Privacy Policy — nosweat.finance
Privaatsuspoliitika — nosweat.finance
Document status: Master draft in English. The live page at /et/privaatsus must be published in Estonian (primary) and English (secondary). Estonian version prevails. Have reviewed by an Estonian data protection lawyer before going live.
Rendered pages: src/app/[locale]/privaatsus/page.tsx
Legal basis: GDPR (EU 2016/679), Estonian Isikuandmete kaitse seadus (IKS, RT I, 04.01.2019, 11), Elektroonilise side seadus (ESS) § 102
Last updated: 2026-09-24 | Version: 1.5
1. Data Controller
Nosweat Finance OÜ Registry code: 17466091 Address: Kadaka pst 2-2, 10912 Tallinn, Estonia E-mail: support@nosweat.finance Website: nosweat.finance
No Data Protection Officer (DPO) is appointed at this time — the volume of personal data processed does not meet the threshold for mandatory appointment under GDPR Art. 37. Contact the above address for all data protection queries.
2. Data We Collect and Why
We collect only the personal data necessary to provide the service. The table below lists each category, the specific data, the purpose, and the legal basis under GDPR Art. 6.
| Category | Specific data | Purpose | Legal basis |
|---|---|---|---|
| Account identity | Full name, email address | Create and manage your account; send service notifications; identify you as a board member in company data | Art. 6(1)(b) — contract performance |
| eID identity | Isikukood (Estonian personal identification code), full name, eID method (ID-card / Mobiil-ID / Smart-ID) | Authenticate via SK ID Solutions; auto-query Äriregister for companies where you are a board member | Art. 6(1)(b) — contract performance; Art. 6(1)(c) — legal obligation (Äriregister filing requires isikukood) |
| Social login data | Name and email as returned by Google or Facebook OAuth | Pre-fill account details; authenticate | Art. 6(1)(b) — contract performance |
| Company data | Company name, registry code, EMTAK code, share capital, registered address, board member list (from Äriregister) | Verify eligibility; pre-populate annual report; validate board membership | Art. 6(1)(b) — contract performance |
| Financial transaction data | Bank transaction dates, amounts (in cents), counterparty account numbers, transaction descriptions (anonymised before AI processing — see § 4) | Categorise transactions; generate income statement and balance sheet; produce annual report | Art. 6(1)(b) — contract performance |
| Salary and payroll data | Gross salary, social tax, income tax figures (from TSD if imported, or manual entry) | Calculate labour cost figures for annual report | Art. 6(1)(b) — contract performance |
| Fixed asset and loan data | Asset purchase dates and costs, depreciation rates, loan balances, interest rates | Calculate balance sheet; produce notes to the annual report | Art. 6(1)(b) — contract performance |
| Payment data | Payment status and reference number (from LHV Payment Gateway); we do not store card numbers or bank credentials | Verify that a paid payment exists for a specific report before granting access | Art. 6(1)(b) — contract performance |
| Authentication logs | Login timestamps, IP address, authentication method | Security monitoring; detect unauthorised access | Art. 6(1)(f) — legitimate interest (security) |
| Usage logs | Pages visited, actions taken, error logs | Debug technical issues; improve the service | Art. 6(1)(f) — legitimate interest (service improvement) |
| Subscription lists | Email address, language preference, the page the address came from, any extra fact you enter with it, a hashed IP address, and a record of the consent text you agreed to (version and timestamps) | Send the specific emails you asked for on the list you joined; prove that you asked for them | Art. 6(1)(a) — consent (withdrawable at any time via the link in every email) |
| Business Register open data (company pages) | Company name, registry code, county, founding date, financial year, first filing deadline (derived) — only companies founded in 2026 | Publish Filing Radar cohort pages: a public page for each company founded in 2026 showing its registered financial year and first filing deadline | Art. 6(1)(f) — legitimate interest (public-interest statistics and an information service based on registry data) |
| Cold-email recipients (Business Register open data) | The contact email address a company has entered in the Business Register, company name, registry code; events for sending, bounces, replies, link clicks and unsubscribing; if you reply, the correspondence in our mailbox; shareholder and board-member register data read temporarily to make the selection (not stored) | Send introductory emails about nosweat.finance to Estonian companies for which the service is relevant according to Business Register open data; honour unsubscribes and objections | Art. 6(1)(f) — legitimate interest (direct marketing to companies) |
Business Register open data (company pages). We publish a limited number of public pages about companies founded in 2026. The data displayed on these pages comes from the Business Register open data (Centre of Registers and Information Systems, licence CC BY-SA 4.0). The pages do not display addresses, personal data, or financial data — only the company name, registry code, county, founding date, financial year, and derived filing deadline. If you wish to have your company's page removed, write to support@nosweat.finance — we will remove the page within a reasonable time and ensure it does not reappear.
