Privacy notice
Version 2026-09-13
Service provider and data controller
Fizzical Assets Oy
Business ID: 3604826-8
PL 2, 36201 Kangasala
Customer service and privacy requests: myynti@miikathemachine.fi
1. Information and purposes
We process your email, profile, preferences, roles, login and membership information; answers, attachments, feedback, assessment history, video progress and points; Stripe customer/subscription references and billing events; and necessary technical/security logs. We retain a copy of the accepted terms and request for immediate service commencement, with the acceptance time. Subscription confirmations include the content, recipient and delivery status. Withdrawal records include your notice, acknowledgment and handling notes. Data comes from you, your use and the payment provider. Providing the account, learning and membership relies on contract; statutory payment/accounting duties, confirmations and withdrawal handling on law; proportionate security, reliability and handling contractual claims on legitimate interests. Optional usage analytics and performance measurement rely on consent. Separate marketing consent, if requested, is optional and withdrawable.
2. AI and teacher access
OpenAI receives the task question, rubric, your answer and relevant video summary/keywords, or the full transcript when the teacher explicitly selects it. Evidence tasks may include an attachment. Assessment affects educational progress and points. Teachers can inspect activity, answers, feedback and failures. You can request human review. AI assessment does not decide payment or other legal rights.
3. Providers and transfers
We use Supabase for authentication and the database, Vercel for hosting and consent-based usage analytics and performance measurement, Mux for videos, OpenAI for AI assessment, Stripe for payments, and Resend for login and subscription messages. Each provider receives data needed for its task. Processing may take place outside the EEA, including in the United States. Resend stores email content and delivery logs in the US even when the sending region is in Europe. Supabase's and Vercel's data processing terms include European Commission Standard Contractual Clauses for EEA transfers. OpenAI's transfers of EEA data rely on these clauses or a Commission adequacy decision. Mux and Stripe use the EU–US Data Privacy Framework where applicable, with Standard Contractual Clauses as the alternative mechanism specified in their terms. Resend uses Standard Contractual Clauses and the Data Privacy Framework as an additional mechanism. Processing is therefore not confined to Finland or the EEA. The providers' public data processing terms describe these safeguards and their subprocessors. Contact myynti@miikathemachine.fi for further information or a copy of applicable transfer safeguards.
4. Retention and deletion requests
Retention is assessed by the purpose of the data and whether it is still needed to provide the service, meet a legal obligation or handle an unresolved matter. Account and learning data support continued account use, learning, assessment corrections and support requests. Retention of task attachments is assessed against the assessment and related review needs. Payment, contract, acceptance and withdrawal records are assessed against applicable accounting and other statutory obligations and the handling of contractual claims. Log retention depends on investigating security incidents or faults. Backup retention takes account of recovery needs and the provider's applicable backup arrangements. Ending membership or removing the app does not close the account or erase learning history. Request account closure or deletion at myynti@miikathemachine.fi. Support handles the request and assesses which categories can be deleted and which must still be retained. Submitting a request does not automatically erase all data immediately.
5. Cookies and device storage
Essential session data supports login. The app also stores view caches, installation state and unfinished answers on your device. Logout clears private app caches and drafts; it does not erase learning history on the server. Optional Vercel usage analytics and performance measurement start only with consent. We measure page visits, free-start and subscription journey events, and load speed. Answers, conversations and contact details are not included in analytics event properties. Query parameters and specific content identifiers are removed from page URLs sent to analytics. No advertising pixels are used. Choose essential functions only or change your choice in Cookie and analytics settings in the footer or app settings. Withdrawing consent stops new optional measurement data from being sent. Your choice is stored in the browser; if storage is blocked, it applies in the current view.
6. Your rights
Contact the controller to request access, correction, deletion, restriction, applicable portability, or to object to processing based on legitimate interests. Consent can be withdrawn without affecting earlier lawful processing. Identity is checked before disclosure. You may complain to the Finnish Data Protection Ombudsman at tietosuoja.fi.