Privacy Policy
Last updated: August 2026
1. Data controller
The data controller for personal data processed through Satomaa is:
Muhammad Imran (Satomaa)
Finland
Satomaa is a hobby project. It is built and run by one person, not by a registered company. Nothing is charged to producers or consumers, no money passes through the platform, and it is not run for profit. That does not change your rights under GDPR, and it does not reduce the obligations described on this page. It is stated here so you know exactly who holds your data: one named individual, reachable at the address above.
2. What data we collect and why
Consumers (buyers)
| Data | Why |
|---|---|
| Name, email address | To create your order, send a confirmation email, and send a pickup reminder |
| Phone number | Optional. Shared with the producer so they can contact you about your order |
| Order history | To display your past orders in your account and to allow producers to fulfil your order correctly |
| Delivery address and city | Collected only when you choose home delivery (where a producer offers it), and shared with the producer so they can deliver your order. Not collected for pickup orders |
| Payment data | We do not process or store any payment data. Payments are made directly between you and the producer (via MobilePay or at pickup). Satomaa never sees card numbers, bank details, or payment credentials |
Producers (sellers)
| Data | Why |
|---|---|
| Name, email address | Account login and identification |
| Profile photo, bio, farm/business name | Displayed publicly on your producer profile and event pages to build consumer trust |
| Phone, website, Instagram | Optional. Displayed on your event page if you choose to share them |
| Certifications (e.g. organic, local) | Displayed as trust badges on your profile and events |
| Pickup address and instructions | Shown to consumers who have placed an order for your event |
| Product listings and sales data | To run your events and show you order summaries |
Community comments
Event pages include a public comment thread. If you post a comment, your display name and the text you write are shown publicly to anyone who views that event, so please do not include personal information you would not want to be public. You can delete your own comments at any time, and the event’s producer can remove comments on their own events.
3. Legal basis for processing
We process your personal data on the following legal grounds under GDPR Article 6:
- Contract performance — processing name, email, and order data to fulfil your order or run your producer account.
- Legitimate interest — operating a secure and functional marketplace, preventing fraud, and sending transactional emails (order confirmation, pickup reminder) that users reasonably expect.
- Legal obligation — retaining accounting records as required by Finnish bookkeeping law (Kirjanpitolaki 1336/1997).
- Consent — any optional marketing emails. You can withdraw consent at any time by emailing us.
4. How long we keep your data
| Data category | Retention |
|---|---|
| Account and profile data | Until you delete your account, then up to 12 months |
| Order records | 6 years from the end of the financial year, as required by Finnish bookkeeping law |
| Delivery addresses | Kept while a delivery order is active; removed from completed orders when you delete your account |
| Email communication logs | Up to 12 months |
5. Who we share your data with
We do not sell personal data. We share data only with the following service providers who process it on our behalf under GDPR-compliant data processing agreements:
Supabase
Database and user authentication · EU (AWS eu-west-1)
Resend
Transactional email (order confirmations, reminders) · EU data residency available
Vercel
Web hosting and infrastructure · EU region
Vercel Web Analytics
Aggregate page-view counts. Cookieless, no cross-site tracking · EU region
Between producers and consumers: When you place an order, your name, email, and optionally phone number are shared with the producer so they can fulfil your order. If you choose home delivery, your delivery address and city are shared with the producer as well. By ordering you consent to this sharing.
6. Cookies and tracking
Satomaa uses only the minimum cookies necessary to run the service:
- Session cookie — keeps you logged in while you use the site. Deleted when you log out or close your browser.
- CSRF protection cookie — protects against cross-site request forgery attacks. No personal data.
We do not use advertising cookies or tracking pixels, and we do not track you across other websites.
We do use Vercel Web Analytics to count page views, so we can see which parts of the site get used. It does not set cookies, does not store anything on your device, and does not build a profile of you or follow you to other sites. It records aggregate counts only.
7. Your rights
Under GDPR you have the right to:
- Access — request a copy of the personal data we hold about you.
- Rectification — ask us to correct inaccurate or incomplete data.
- Erasure — request deletion of your data, subject to legal retention obligations.
- Portability — receive your data in a structured, machine-readable format.
- Restriction — ask us to limit how we process your data in certain circumstances.
- Object — object to processing based on legitimate interest.
- Withdraw consent — if processing is based on consent (e.g. marketing), you can withdraw at any time.
To exercise any of these rights, email . We will respond within 30 days. We may ask you to verify your identity before processing your request.
Want something taken down?
Email the address above and it will be removed. Your account, your producer profile, a photo, a comment, a product listing, or anything else on the site that is about you. You do not need to give a reason, there is no form, and you will not be asked to justify it. The only things that stay are order records we are required to keep for accounting, and those are stripped of your personal details.
8. Data security
All data is transmitted over TLS-encrypted connections. Your data is stored in the EU. Only one person has access to it: the controller named in section 1. Service providers are required to apply appropriate security measures of their own.
9. Complaints
If you believe we are processing your data unlawfully, you have the right to lodge a complaint with the Finnish Data Protection Ombudsman:
10. Changes to this policy
We may update this policy from time to time. We will notify registered users by email of any significant changes before they take effect. The “last updated” date at the top of this page always reflects the current version.
This policy is published in Finnish and English. We keep both versions identical. If they ever differ, the Finnish version applies, because Satomaa operates in Finland under Finnish law.