Privacy policy

We may process the following personal data:

• Account data: email, name/display name, phone number, country and city.
• Role and company data: customer or company, company name, description and website.
• Publications: quote requests, service listings and uploaded images.
• Optional map location: address and coordinates (if the company enables the feature).
• Payment data: Stripe payment references and the billing address and any VAT number given at payment (card numbers are not stored).
• Messages and logs: messages between customers and companies and when they were sent, reports of inappropriate content, and technical logs (IP, browser).

We use personal data only to provide the Servicetavern.com service:

• Contract (GDPR Art. 6.1.b): identifying and managing the account, relaying and storing messages between customers and companies (neither side sees the other’s contact details), publishing service listings, and managing payments and access rights.
• Legal obligation (GDPR Art. 6.1.c): accounting and regulatory duties.
• Legitimate interests (GDPR Art. 6.1.f): security, operations, support, development of the Service, and handling voluntary reports of inappropriate content (abuse prevention).
• Consent (GDPR Art. 6.1.a): possible marketing communications (separate opt-in, withdrawable at any time).

We do not sell personal data. We disclose data to authorities only when legally required.

Account data is kept while the account is active and deleted or anonymised within a reasonable time after closure, unless law requires longer retention. Messages are kept until nobody has written in the conversation for 24 months or until either party deletes their account, and audit logs of earlier email relays for up to 24 months. Payment reference data is kept as required for accounting. Content reports and the record of how they were handled are kept for up to 24 months. Use of the launch offer is recorded as a code computed from the email address, so the offer is given only once even after an account is deleted; the code is kept for up to 24 months and does not contain the address itself.

You may request access, rectification, erasure, restriction of processing, data portability, and object to processing. You can download your data, update your details or delete your account while signed in via the portal. You may also exercise your rights or request erasure by emailing info@noxisfin.com. Marketing consent can be withdrawn at any time. You may lodge a complaint with the Finnish Data Protection Ombudsman (www.tietosuoja.fi) or with the data protection authority of the country where you live.

We use the following subprocessors to operate the Service: Supabase (database, authentication, images), Stripe (payments), Resend (email), Vercel (hosting) and Render (API). Addresses are geocoded with OpenStreetMap Nominatim where needed. We enter into data processing agreements (DPAs) with subprocessors. If data is transferred outside the EU/EEA, we use GDPR transfer mechanisms (e.g. SCCs).

We use necessary cookies/sessions for sign-in (Supabase Auth). Your browser also keeps the site's settings: the language you chose (for a year), the theme, and a country code derived from your IP address (for the session), which the front page uses to show listings from your country. We do not use marketing cookies without separate consent. We protect data with technical and organisational measures (access control, RLS, encrypted connections). Card data is not processed on Noxisfin Oy's servers.

Messages are stored in the Service so the parties can hold a conversation and so that abuse can be investigated. Noxisfin Oy does not routinely read messages; they are handled only when needed to investigate abuse, deal with a support request, or when the law requires it. We update this policy as needed. Material changes are announced in the Service or by email.

Noxisfin Oy

Business ID 3584061-6

VAT number FI35840616

Email: info@noxisfin.com.

Servicetavern.com service user register

Users registered for the Service are in Noxisfin Oy’s customer register. The data is used to deliver, maintain, and manage the Service. In delivering the Service, Noxisfin Oy may use third parties.

The register may contain the following data:

• User credentials and other authentication data
• Basic information of the data subject, such as display name, email, phone number, country and city
• Company user details such as company name, description, website, and contact details the company chooses to publish in a service listing
• Quote requests and service listings, including text and images uploaded by the user
• Payment references (Stripe identifiers) and the billing address and any VAT number; card numbers are not stored
• Messages (sender, recipient, time and content) and audit logs of earlier email relays
• Optional map location (address and coordinates) if the company enabled the map on a service listing

Information the user provides at registration and later, and payment reference data received from Stripe.

Processors (Supabase, Stripe, Resend, Vercel, Render, Nominatim where used) process data. Transfers outside the EU/EEA use GDPR mechanisms (e.g. SCCs).

Access is limited by personal credentials, role-based access, and database RLS. Card data is not stored in Noxisfin Oy's systems.

Rights of access, rectification, erasure, restriction, portability, and objection; withdraw marketing consent; complain to the Finnish Data Protection Ombudsman or the data protection authority of the country where you live. Contact: info@noxisfin.com.

You may update your details in the portal or request correction/erasure at info@noxisfin.com. Account deletion requests are handled within a reasonable time.