Cold emails to companies. We send individual introductory emails to Estonian companies whose contact email address, as entered in the Business Register, is public in the Business Register open data. The only source of the addresses and company data is the e-Business Register open data (RIK); we do not buy or exchange addresses with third parties. Every email states that the contact details come from the e-Business Register open data. We choose who receives an email solely from the company's Business Register entry (for example a recently founded private limited company, an annual report not yet filed, or bookkeeping as a registered activity). We do not send cold emails to sole proprietors (FIE). When choosing recipients we may also use the Business Register open data on shareholders and board members to find companies where one and the same person is both a shareholder and a board member. We read that data only temporarily, to make the selection: we do not store the names, birth dates or addresses of shareholders and board members or the hash of their personal code, and we do not use them in the email. Only the company's registry code and a note about the selection reach the campaign.
We process this data on the basis of legitimate interests (GDPR Art. 6(1)(f)); we have assessed and documented that reliance separately. Sending to a company is also governed by § 103¹(2) of the Electronic Communications Act (ESS): no prior consent is required, but every email contains a free, one-click unsubscribe link. We send each address up to two emails within one campaign and do not write to the same address again in a later campaign. If you unsubscribe, we never write to that address again; to guarantee this, the address stays on the unsubscribe list even if you ask us to erase your data (see section 5). The data is processed by Supabase (database) and the emails are sent from Zone.ee mailboxes (see section 3).
Subscription lists. Signing up to any of our email lists — a filing-deadline reminder, a product waitlist, a newsletter — is separate from having an account, and is never a condition of using the service. Each list stores its own consent record: the exact wording you agreed to (kept by version, so a later edit to that wording cannot change what you are recorded as having agreed to), when you asked, and when you confirmed. Confirmation is required — an address that never clicks the confirmation link is never mailed, and is deleted in our clean-up of unconfirmed sign-ups, for which a sign-up becomes eligible 30 days after it was made. Every email carries a one-click unsubscribe link; that link also offers opting out of all lists at once, which we honour globally and permanently.
What we do NOT collect or store
- Bank account passwords or online banking credentials
- Raw bank statement files — these are deleted immediately after parsing (within minutes of upload)
- Full card or payment account numbers — payment is handled by LHV Payment Gateway on their infrastructure
- Employee personal data (names, isikukood of employees) — only aggregate salary figures are used
- Raw IP addresses of email-list subscribers — only a one-way hash is stored, as an abuse trace
3. Data Processors (Third Parties)
We use the following third-party services to operate nosweat.finance. Each is a data processor under a Data Processing Agreement (DPA):
| Processor | Role | Location | What they receive | Safeguard |
|---|---|---|---|---|
| Supabase Inc. (via Supabase EU deployment) | Database, authentication, file storage | Stockholm, Sweden (eu-north-1) | All user and financial data | EU-based deployment; DPA under SCCs |
| Anthropic (Claude API) | AI transaction categorisation; tegevusaruanne text generation | United States | Anonymised data only — transaction amounts, dates, sanitised descriptions. Names, registry codes, isikukood, and counterparty identifiers are stripped before any data is sent (see § 4). | Standard Contractual Clauses (SCCs); no personal data transferred |
| LHV Payment Gateway (AS LHV Pank) | Payment processing | EU (Estonia) | Your payment method selection and payment confirmation; we share only the payment reference and amount | DPA; EU-based processing |
| SK ID Solutions | eID authentication (ID-kaart, Mobiil-ID, Smart-ID) | EU (Estonia) | Isikukood (during authentication only); we receive the authentication result (isikukood + name) | Contractual DPA; Estonian regulated service |
| Zone.ee | Application server hosting; email, including the cold-email mailboxes | EU (Estonia) | Application traffic; transactional email (payment confirmations, notifications); cold-email content and recipient addresses | DPA; EU-based processing |
| Cloudflare (Turnstile) | Bot protection on sign-up forms | EU (Cloudflare EU edge) | Form interaction signals (no personal identifiers sent) | Cloudflare Turnstile is privacy-preserving; no cookie or user profile created |
| Sentry | Error monitoring and crash reporting | EU (Frankfurt, Germany — de.sentry.io) | Sanitised error events; personal data (email, name, isikukood) is stripped before transmission by a server-side PII scrubber | EU-based ingest; DPA with Sentry Inc.; data processed in Germany |
