Privacy policy
Updated 9 October 2026
Controller
Nevaberry Oy is the controller for its own customer and website processing described here. Our company identifier and contact details appear below. Send privacy requests to the same email address. We do not sell personal data or use it for third-party advertising.
Messages and newsletter
The contact form processes your email address, message and other information you provide. We use it to respond, take pre-contractual steps you request and retain necessary customer correspondence. Depending on the matter, the basis is preparing a contract or our legitimate interest in handling enquiries.
Joining the Lab Notes newsletter stores your email address with Resend on the basis of consent. Unsubscribe using the email link or by contacting us. An unsubscribe record may be retained to respect your choice.
Payments and accounting
For agreed payments we process necessary names, email addresses, business, invoice and payment details, and the invoice number or reference. The payment provider may collect additional payment and fraud-prevention information. Card details are entered with Stripe; nevaberry.com does not store full card numbers or security codes.
For Bitcoin payments, our BTCPay Server processes the payment request, amount, exchange rate, identifiers, network addresses, transaction status and information entered in its form. Bitcoin addresses and transactions are recorded on a public blockchain and cannot be removed from its history.
The legal bases are performing the contract, complying with accounting and other legal obligations, and our legitimate interest in reconciling payments and preventing abuse. Accounting documents are handled in Odoo and our protected document archive.
Technical information and browser storage
Hosting and security services process technical request and log information such as IP addresses, browser details, requested URLs and timestamps. Vercel Web Analytics and Speed Insights provide traffic and performance statistics. Cloudflare Turnstile processes security signals on protected forms to prevent spam and automated abuse. Our basis is a legitimate interest in operating a secure, functional website.
The NEVABERRY_LOCALE cookie stores your selected language for up to a year. Theme and build-version preferences may be kept in local storage, and sidebar state in session storage. Remove them in your browser settings. Vercel describes its analytics processing in its own privacy information.
The site has no customer accounts or passwords. Payment links take you to the payment service's own page, where that service provides separate information about its processing and cookies.
Providers and transfers
Vercel provides hosting and analytics. Resend delivers contact-form emails and manages newsletter contacts. Cloudflare protects forms. We use Forward Email to receive, store and send email. Stripe processes payments made through it. BTCPay Server and Odoo are self-hosted services.
The Thunderbird email client stores copies of messages on our workstations.
Data is disclosed as necessary for these purposes, legal obligations and, where needed, handling legal claims. International providers may process data outside the EEA. Transfers use the provider's applicable safeguards, such as an adequacy decision or EU standard contractual clauses. Contact us for information about the applicable safeguards.
Retention
Correspondence is retained as needed to handle the matter, maintain necessary customer records and address potential claims. Newsletter details remain for the subscription period; an unsubscribe record may remain afterwards.
Invoices, payment receipts and other transaction evidence are kept for at least six years from the end of the year in which the financial year ended. Accounting records and financial statements are kept for at least ten years from the financial year end. Law or an ongoing matter may require longer retention. Records subject to mandatory retention are not removed solely because of an erasure request.
Retention of technical logs, security information and statistics depends on their purpose and the provider settings in use. Browser preferences remain until expiry, session end or removal by you.
Rights and security
Subject to applicable law, you may request access, correction, erasure, restriction or portability, and object to processing based on legitimate interests. You may withdraw consent without affecting the lawfulness of earlier processing. Send requests to the contact below. You may also complain to the Finnish Data Protection Ombudsman.
We use access controls and technical safeguards. No online service can guarantee absolute security. Nevaberry does not use this information to make solely automated decisions with legal or similarly significant effects on you. Payment providers describe their own processing in their privacy information.