Privacy

Last updated 28 October 2026. Terms version 2026-10-28.3.

In short: we only hold your email address, which pack you bought, when you opened it and any reminder dates you choose to enter. We never ask about your case and you never send us documents. We delete your email and dates 30 days after your reminder period ends.

1. Who is responsible

Cifas Appeal is a name used by Elbek, a Finnish sole trader. Business ID 3570992-5 (Finnish Trade Register). Address: Myllyväenkatu 10 D 3, 00920 Helsinki, Finland. Phone +358 40 757 0116. Email [email protected]. We are the controller for the data described here. Stripe processes your card details at checkout. We never see or store your card number.

2. What we hold and why

Your email address, your billing country, your order reference, the pack you bought and the payment amount, from the Stripe checkout. The billing country is also our VAT record of where you live. We use them to send your pack link and your reminders, and to answer you. Legal basis: performing our contract with you.
Reminder dates you choose to enter (for example the day you sent a complaint) and the kind of step each date is for. We use them only to send your reminder emails. Legal basis: performing our contract with you. Do not enter anything else about your case: there is no field for it.
When you opened your pack and how often. To answer payment disputes and support questions. Legal basis: our legitimate interest in showing that we delivered.
Emails you send us and our replies. Kept in our admin so whoever answers can see the earlier messages. Only the two people who run Cifas Appeal can read them, each with their own login. Legal basis: our legitimate interest in answering you, and performing our contract with you.
Page view counts per page and day, with no IP address, no cookies and nothing that identifies you.

We do not use cookies or advertising trackers. Stripe's checkout page sets its own cookies for security and fraud prevention.

3. Who we share it with

Stripe (Ireland and USA), our payment provider, for payments, refunds and fraud checks. Stripe is also a controller for some payment data, under its own privacy policy.
Resend (USA), which sends our emails and receives the emails you send to [email protected]. It acts on our instructions under a data processing agreement with standard contractual clauses.
Google (Gmail), where the owner receives a copy of order notices and of emails you send us. There is no separate data processing agreement for this personal account.

Our server runs on our own hardware in Finland. We never sell your data.

4. How long we keep it

Your email address, reminder dates, our emails with you and your pack link are deleted 30 days after your reminder period ends (12 months after purchase for the Full pack, 24 months for the Complete pack), or sooner if you ask. If you write to us without buying, we delete the emails 12 months after the last one. We keep a record of the sale with no contact details for our accounts, as Finnish law requires.

5. Your rights

You can ask for a copy of your data, ask us to correct or delete it, object to our use of it, or ask us to stop reminders. Write to [email protected]. You can also complain to the Information Commissioner's Office in the UK (ico.org.uk) or the Data Protection Ombudsman in Finland (tietosuoja.fi).