Skip to content
Haalarikone

Privacy notice

Effective 15 September 2026

This notice explains how Haalarikone (haalarikone.fi) processes personal data. The service is run by Valtteri Savonen as a private individual. It is written under the EU General Data Protection Regulation (GDPR, 2016/679) and the Finnish Data Protection Act (1050/2018).

Controller
Valtteri Savonen
Service
Haalarikone, https://haalarikone.fi
Contact
savonen.emppu@gmail.com

1. What this notice covers

Haalarikone is a free directory of student overall colours at Finnish universities and universities of applied sciences. There are no user accounts, and the directory is not a register of individual students.

Personal data is created only if you send feedback, and in a technical sense when the site is used (analytics, search, and hosting). Institution, student organisation, and colour data is public directory information.

2. Data we process

We only process what is needed to run the service:

  • Feedback. The message (required), an optional email address, and technical context needed to reply (page URL, subject name/id, and referring page if present).
  • Analytics. Databuddy collects cookieless aggregated usage data: page views, referring domain, browser/device type, country/region, interactions, and technical errors. IP addresses are anonymised and individual visitors are not identified. Databuddy policy: https://www.databuddy.cc/privacy
  • Search. Search queries are processed on the server against the local dataset. If local search returns no results, the query may be sent to Anthropic (Claude) to interpret intent. We store the search text (and any search filters) anonymously in our own database to improve search and the underlying directory data. Log rows are not linked to a user account, IP address, or other identifier that would let us recognise you.
  • Theme. Light/dark preference is stored in your browser's localStorage. It is not sent to us.
  • Technical delivery. Cloudflare processes technical request data (such as IP address, user agent, and timestamp) to deliver the site, prevent abuse, and keep it secure.

3. Purpose and legal basis

Feedback: we process the message to reply and to improve the directory. The legal basis is GDPR 6(1)(b) (steps at your request) and, for an optional email, 6(1)(a) (consent, which you can withdraw).

  • Analytics. Legitimate interest (6(1)(f)): understand how the service is used and fix errors without cookies or user profiles.
  • Search and AI. Legitimate interest (6(1)(f)): provide working search and improve the dataset using anonymous search logs. AI is used only when local search returns no results.
  • Hosting and security. Legitimate interest (6(1)(f)): keep the service available and protect it from abuse.

4. Sources

Feedback and search data come from you. Analytics and hosting data are generated when you use the site. Directory content is compiled from public sources and user reports.

5. Recipients

We do not sell personal data. Data is processed only by processors needed to run the service:

6. Transfers outside the EU/EEA

Cloudflare, Discord, and Anthropic may process data outside the EEA, including in the United States. Transfers rely on the processors' safeguards, such as the European Commission's standard contractual clauses. Databuddy processes visitor data in anonymised form.

Only the search query that local search could not interpret is sent to the AI provider. Feedback messages and email addresses are not sent to Anthropic.

7. Retention

Feedback is kept for as long as handling it requires, and is usually deleted within 12 months unless the conversation continues or law requires longer retention.

Analytics is retained in aggregated form under Databuddy's policy. Anonymous search logs are kept for as long as they are needed to improve search and the directory, and they are reviewed without identifying users. Theme preference stays on your device until you clear site data.

8. Cookies and local storage

Haalarikone does not set tracking cookies and does not build user profiles. Theme preference lives in localStorage. Databuddy runs without cookies.

Cloudflare may set strictly necessary cookies for security and delivery. These are not marketing cookies.

9. Security

Connections are protected with TLS. Access to feedback and search logs is limited to the controller. The feedback form includes a honeypot field to reduce spam. We do not collect payment or login data because there are no accounts.

10. Your rights

Under the GDPR you may request access, rectification, erasure, restriction, data portability, and object to processing based on legitimate interest. You can withdraw consent for an optional email at any time.

Because analytics and search logs do not include user identifiers, we cannot identify one visitor from them. For feedback we can act on a request if the message or email is enough to find it.

Send requests to savonen.emppu@gmail.com. We will reply without undue delay, and within one month at the latest.

11. Right to complain

If you believe your personal data is processed unlawfully, you may lodge a complaint with the Office of the Data Protection Ombudsman: https://tietosuoja.fi — Office of the Data Protection Ombudsman, Lintulahdenkuja 4, 00530 Helsinki, Finland.

12. Changes to this notice

We update this notice when processing changes. The current version is on this page. Material changes are marked with the date at the top.

Privacy notice | Haalarikone