Privacy notice

Controller

Kehita AI Oy, Unioninkatu 7 B 15, 00130 Helsinki, Finland, Finnish business ID 3545522-4. For any question about your data, write to rapport@pfasnearme.com. We have no data protection officer; the law does not require one for an activity of this size.

rapport@pfasnearme.com

What data we process

• Report signup. When you enter your email address on a city's page, we record that address, the city you chose, the page language, the version of the consent text shown, the date of the request, the date of your confirmation and, if you arrived through a link in one of our emails, the campaign tag of that link. We then record which results were sent to you, so that nothing is sent twice.
• Sending emails. Our sending provider tells us whether a message was delivered, bounced or was reported as spam. An address that bounces permanently or reports us as spam is blocked; we no longer write to it.
• Technical logs. Like every website, ours receives your IP address and browser type with each request. Our host processes them to deliver the pages and defend against abuse. We build no profile from these logs and do not match them with signups.
• Audience measurement. We count visits with Plausible, a cookieless tool hosted in the European Union. It stores no personal data. The IP address is used for a moment to compute an anonymous session identifier that changes every day, then discarded. We see totals per page and per country, never people. Clicks on affiliate links are counted with the city name of the page, never with your address.
• Nothing else. No user account, no contact form storing your messages (you write to us by email), no targeted advertising, no social media button tracking you.

Purposes and legal bases

• Sending you the report for the city you chose, then the new PFAS results for that city with explanations, at most once a week and only when there is something new. Legal basis is your consent (art. 6(1)(a) GDPR), which you give by confirming your address and withdraw by unsubscribing. Withdrawal does not affect earlier sends.
• Preventing abuse of the form (repeated signups, bots) and proving that a signup was confirmed. Legal basis is our legitimate interest in running the service reliably (art. 6(1)(f) GDPR). The host's technical logs and the blocking of bouncing addresses rest on the same basis.
• Knowing which pages are read and whether affiliate links are used, to improve and fund the site. Legal basis is our legitimate interest (art. 6(1)(f) GDPR); no personal data is kept, so no consent is needed. We take no automated decisions about you and do no profiling.

Recipients and processors

We neither sell nor share your data. Three providers process it on our behalf under data processing agreements (art. 28 GDPR):

• Netlify, Inc. (San Francisco, United States) hosts the site, runs the signup form and stores the subscriber list in encrypted storage. The technical logs are its own. https://www.netlify.com/privacy/
• Resend, Inc. (San Francisco, United States) sends the confirmation emails and the reports, and passes delivery events back to us (delivered, bounced, complained). https://resend.com/legal/privacy-policy
• Plausible Insights OÜ (Tartu, Estonia) provides the cookieless audience measurement described above, on servers in the European Union. https://plausible.io/data-policy

Netlify and Resend are US companies, so your email address may be processed in the United States. These transfers rely on the European Commission's standard contractual clauses included in their data processing agreements (art. 46(2)(c) GDPR). You can ask for a copy at the address above. Plausible processes data in the European Union.

Retention

A request not confirmed within 7 days can no longer be confirmed; write to us to have it deleted. A confirmed signup is kept for as long as you stay subscribed. When you unsubscribe, we keep your address marked "unsubscribed" so that an old confirmation link cannot re-subscribe you and so that we stop writing to you; write to us to have it erased completely. Addresses blocked after a permanent bounce or a complaint stay on the block list for the same reason.

Your rights

You can ask for access to your data, its rectification, its erasure, the restriction of its processing and its portability, and object to processing based on our legitimate interest (articles 15 to 21 GDPR). You withdraw your consent at any time with the unsubscribe link in every email. For everything else, an email to rapport@pfasnearme.com is enough; we answer within a month. We may ask you to confirm that the address is yours before acting.

You also have the right to lodge a complaint with a supervisory authority (art. 77 GDPR). The authority competent for us is the Finnish one, Tietosuojavaltuutetun toimisto (Office of the Data Protection Ombudsman, Finland). You may also turn to the authority of the country where you live: https://tietosuoja.fi/en

• CNIL
• Autorité de protection des données / Gegevensbeschermingsautoriteit
• Landesdatenschutzbehörde des Bundeslandes (list at bfdi.bund.de)
• Autoriteit Persoonsgegevens
• Tietosuojavaltuutetun toimisto
• Datatilsynet
• Andmekaitse Inspektsioon
• Federal Trade Commission (consumer protection)

Cookies

The site uses no tracking, advertising or analytics cookies, so it shows no consent banner. The only cookie is pfasnearme_language, which your browser stores only if you click another language in the menu; it remembers that choice for one year so the homepage can send you to the right language. It is strictly necessary for the service you asked for and contains nothing but the language code. Your browser's Global Privacy Control signal is honoured by design; there is no tracking to switch off.

Changes

We update this notice when the service changes. The version date is at the top of the page. A change that would widen how your address is used would come with a new consent email, never a silent edit.