Privacy Policy

Suomeksi

This policy explains how Elecz processes personal data. Elecz is a service operated by Sakari Korkia-Aho. It includes the elecz.com website, the electricity contract comparison, the Elecz REST API and the MCP server for AI assistants.

1. Controller

Sakari Korkia-Aho, Kokkola, Finland. Privacy contact: [email protected]

2. What we process and why

Website use. We use Cloudflare Web Analytics, which collects aggregated usage data such as the page viewed, referring page, browser type and country. It does not use cookies. We use it to understand how the site is used and to improve it.

Contract comparison. The details you enter in a comparison (such as postcode, housing type, annual consumption and main fuse size) are used to calculate prices and select suitable offers. We do not ask for your name, email address or other contact details in the comparison.

Comparison inputs and results are also stored in Supabase as a decision audit record. This can include postcode, annual consumption and calculation assumptions. These records support reproducibility and troubleshooting; the decision record has no separate name, email or IP-address fields. A comparison query supplied through the API can also be stored; do not include personal details in it.

Offer link clicks. When you leave a comparison for a supplier's site, we record the offer, supplier, market and time. We do not attach your IP address, browser details or cookies to these records. We use them to see which offers interest users and to reconcile partner reports.

API and MCP. When the Elecz API or MCP server is used, we store the function called, market, time and a truncated IP address. For MCP calls we also store the calling application's identifier (user agent). Errors are logged with similar details. IP addresses are truncated before storage, but truncated data is not considered fully anonymous. We use this data to keep the service running, prevent abuse and overload, troubleshoot and produce usage statistics.

Contacting us. If you email us, we process your name, email address and message to reply to you.

Server logs. Our infrastructure (Cloudflare and Render) records technical logs that may include IP address, time and requested URL. These are used for security and troubleshooting.

3. Legal basis

Processing is based on our legitimate interest in providing, securing and improving the service (Article 6(1)(f) GDPR). Replying to emails is also based on legitimate interest.

4. Affiliate partnerships

Some comparison links are affiliate links through networks such as Adtraction. When you click one, you pass through the network's tracking service to the supplier's site. The network and the supplier may set cookies and process data such as your IP address and click time, so that a resulting contract can be attributed to Elecz for commission.

Affiliate networks and suppliers act as independent controllers for this processing, under their own privacy policies (Adtraction's is available at adtraction.com). They report contracts made through partner links and the related commissions to Elecz.

5. Cookies and browser storage

Elecz.com does not itself set cookies or store data in your browser. Cloudflare may set strictly necessary security cookies, for example to detect bot traffic. Cookies from affiliate links are described in section 4.

6. Service providers and transfers

We use the following service providers. Their roles depend on the service used and its applicable terms:

Some providers are based in the United States or process data outside the EU/EEA. Such transfers rely on the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses.

We do not sell personal data. Affiliate-link tracking is described in section 4.

7. Retention

Individual REST call logs are retained for approximately seven days. Individual MCP, click and error logs are retained for approximately 90 days, with scheduled cleanup. Comparison inputs (including postcode, consumption and the original query), calculation assumptions, consumption-based costs and savings are cleared by scheduled processing after the 90-day retention period. Comparison records, offer rankings, recommendations and execution-route references remain for analysis without those inputs. We retain only a validated housing-type category and main-fuse category from the original assumptions. Identifiers and timestamps remain, so these records are not described as fully anonymous. Aggregated usage figures that cannot identify an individual user may be kept longer. Emails are kept as long as needed to handle the matter and meet accounting obligations. Providers' technical logs are kept under their own policies.

8. Your rights

You have the right to access, correct or delete your data, to restrict processing, and to object to processing based on legitimate interest. Send requests to [email protected].

We may not be able to link truncated IP addresses or click records to you, so we cannot always find data about you specifically.

You have the right to lodge a complaint with a supervisory authority. In Finland this is the Office of the Data Protection Ombudsman. You may also contact the authority in your own EU country.

9. Changes

We may update this policy as the service changes. The current version and its date are always on this page.