Privacy policy

Updated 28 August 2026

This policy describes what personal data Selecto Oy processes on the selecto.fi website and in its services, what the data is used for, who it is disclosed to and what rights you have. It follows articles 13 and 14 of the EU General Data Protection Regulation (2016/679).

1. Controller and contact details

The controller of personal data is Selecto Oy. Questions and requests about this policy or about your own data are handled by email.

Controller: Selecto Oy
Business ID: 3358486-6
VAT number: FI33584866
Register: Finnish Trade Register, Finnish Patent and Registration Office
Registered address: Ilokkaanrinne 2 A 1, Tampere, Finland
Email: sales@selecto.fi
Phone: +358 44 230 6321

Ilokkaanrinne 2 A 1 is the company's registered address, not a visiting address. Selecto Oy has not appointed a data protection officer, because the conditions in article 37 of the GDPR are not met.

2. What personal data we process

Data you provide on the contact form

name
email address
phone number, optional
company name, optional
topic, meaning the service you are interested in
the text you write in the message field

Name and email address are required, because without them there is no way to reply. Please do not write sensitive data such as health information or a personal identity code in the message field: the form is meant for getting in touch and is not designed for processing sensitive data.

Data generated automatically

IP address, timestamp, the address requested and the browser identifier, in the server logs
page views, referring address, device type, browser and approximate location at country level

Google account data

If you sign in to a Selecto service with a Google account, we process the name, email address and profile picture from that account. Details in section 6.

3. Purposes and legal bases for processing

Replying to your message and preparing a quote. Steps taken prior to entering into a contract, and legitimate interest (article 6(1)(b) and (f) GDPR).
Managing the customer relationship and delivering the service. Performance of a contract (article 6(1)(b)).
Sign-in and user identification in Selecto services. Performance of a contract, and the consent you give when you choose Google sign-in (article 6(1)(b) and (a)).
Site security and troubleshooting. Legitimate interest (article 6(1)(f)).
Measuring and improving the site. Legitimate interest (article 6(1)(f)).
Complying with legal obligations. For example keeping accounting records as required by the Finnish Accounting Act (article 6(1)(c)).

Personal data is not sold, rented or traded. The site performs no automated decision making with legal effects concerning you.

4. Cookies and consent

The site stores data on your device in two cases.

Strictly necessary data

The language you picked and your cookie choice are stored in your browser so the site does not have to ask again. Both are strictly necessary to provide the functions you asked for, so they do not require consent (section 205 of the Finnish Act on Electronic Communications Services 917/2014).

Nothing beyond the above is stored, so the site has no cookie notice. If we later introduce tracking that stores anything else on your device, we will update this policy and ask for your consent before doing so.

Fonts are served from the site's own server, so opening a page does not in itself make requests to third party servers.

5. Visitor measurement

PostHog, cookieless

PostHog is configured to run in cookieless mode: it stores no cookie and no localStorage value in your browser. The visitor identifier is computed on the server from technical data such as the IP address and the browser identifier, as a hash that changes daily. The same visitor therefore appears as a different visitor on different days. Measurement is limited to page views: automatic click capture, heatmaps, session recording and visitor profiles are all switched off. The PostHog EU cloud is used.

No individual visitor is identified by name. You can object to processing based on legitimate interest and withdraw consent, see sections 4 and 12.

In some Selecto services you can sign in with a Google account. If you choose that, Selecto receives your name, email address and profile picture, where one exists, from your Google account. We request only these and nothing else.

The data is used solely for authentication and identifying the user.
Data received from a Google account is not used for advertising or ad targeting.
The data is not sold and is not disclosed to third parties.
The data is not used to train language models.
You can revoke Selecto's access to your Google account at any time in your Google account settings at myaccount.google.com/permissions.
When a user account is deleted or access is revoked, the data received from the Google account is deleted from Selecto's systems.

Selecto complies with the Google API Services User Data Policy, including its Limited Use requirements.

7. Server logs

Selecto.fi is a static site running on Selecto's own Easyhost platform. The server logs record ordinary technical data every time a browser requests a page: IP address, timestamp, the address requested and the browser identifier. Log data is used for security and troubleshooting, not for tracking visitors or for advertising.

8. Recipients of the data

The following service providers process data on Selecto's behalf. They act as processors and may not use the data for their own purposes:

SMTP2GO delivers the message you send on the form to Selecto's email.
Easyhost, Selecto's own server platform, which runs the site.
PostHog produces the visitor measurement in its EU cloud.
Google provides Google sign-in, if you use it.

Data is disclosed to other third parties only where the law requires it or where an authority demands it on a statutory basis.

9. Transfers outside the EU and the EEA

The contact form data and the visitor measurement data is processed within the EU and the EEA. For Google sign-in, data is also processed in the United States.

Transfers outside the EU and the EEA are based on the standard contractual clauses approved by the European Commission or on the EU-US Data Privacy Framework, which the companies concerned have joined. You can request further information about the mechanisms used by email.

10. Retention periods

Contact messages. For as long as the customer relationship or its preparation requires. If no customer relationship follows, the message is deleted within 24 months at the latest.
Server logs. 12 months at most.
Visitor measurement data. Events are kept in the PostHog EU cloud for at most 84 months. They do not accumulate into a profile: the identifier changes daily, so events from different days cannot be linked to the same visitor.
Google sign-in data. For as long as the user account exists.
Your cookie choice. 12 months, after which consent is asked again.
Accounting records. For the period required by the Finnish Accounting Act.

11. How the data is protected

The site runs over an encrypted HTTPS connection. The form's recipient address is set in a server environment variable, so it cannot be redirected elsewhere through the form. Access to the email, the server environment and the measurement tools is limited to those people at Selecto who need it for their work, and is protected with personal credentials and multi-factor authentication.

12. Your rights

Requests are handled by email at sales@selecto.fi. Making a request is free of charge and we reply within one month.

Right of access. You can find out what data we hold about you and get a copy of it.
Rectification. Incorrect or incomplete data is corrected at your request.
Erasure. You can ask us to delete your data once there is no longer a basis for keeping it.
Restriction of processing. You can ask us to store your data without processing it further while a matter is being resolved.
Right to object. You can object to processing based on legitimate interest on grounds relating to your situation.
Data portability. You can get the data you provided in a machine readable format and transfer it elsewhere.
Withdrawal of consent. You can stop consent-based processing at any time, see section 4.
Right to lodge a complaint. You can complain to the supervisory authority, see the end of this section.

We may ask for further details to verify your identity, so that data is not handed to the wrong person. If you believe your data is processed in breach of the GDPR, you can lodge a complaint with the supervisory authority: Office of the Data Protection Ombudsman, Lintulahdenkuja 4, 00530 Helsinki, Finland, tietosuoja.fi/en.

13. AI services and customer data

This section concerns the agent and automation projects Selecto delivers. The agents Selecto builds run on Selecto's own servers or in the customer's own environment. Customer data is not used to train language models. When Selecto processes personal data on a customer's behalf, a separate data processing agreement is made (article 28 GDPR), naming the sub-processors used, such as the language model providers.

14. Changes to this policy

This policy is updated when the site or the processing of data changes. The date at the top of the page shows when it was last updated. If a change requires your consent, it will be requested separately before the change takes effect.