Privacy Policy

Last updated 9 October 2026.

(Suomeksi: Tietosuojaseloste)

This Privacy Policy explains how Clouden Oy collects and uses personal data when you use our websites and services. It also explains the choices you have and the rights you have under the EU General Data Protection Regulation (GDPR).

1. Who We Are and What This Policy Covers

The controller of your personal data is:

Clouden Oy (business ID 2760188-5)
Kotikaivontie 2E, 00700 Helsinki, Finland
info@clouden.net

Please contact us at info@clouden.net about anything related to privacy, including requests to use your rights.

This policy applies to our websites, such as clouden.net, webcat.fi and tuntikirjaus.fi, and to the services described in our Terms of Service, such as WebCat and Tuntikirjaus.

When we act on a business customer’s behalf. A business customer may use our services to process personal data of other people. For example, a company may record its employees’ working hours in Tuntikirjaus, or add its own customers’ contact details.

• In that case, the business customer is the controller of that data, and we process it on their behalf under our Data Processing Agreement.
• If you are an employee or a customer of such a business, please contact that business first. It decides how your data is used.
• This policy still applies to the data we process for our own purposes, such as account data and billing.

2. Information We Collect

Information you give us

• Account information. Your email address and password when you sign up. Passwords are handled by Amazon Cognito. You may add more details, such as your name, phone number and address, but we don’t require them.
• Billing information. If you buy something, you give us billing details: name, address, and for businesses also the business ID and VAT number. Stripe processes your payment card details on our behalf.
• Your Content. Everything you put into our services, as described in section 3.
• Communications. When you contact us by email or otherwise, we keep a copy of the conversation to handle your request.

Information we collect automatically

• Log information. Our servers record technical information about requests, such as the IP address, browser type, the date and time, and the address requested. We use it to run and protect our services and to investigate errors.
• Usage information. We record what happens in your account, such as purchases, changes to settings, and the history of a domain or an entry, so that the services work and you can see what has been done.
• Website analytics. If you allow analytics cookies, we use Google Analytics to understand how our websites are used. Some of our websites also use our own cookieless analytics, which records the pages visited and the referring page with a random session identifier. It drops the IP address after looking up the visitor’s country. See section 9.
• Advertising measurement. If you allow analytics cookies, some of our services use Google Ads to measure which advertisements lead to a sign-up or a purchase. When one happens, the service tells Google, and may include the purchase’s identifier, amount and currency. It does not send your name, email address or account details.

Information we get from others

• Payment providers. Stripe tells us whether a payment succeeded, and gives us the details we need for receipts and accounting.
• Domain registries and registrars. Domain registries and registrars tell us the status of your domains.
• Integrations you connect. If you connect another service, such as GitHub in Tuntikirjaus, we receive the information described in section 3.
• Other people in your organization. If someone invites you to an organization in one of our services, we receive your email address from them.

3. Information Specific to Each Service

WebCat

• Domain contact information. WebCat stores the contact information of domain registrants and other domain contacts:

  • name, organization, email address, phone number and postal address;
  • for a private person’s .fi domain, the personal identity code (henkilötunnus) or date of birth that the .fi registry requires;
  • for an organization, its business ID.

  We send this information to the domain’s registry and to the registrar that we use, because registering a domain is not possible without it.

• Domains, DNS records and orders. WebCat stores your domains, DNS zones and records, monitoring targets, orders, baskets and the history of changes. A DNS zone is published technical information, which the DNS distributes worldwide by design, so please don’t put personal data into your records.

• Hosting and server features. WebCat’s hosting and server features run on Cloudora, our own platform. When you use them, Cloudora stores the websites, files and settings you put there, and receives your user identifier and email address to know whose they are.

• Merchandise orders. When you order merchandise, WebCat stores the order and the recipient’s name, company, shipping address, email address and phone number. We send them to Printful, which prints the product and ships it to you, and which may use the email address and phone number to deliver it.

• AI name suggestions. WebCat stores the description you type to get suggestions for domain names. We send it to an AI model in Amazon Bedrock in the EU to generate suggestions.

Tuntikirjaus

• Organizations and members. Tuntikirjaus stores:
  • the name of each organization, and the email addresses and roles of its members and invited members;
  • the organization’s billing details if it provides them: name, business ID, VAT number, address, contact details and bank account.
• Work data. It stores customers (name, business ID, VAT number, address and contact email), projects, categories, billing rates, hour entries and their descriptions, invoices, and flex hour balances.
• AI assistant. When you use the assistant, it stores your messages and its answers.
  • We process them using Amazon Bedrock in the EU, and we don’t use them to train AI models.
  • If the assistant creates an entry for you, the message that asked for it is saved with the entry.
• API keys. Tuntikirjaus stores API keys and their descriptions.
• GitHub integration. If your organization connects GitHub, Tuntikirjaus stores the connected GitHub account and repositories, and the GitHub usernames of members. It also stores information about pushed commits: the commit identifier, message, link, and the author’s GitHub username and email address.
• Imports and exports. Tuntikirjaus stores the files you upload for import, and the export files you create.

4. How and Why We Use Information

We don’t make decisions based solely on automated processing that would have legal or similarly significant effects on you.

Providing the information marked as required is necessary for the contract. Without it, we can’t provide the service.