| PostHog | Product analytics and session replay | EU (Frankfurt, Germany — eu.i.posthog.com) | Page views, feature usage events, session recordings. Session replay masks all financial fields and personal data fields. | EU-based ingest and storage; DPA with PostHog Inc. |
| CloudMailin | Inbound support email routing | EU (Ireland) | Content of emails sent to support@nosweat.finance (including sender email address and message content) | EU-based processing; DPA with CloudMailin |
| Meta Platforms Ireland Ltd (marketing consent only) | Conversion tracking (Meta Pixel + Conversions API) | EU (Ireland) | Event type, payment UUID, browser match keys — no name, email, or isikukood | DPA; SCCs for any onward US transfer; loaded only on marketing consent |
| Google Ireland Ltd (marketing consent only) | Conversion tracking (Google Ads tag) | EU (Ireland) | Event type, transaction ID — no personal identifiers | DPA; SCCs / DPF for any onward US transfer; loaded only on marketing consent |
Marketing recipients (consent-gated, Art. 6(1)(a)): When you give marketing consent, anonymised conversion data (event type, payment reference, browser identifiers _fbp/_fbc) is shared with the following recipients solely to measure the effectiveness of our advertising:
| Recipient | Role | Location | What they receive | Safeguard |
|---|---|---|---|---|
| Meta Platforms Ireland Ltd | Conversion tracking (Meta Pixel + Conversions API) | EU (Ireland) | Event type, payment UUID (dedup key), browser match keys (_fbp, _fbc), IP address, user-agent — no name, email, or isikukood | DPA; Meta's EU GDPR compliance; SCCs for any onward US transfer |
| Google Ireland Ltd | Conversion tracking (Google Ads tag) | EU (Ireland) | Event type, transaction ID for deduplication — no personal identifiers | DPA; Google's EU GDPR compliance; SCCs for any onward US transfer |
These transfers are made under Standard Contractual Clauses (SCCs, Commission Decision 2021/914) and, where applicable, the EU–US Data Privacy Framework (DPF). You can withdraw marketing consent at any time via the Küpsiste seaded link in the footer; withdrawal does not affect the lawfulness of processing before withdrawal.
We do not sell your data to any third party. We do not use our users' data for advertising without their explicit consent. For the data of cold-email recipients, see section 2.
4. Data Transfers Outside the EU
The only transfer outside the EU is to Anthropic (Claude API), and this transfer contains no personal data. Before any data is sent to the Claude API, all personal identifiers are replaced with generic placeholders:
- Company names →
[ETTEVÕTE] - Person names →
[ISIK] - Registry codes, isikukood → removed
- IBAN / account numbers →
[KONTO] - Counterparty names →
[PARTNER]
Only transaction amounts, dates, and sanitised descriptions are sent. This anonymisation is applied programmatically before every API call and is logged for audit purposes. The transfer is therefore not a transfer of personal data within the meaning of GDPR Chapter V, but we document it for transparency.
All other data remains within the EU at all times (Supabase Stockholm, Zone.ee Estonia, SK ID Solutions Estonia, LHV Payment Gateway Estonia).
5. Data Retention
| Data category | Retention period | Reason |
|---|---|---|
| Account profile (name, email, isikukood) | Until account deletion, then deleted within 30 days | No longer necessary after account closes |
| Financial transaction data, generated reports, balance sheet and income statement figures | 7 years from the end of the relevant financial year | Raamatupidamise seadus (RPS) § 12 — accounting records retention obligation; GDPR Art. 6(1)(c) legal obligation |
| Payment records | 7 years from transaction date | Accounting and tax record retention requirement |
| Raw uploaded bank statement files | Deleted immediately after parsing (within minutes) | Minimum data retention principle; only structured transaction data is kept |
| Authentication and security logs | 12 months | Security monitoring; limitation period for security incidents |
| Usage logs (non-financial) | 6 months | Debugging and service improvement |
| Email-list subscription (confirmed) | While you are subscribed, and after you unsubscribe as a closed record | We keep the closed record so we can show the unsubscribe was honoured; erased on request |
| Email-list subscription (never confirmed) | Becomes deletable 30 days after sign-up, removed at the next clean-up | Without a confirmation there is no consent to rely on |
| Email-list consent trail (asked / confirmed / unsubscribed timestamps, hashed IP) | As long as the subscription record it documents | Evidence that consent was given and honoured (GDPR Art. 7(1) accountability). What survives a deletion is a bare timestamp with no personal data in it |
| Global opt-out record (email address only) | Until you ask us to erase it (an address on the cold-email opt-out list is kept permanently, see below) | The only way to guarantee we never email an address again is to remember that we must not |
