← Back | 🌍

Privacy & Cookies

Suomeksi

Last updated: 30.5.2026

1. Data Controller

Matkalle — travel planning service
Service available at selaa.fi/matkalle
Contact: matkalle@selaa.fi

2. What data we collect

At registration

Name — to personalise the service
Email address — for authentication and notifications
Date of birth — to verify age (trip creation requires ≥16 years)
Password — stored only as bcrypt hashes, never in plain text

During trip use

Trip data (title, dates, route points, countries)
Scheduled events (flights, accommodation, sights etc.)
Cost entries (price, currency, payer)
Uploaded images (compressed & stored on server)
IP address and last-seen timestamp (security)

Cookies and local storage

PHP session cookie (necessary) — maintains login for 30 days
localStorage: matkalle-theme — dark/light theme preference
localStorage: matkalle-cookie-consent — your cookie choice
localStorage: matkalle-view — last active view
localStorage: pwa-ios-hint — PWA install banner dismissal

We do not use third-party tracking or advertising cookies.

3. Purpose and legal basis

Contract (GDPR 6.1.b) — processing is necessary to provide the service
Legitimate interest (GDPR 6.1.f) — security and fraud prevention
Consent (GDPR 6.1.a) — marketing communications, only on request

4. Retention periods

        User account — retained until the user requests deletion
Trip data — retained until archived; archived trips can be deleted by admin
Email and log data — 90 days
PHP session — 30 days from last activity
Archived trips — automatically deleted 2 years after archiving

    

5. Third-party services

OpenStreetMap / Leaflet — map tiles (client-side, no personal data)
Overpass API — fuel station lookup (no personal data)
Open-Meteo — weather data for coordinates (no personal data)
Open Charge Map — EV charging points (no personal data)
MyMemory API — text translations (translated text is transmitted)
OSRM — route calculation (coordinates are transmitted)
api.qrserver.com — QR code generation (user code is transmitted)
SMTP server (Louhi) — sending invitation and verification emails
Affiliate partners (Booking.com, World Nomads, GetYourGuide, Rentalcars etc.) — linked external services governed by their own privacy policies. We do not automatically share personal data with them.

6. Your rights (GDPR)

Right to information — this policy covers the basis of processing
Right of access — contact us by email
Right to rectification — you can edit your profile data in the app
Right to erasure — send a request by email; we will delete all your data
Data portability — request your data in JSON format by email
Right to object — contact us to object to processing
Right to lodge a complaint — you may complain to the Finnish Data Protection Ombudsman (tietosuoja.fi)

Contact for exercising your rights: matkalle@selaa.fi

7. Security

Passwords are stored as strong one-way hashes — the plain-text password is never stored
Connection to the server is HTTPS-encrypted
Session files are stored in a protected server-side directory
IP addresses are used only for security, not profiling
Server configuration files are protected from external web access

8. Age limit

Creating a trip requires a minimum age of 16 (GDPR Article 8). Joining as a passenger is available at any age when invited by the trip creator.

9. Cookie management

You can delete cookies at any time from your browser settings. Deleting the necessary session cookie will log you out. You can reset your cookie preference by clicking the button below:

10. Changes to this policy

We may update this policy as the service evolves. Significant changes will be announced on the site or by email. By continuing to use the service, you accept the changes.