5. Sharing Information

We share personal data only in the following situations:

• Service providers (sub-processors). We use providers that process data on our behalf, such as Amazon Web Services for hosting and Stripe for payments. Our list of sub-processors shows each one, what it does, and where it processes the data. Each of them is bound by an agreement that requires it to protect the data.
• Domain registries and registrars. When you register a domain, we share the registrant’s information with the domain’s registry (such as Traficom for .fi domains) and our registrar (such as Enom). They process it as controllers under their own rules, and may publish some of it in public directories.
• People you work with. In Tuntikirjaus, the owner, administrators and members of an organization see the organization’s data according to their roles. If you send an invoice to a customer, your customer sees the information on it.
• Legal requirements. We may disclose information when the law requires it, for example to comply with a court order or a lawful request from an authority. We may also disclose it when it is necessary to protect the rights, property or safety of Clouden, our users or others.
• Business transfers. If Clouden or one of our services is sold or merged with another company, personal data may be transferred to the new owner, who must keep following this policy.
• With your consent. We share information in other ways when you ask us to.

6. Transfers Outside the EU

We store our services’ data in the European Union, mainly in the Amazon Web Services region in Ireland.

Some data is processed outside the EU or the European Economic Area (EEA):

• Content delivery. Amazon CloudFront delivers our websites through a worldwide network of edge locations, and some security and certificate services run in the United States.
• Payments. Stripe may process payment data in the United States.
• Analytics and advertising. Google Analytics data and Google Ads conversion data are collected only with your consent and processed in the United States.
• Internal notifications. We use Slack, based in the United States, for internal notifications about events in our services, such as errors and new customers.
• GitHub. The GitHub integration exchanges data with GitHub, based in the United States.
• Domain registrars. Registrars of domains other than .fi are in the United States or Canada.
• Merchandise. Printful, which produces and ships WebCat merchandise, is based in the United States, and it may produce your order in one of its facilities inside or outside the EU.
• Backup copies. Some WebCat billing records are copied to an AWS region in the United States as a backup.

When personal data is transferred outside the EEA, we make sure it is protected:

• by the European Commission’s adequacy decision, such as the EU–US Data Privacy Framework for certified companies;
• by the Commission’s standard contractual clauses; or
• when registering a domain with a registrar outside the EEA, because the transfer is necessary to carry out your order (GDPR article 49).

7. How Long We Keep Information

We keep personal data only as long as we need it for the purposes described in this policy, or as long as the law requires.

Where a service has organizations, everything a member creates in an organization belongs to that organization, and is kept as long as the organization keeps it, even after the member has left the organization or deleted their account.

8. Security

The security measures we apply are described in our Data Processing Agreement.

9. Cookies and Similar Technologies

A cookie is a small piece of information that a website stores in your browser. Websites can also use the browser’s local storage for the same purpose. We use both, in the ways listed below.

Strictly necessary. These are needed for the services to work, so they don’t require your consent:

• Sign-in tokens. Amazon Cognito stores these in local storage while you are signed in to one of our services.
• Your preferences. We store your language and your choice about cookies in local storage. On clouden.net we also store your color theme if you choose light or dark.
• Payments. Our services load Stripe’s payment script, which sets cookies to process payments and prevent fraud.

Analytics, only with your consent:

• Google Analytics. Its cookies are set only if you choose “I accept” in the cookie banner. They measure how our websites are used.
• Google Ads. In services that use it, its cookie is set only if you choose “I accept”. It connects a sign-up or purchase you complete to the advertisement you arrived from, so that we can measure which advertisements work.
• If you decline. If you choose “Only essential cookies”, Google Analytics and Google Ads aren’t loaded and receive nothing from your visit.

Our own analytics. Our own cookieless analytics, used on some of our websites, stores nothing in your browser.

Changing your choice. You can change your choice at any time by clearing your browser’s storage for the site, which brings the cookie banner back. Most browsers also let you block or delete cookies, but some features may not work without them.

10. Your Rights

Under the GDPR, you have the right to:

• access the personal data we hold about you, and get a copy of it;
• rectify data that is inaccurate or incomplete;
• erase your data, for example by deleting your account, unless we must keep it by law;
• restrict the processing of your data in certain situations;
• object to processing that is based on our legitimate interest, including direct marketing;
• receive your data in a portable format, which in Tuntikirjaus you can also do yourself with the export feature; and
• withdraw your consent at any time, where processing is based on consent. Withdrawing doesn’t affect the lawfulness of the processing before it.

To use your rights, contact us at info@clouden.net. We may need to verify your identity first. We will respond within one month.

If your data is in an organization of a business customer, as described in section 1, we will forward your request to that customer.

Complaints. If you believe that we process your personal data unlawfully, you have the right to lodge a complaint with a supervisory authority. In Finland it is the Office of the Data Protection Ombudsman (tietosuojavaltuutettu).

11. Children

Our services are not directed to children. You must be at least 16 years old to use them, and we don’t knowingly collect personal data from younger children.

12. Changes to This Policy

We update this policy when our services or the law change. We publish the new version on this page and update the date at the top. If a change materially affects how we use your personal data, we will also tell you by email or in the service.

Attribution and License

This Privacy Policy is adapted from the Automattic Privacy Policy, which Automattic licenses under CC BY-SA 4.0. This policy is likewise available under CC BY-SA 4.0.