kind. The site shows a consent banner so that if we ever add such tools, they stay off unless you allow them; you can change your choices at any time via the "Cookie settings" link in the footer. When you pay, Stripe may set cookies on its own checkout domain (checkout.stripe.com). Some pages also load content from third-party servers (OpenStreetMap map tiles, the Leaflet map library from unpkg.com, Google Fonts, and Unsplash images), which sends your IP address to those servers as with any web request, but to our knowledge none of them set cookies on our site. For more details, see our Cookies Policy.

8. Data Security

We take the security of your personal data seriously. We use HTTPS encryption on our website, and access to personal data is restricted to authorised personnel only. Card details are handled exclusively by Stripe and are never stored on our servers. The booking records described in Section 2.6 are stored on our own infrastructure and include the amount you paid, but they contain no card details of any kind.

9. International Transfers

Our platform is hosted on Netlify (USA). Netlify participates in the EU-US Data Privacy Framework, ensuring adequate protection for data transferred to the US. Email services (Resend) use EU-based infrastructure where possible.

10. Changes to This Policy

We may update this Privacy Policy from time to time. The current version will always be available at saunafinder.fi/privacy.html. We will notify you of significant changes by email where we hold your contact details.

Last updated: August 2026
Saunafinder.fi — info@saunafinder.fi