Privacy

Privacy policy

Updated 14 November 2026. Information provided under Articles 13 and 14 of the EU General Data Protection Regulation (2016/679).

This is a translation. In case of conflict, the Finnish version prevails.

1. Controller and contact details

Alpha Consulting Oy (business ID 3323077-7), Urpukuja 3 A3, 30420 Forssa, Finland. The name of the service is Acosolutions (acosolutions.fi). Privacy matters: privacy@acosolutions.fi. We have not appointed a data protection officer, as the GDPR does not require one for us.

2. Whose data we process and in what role

• As controller, we process the account data of the service's users, sign-in and access rights data, the account and billing messages we send, quote and order requests, and billing data. They are described in this policy.
• As processor, we process data that the customer company stores in reports and registers (for example names, contact details and qualification cards of employees and subcontractors, signatures, report entries, supervisors and the notifications and reminders sent for sites). The controller of that data is the company of the account, and the processing is governed by the data processing agreement in the terms of use. We do not use the content of reports for our own purposes. If your data has been stored in a contractor's report or register, please contact that company first.

3. What data we process and on what basis

Data	Purpose	Legal basis
Email address, name, phone number, job title, language	Account, sign-in, showing your name as author and to your team, language of messages	Contract (6(1)(b))
Sign-in method and Google or Microsoft user identifier (if you use them)	Sign-in	Contract (6(1)(b))
Account memberships, invitations, roles and site-specific permissions	Managing access rights	Contract (6(1)(b))
Sign-in account of a subcontractor or supervisor (email, name)	Access to the My sites page	Legitimate interest (6(1)(f)): giving contractors and their partners a shared channel for defects and site diaries without the subcontractor or supervisor needing a company account of their own.
Quote and order requests: company, contact person, email, phone, billing details, message	Preparing an offer, activating the order and contacting you	Steps prior to entering a contract, and contract (6(1)(b))
Billing data: company name, business ID or VAT ID, billing address, billing email, subscription status	Billing of the Pro subscription and bookkeeping	Contract and legal obligation (6(1)(b), (c))
Technical data: IP address and browser data in requests to the service	Delivering the service and security	Legitimate interest (6(1)(f)): protecting the service and users' data against attacks and misuse.

The email addresses of subcontractors and supervisors are stored by the contractor, who is the controller of that data (section 2). Card payment data is processed by the payment service Stripe. We neither see nor store card numbers.

An email address is required for an account and sign-in, and billing data for a Pro subscription. Other data is voluntary. We do not make automated decisions or carry out profiling (Article 22).

4. Where the data comes from

The data comes from you, from the sign-in service (Google or Microsoft) if you use it, and from the company of the account that has added you to its team, subcontractor register or as a site supervisor.

5. Data stored in the browser and cookies

We only use cookies that are strictly necessary for the service to work. No advertising, tracking or analytics cookies are used. Strictly necessary cookies do not require consent (Finnish Act on Electronic Communications Services 917/2014, section 205).

Name	Purpose	Duration
aco_istunto	Identifier of a signed-in session (the server stores only a hash of it)	Until the browser is closed (at most one day on the server), or 60 days if you choose "Stay signed in"
aco_oauth_google, aco_oauth_microsoft	Protection of Google or Microsoft sign-in	10 minutes
aco_linkki	Linking a Microsoft account after email verification	15 minutes

In addition, the browser's local storage (localStorage) holds form drafts, the theme setting, the selected site, additional message languages, export settings, recently used places and email addresses and suggestions, and the session storage (sessionStorage) holds the return address during sign-in. They stay on your device and are not sent to us. You can remove them by clearing the site data in your browser. Our network provider Cloudflare may set a strictly necessary security cookie (for example __cf_bm) to detect bot traffic.

6. How long data is kept

• Account data: until the account is deleted. We delete the account and its data from the production database within 30 days of a request, and it is purged from recovery backups no later than 30 days after that. In other companies' reports, the author's name remains as part of their document.
• Sign-in codes: as a hash, valid for 10 minutes; expired codes are deleted daily.
• Sessions: one day, or 60 days if you choose "Stay signed in"; signing out ends the session immediately, and expired sessions are deleted daily.
• Open team invitations: 90 days.
• Quote and order requests: 2 years unless they lead to a customer relationship; during a customer relationship, for the term of the contract.
• Billing data: under the Finnish Accounting Act (1336/1997, chapter 2, section 10), vouchers for at least six years from the end of the calendar year in which the financial year ended, and financial statements and ledgers for at least 10 years from the end of the financial year.
• IP addresses: we do not store them in our own database. Cloudflare processes them briefly to deliver and protect the service.

7. To whom data is disclosed

We do not sell data or disclose it for marketing. The following service providers process data on our behalf:

Recipient	Task	Location and transfer basis
Cloudflare, Inc.	Server, database and email forwarding	Database in the EU (Cloudflare's EU jurisdiction: data is stored and processed only in the EU); global network. Transfers to the United States: EU–US Data Privacy Framework and EU Standard Contractual Clauses
Resend (Plus Five Five, Inc.)	Sending sign-in codes, notifications and reminders	United States: EU–US Data Privacy Framework and EU Standard Contractual Clauses
Stripe Payments Europe, Ltd.	Card payments and subscription billing	Ireland (EU); data is also transferred to the United States (EU–US Data Privacy Framework and Standard Contractual Clauses). For payments, Stripe is partly an independent controller (e.g. fraud prevention).
Microsoft Ireland Operations Ltd	Email for enquiries, quote requests and privacy requests (Microsoft 365)	EU; support functions in the United States: EU–US Data Privacy Framework and Standard Contractual Clauses
Google and Microsoft	Sign-in, if you choose it	Independent controllers for their own services

You can get a copy of the safeguards for transfers (Standard Contractual Clauses) from privacy@acosolutions.fi.

Weather lookup: when you press the weather button in the site diary, your browser fetches the data directly from the open interface of the Finnish Meteorological Institute. At the same time, the place name or approximate location, the date and your IP address are passed to the Finnish Meteorological Institute. The lookup is made only when you press the button.

We may disclose data to authorities if required by law.

8. Data security

• The connection to the service is encrypted (HTTPS).
• Every database query is limited to the company of the account, so no other company can see a company's data.
• There are no passwords. Sign-in codes and session identifiers are stored only as hashes.
• Only the administrators have access to production data, and only for the needs of maintaining the service.

9. Your rights

You have the right to:

• know what data is processed about you and receive a copy of it
• have inaccurate data corrected (you can correct your own details under Account → Settings)
• request erasure of your data or restriction of processing
• transfer your data to another system (you can export reports yourself from the archive in JSON, Excel, CSV and PDF format).

Right to object: you may at any time object, on grounds relating to your particular situation, to processing based on legitimate interest (Article 21).

Send your request to privacy@acosolutions.fi from the email address you use the service with. We respond within one month; for complex requests the period may be extended by up to two months, and we will let you know.

If you believe your data is processed unlawfully, you may lodge a complaint with the supervisory authority: Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto), P.O. Box 800, 00531 Helsinki, Finland, tel. +358 29 566 6700, tietosuoja.fi.

10. Changes

We update this policy when the service or the processing changes. We announce material changes in the service or by email.