PRIVACY POLICY

1. Data Controller

This Privacy Policy explains how personal data is collected, processed, and protected when you visit pirkkaraisanen.com, subscribe to the newsletter, or purchase digital products.

• Data Controller: Pirkka Räisänen
• Address: Helsinki, Finland
• Contact Email:pirkka@pirkkaraisanen.comCopied!

2. Hosting, Media & Analytics

This website uses select infrastructure providers (acting as Data Processors) to deliver content securely:

• Netlify (Hosting & Server Logs): When you access this site, Netlify automatically processes standard server access logs (including your IP address) solely to maintain the security, stability, and technical performance of the site. These logs are retained on Netlify's secure servers for up to 30 days before being automatically deleted.
• Netlify Web Analytics: If enabled on our host, we use Netlify Web Analytics, a privacy-friendly, server-side tool. It analyzes aggregated, non-identifiable data from server logs to track general page views.No tracking cookies are placed on your device, and no cross-site tracking is performed.
• Cloudflare R2 (Audio Hosting): We host our custom audio files on Cloudflare. When you initiate playback, your browser connects to Cloudflare, which processes your IP address strictly for content delivery and security. Our custom audio player does not set tracking cookies or advertising pixels.
• Asset CDNs: We use Google Fonts and unpkg (for icons) to load design assets. These third-party services may receive your IP address when delivering these files to your browser.
• International Data Transfer: Infrastructure providers process data on servers located in the United States. These transfers are legally safeguarded by their active certifications under the EU-U.S. Data Privacy Framework (DPF) and their executed Data Processing Agreements (DPAs).

3. Email Newsletter & Subscriptions (beehiiv)

When you opt-in to our newsletter via a subscribe form on this site, your data is processed by beehiiv, Inc., our email marketing platform (acting as a Data Processor).

• Data Collected: We collect your email address and, optionally, your first name.
• Purpose of Collection: We use your email address to deliver our regular newsletter, which covers music production, app development, on-device AI, and builder mindset lessons, as well as occasional updates about new tools or digital products.
• Email Analytics & Tracking: beehiiv emails may contain standard industry web beacons or tracking pixels to measure campaign metrics (such as email open rates and link clicks).
• International Data Transfer: Subscriber data collected via beehiiv is transferred to and processed on servers in the United States. This transfer complies with GDPR through beehiiv's adherence to the EU-U.S. Data Privacy Framework (DPF) and the implementation of Standard Contractual Clauses (SCCs).

4. Legal Basis for Processing (GDPR)

Under the EU General Data Protection Regulation (GDPR), we process your personal data under the following legal grounds:

• Consent (Article 6(1)(a) GDPR): Processing your email address for our newsletter is based on your explicit, affirmative consent provided at the time of subscription. Furthermore, where required by applicable ePrivacy laws, we rely on your consent to load non-essential tracking scripts (such as pre-subscription referral attribution) and third-party media embeds. You may withdraw your consent at any time.
• Performance of a Contract (Article 6(1)(b) GDPR): When you purchase digital products via Gumroad, data processing is necessary to fulfill our contractual obligation to process your payment and deliver the product to you.
• Legitimate Interest (Article 6(1)(f) GDPR): Processing IP addresses in Netlify's server logs is based on our legitimate interest in ensuring site security and cyber defense. Direct streaming to Cloudflare R2 relies on the legitimate interest in delivering the media content you explicitly requested.

5. Data Retention & Subscription Management

We retain personal data only for as long as necessary to fulfill the purposes outlined in this policy:

• Newsletter Data: We retain your subscriber information only for as long as you remain an active subscriber. Every email sent via beehiiv includes a clear, automated Unsubscribe link. If you unsubscribe, your personal data is removed from our active mailing lists.
• Commerce Data (Gumroad): Information related to financial transactions is retained in accordance with Finnish statutory accounting and tax laws (typically up to 6 years).
• Server Logs: Technical access logs handled by our hosting provider are automatically deleted after 30 days.

6. Your Rights Under GDPR

Under Articles 15–21 of the GDPR, you have the following rights regarding your personal data:

• Right to Access & Portability: Request confirmation and a copy of the personal data we hold about you, provided in a readable digital format.
• Right to Rectification: Request correction of inaccurate or incomplete personal data.
• Right to Erasure ("Right to be Forgotten"): Request the complete deletion of your personal data.
• Right to Restriction & Objection: Request we limit how your data is processed, or object to processing based on Legitimate Interest.
• Right to Withdraw Consent: Withdraw your marketing or tracking consent at any time.

To exercise any of these rights, contactpirkka@pirkkaraisanen.comCopied!. You also have the right to lodge a complaint with the Finnish Data Protection Authority (Tietosuojavaltuutetun toimisto).

7. External Links, Embeds, and Commerce

We use select third-party services to deliver rich media and handle purchases. These platforms operate under their own privacy policies and may use cookies or track your interaction:

• Gumroad: We use Gumroad to process transactions and deliver digital downloads. The Gumroad commerce script loads across various pages on the site to enable seamless checkout overlays, and securely handles all payment and account information according to their privacy policy.
• Newsletter Scripts (beehiiv): Beyond just collecting your email, our site loads beehiiv attribution and form scripts to display the subscription widgets properly and track referral metrics. These scripts operate under beehiiv's privacy policy and may track referrals prior to subscription.
• Media Embeds: We embed players from Spotify (specifically on product pages like Songen), YouTube, and Instagram. Loading pages with these embeds may allow those platforms to collect data or set third-party cookies. Our custom Cloudflare R2 audio player is completely separate from those embeds and does not use that class of tracking.
• External Links: We link to platforms like the Apple App Store and GitHub. We are not responsible for the privacy practices of these external sites once you leave our domain.

8. Children's Privacy

This website, our applications, and our digital products are not directed at or intended for use by children under the age of 16. We do not knowingly collect personal data from children.

9. Updates to This Policy

We may update this Privacy Policy periodically to reflect changes in legal requirements or our service setup. The "Last Updated" date at the top indicates when the latest revision took effect.