Privacy policy

Updated 3 October 2026

Who is responsible

Kutsio is run by Sävyö, a sole trader registered in Finland, business ID 3555540-1. Sävyö is the controller of the personal data Kutsio needs to run the service. Contact: hello@kutsio.com.

When you book an activity, its organizer receives your name, email and booking. The organizer is responsible for how they use them, for example to contact you about the activity.

What we collect

From participants:

your name and email, and the dates and spaces you book;
what you paid and any refund; card details go to Stripe, never to Kutsio;
cancellation requests, your messages in them and the organizer’s answers;
email codes, personal booking links and a random identifier of the browser you booked in, all stored as one-way hashes;
a one-way hash of your IP address, used to limit abuse.

From organizers:

your name, email and organization name;
the activities, sessions, prices and venues you publish;
the identifier and status of your Stripe account; Stripe keeps your identity and bank details.

Why we use it

To take and manage bookings, send codes, confirmations, reminders and cancellation notices, and process payments and refunds. This is needed to provide the service you ask for.
To keep Kutsio secure and prevent misuse. This is our legitimate interest.
To keep records of Kutsio’s fees as accounting law requires.

We don’t sell personal data, show ads or use it for marketing.

Who else handles it

The organizer of the activity you book, as described above.
Stripe processes payments. For payment data Stripe is a separate controller under its own privacy policy.
Supabase stores our database in the EU (Stockholm).
Vercel runs the website; the server runs in the EU (Stockholm).
Resend delivers our emails from servers in the EU (Ireland).
Digitransit, a Finnish public transport data service, suggests venues as an organizer types an address.
Emails to hello@kutsio.com are forwarded by ImprovMX to our mailbox.

Some of these providers are based in the United States. Where data leaves the EU, it is protected by the EU Standard Contractual Clauses or the EU–US Data Privacy Framework.

How long we keep it

Booking details, including names, emails and messages, are deleted 24 months after the booking’s last session.
Email codes are valid for 10 minutes. Personal booking links stop working 30 days after the booking’s last date.
Requests for a new booking link are deleted after a day.
Organizer accounts are kept until the organizer asks us to delete them.
Records of Kutsio’s fees are kept as long as Finnish accounting law requires.

Cookies

Kutsio uses only the cookies it needs to work, so there is nothing to accept:

a sign-in cookie for organizers;
a cookie that lets the browser you booked in open and manage your booking, kept for one year;
a cookie that opens a booking from your personal link in this browser.

There are no analytics or advertising cookies, and pages load no fonts or scripts from other companies.

Your rights

You can ask to see the personal data we hold about you, correct it, delete it, restrict its use, object to it or get it in a portable form. Write to hello@kutsio.com; we answer within a month.

If you think we handle your data wrongly, you can complain to the Office of the Data Protection Ombudsman in Finland (tietosuoja.fi).

Changes

When we change this policy, we update the date above. We tell organizers about significant changes by email.