| Cold-email recipient data (address, company name, registry code, sending records) | 90 days after the campaign ends or, if the campaign keeps running, 90 days after the last email to you (or your reply, unsubscribe or a bounce) or, if we have not written to you, 90 days after your address was loaded into our database; then deleted | Running the campaign and handling replies; not needed afterwards |
| Address of someone who unsubscribed from cold emails or asked us by reply to stop, or whose mailbox permanently rejected an email (opt-out list) | Permanently, including after an erasure request | The only way to guarantee we never email the address again; obligation to honour an unsubscribe (ESS § 103¹(4)(5); GDPR Art. 17(3)(b)); for a rejected address, not sending to it again |
| One-way hash of an address loaded for a cold-email campaign, with the name and date of the first campaign that used it | Permanently | Ensures the same address is not sent a cold email a second time in a later campaign. The hash is written when the address is loaded; if the address is deleted before we ever wrote to it (see above), its hash is deleted with it. The hash is pseudonymised personal data, not anonymous data; the address itself, the company name and the registry code are not kept in it |
| Cold-email event statistics (sent, bounced, replied, clicked, unsubscribed) | Permanently | Monitoring campaign results and sending quality; after 90 days it is not linked to any person |
Note on the 7-year rule: RPS § 12 places the accounting record retention obligation on the company that prepares the accounts — i.e., your company, not nosweat.finance. We retain financial data for 7 years to enable you to access your prior-year data within the platform and to maintain the data integrity of the service. You are separately responsible for maintaining your own compliant archives (e.g., local copies of the XBRL file and PDF). Account deletion does not erase financial records within the 7-year window; they are anonymised (personal identifiers removed, company data retained) after account closure.
6. Your Rights
Under the GDPR, you have the following rights. To exercise any right, email support@nosweat.finance. We will respond within 30 days.
| Right | What it means |
|---|---|
| Access (Art. 15) | Receive a copy of all personal data we hold about you |
| Rectification (Art. 16) | Correct inaccurate personal data |
| Erasure / "right to be forgotten" (Art. 17) | Delete your personal data. Note: data subject to the 7-year accounting retention obligation cannot be erased during that period (Art. 17(3)(b)). An address on the cold-email opt-out list (section 5) nevertheless stays there, so that we never write to it again |
| Restriction (Art. 18) | Restrict processing of your data in certain circumstances |
| Portability (Art. 20) | Receive your data in a machine-readable format (JSON/CSV export available in /settings) |
| Objection (Art. 21) | Object to processing based on legitimate interests (Art. 6(1)(f)). We will stop unless we have compelling legitimate grounds. Objecting to direct marketing (cold emails) applies unconditionally: we stop writing immediately and never write to that address again |
| Withdrawal of consent | Where processing is based on consent, withdraw it at any time. This does not affect the lawfulness of processing prior to withdrawal. For email lists, the unsubscribe link in every email is a full withdrawal — one click, no login, no confirmation step — and the same link can remove you from every list at once |
| Automated decision-making (Art. 22) | The AI categorisation of transactions is a suggestion only — a human (you) makes the final decision on each categorisation. No automated decisions with legal effect are made |
7. Cookies
We use cookies and similar technologies on nosweat.finance. For a full list of cookies, their purpose, and how to manage your preferences, see our Cookie Policy (/et/kupsised).
In summary: strictly necessary cookies (authentication session, security tokens) are used without consent. Any non-essential cookies (analytics, if used) require your explicit consent, which is requested on your first visit via a cookie consent banner.
8. Children
The service is intended for adults (18+) who are management board members of Estonian companies. We do not knowingly collect data from persons under 18.
9. Changes to This Policy
We will notify registered users by email at least 14 days before material changes to this Privacy Policy take effect. The version date at the top of this page reflects the latest update.
10. Right to Lodge a Complaint
If you believe your personal data is processed unlawfully, you have the right to lodge a complaint with the Estonian Data Protection Authority (supervisory authority):
Andmekaitse Inspektsioon (AKI) Tatari 39, 10134 Tallinn E-mail: info@aki.ee Tel: +372 5620 2341 (Mon–Thu 13:00–16:00) Website: www.aki.ee
We encourage you to contact us first at support@nosweat.finance — most issues can be resolved directly.
11. Contact
For any questions about this Privacy Policy or to exercise your rights:
Nosweat Finance OÜ Kadaka pst 2-2, 10912 Tallinn, Estonia E-mail: support@nosweat.finance