Skip to content
18+

Information only. Luvendo does not host gambling, sell lottery tickets or accept stakes. Results are shown for reference and may differ from official sources.

Live
FI EN
Sign in Sign up

Privacy Policy

A simple, human-readable privacy policy in line with Article 13 GDPR.

1. Data controller

Luvendo Media
Teikankaantie 330, 39530 Kilvakkala, Finland
Business ID: 9753186-2 · 03 4587656 · [email protected]

Privacy enquiries: [email protected] (subject "GDPR"). We respond within 30 days.

2. Personal data we process

  • Account data: name, email address, bcrypt password hash.
  • Subscription data: Premium plan type (monthly/yearly/one-off), subscription status, start and end dates, billing period dates.
  • Payment data: transaction ID from the payment provider, amount charged, payment method type and the last four card digits for receipts. We never process or store full card numbers, CVC codes or bank credentials — they go directly to the payment provider's secure environment (PCI DSS).
  • Billing data: receipt number, billing address (if provided), VAT number (business customers), VAT country.
  • Technical data: session ID, language cookie, cookie consent status and timestamp.
  • Logs: login time and IP address for security purposes (90 days).

We do not collect location data, profiling data, advertising tracking data or biometric data.

3. Purposes and legal bases (Art. 6 GDPR)

  • Contract (Art. 6(1)(b)): creating your account and signing in, delivering Premium, billing and handling cancellations.
  • Legal obligation (Art. 6(1)(c)): retaining accounting records under the Finnish Accounting Act (1336/1997) for 6 years from the end of the financial year, VAT obligations and other regulatory requirements.
  • Consent (Art. 6(1)(a)): sending the newsletter and marketing messages (withdraw any time); non-essential cookies.
  • Legitimate interest (Art. 6(1)(f)): service security, prevention of abuse and payment fraud, handling disputed charges — no profiling and no automated decisions.

4. Retention periods

  • Account data: for the lifetime of the account; at the latest 30 days after a deletion request.
  • Accounting records (receipts, invoices, transaction IDs): 6 years from the end of the financial year.
  • Basic subscription data: for the lifetime of the subscription + 12 months for disputed charges.
  • Login logs and IP addresses: 90 days.
  • Newsletter subscription: until you unsubscribe.
  • Cookies: see our Cookie Policy (max. 365 days).

5. Recipients and transfers

We do not sell or rent personal data. Data is never shared with third parties for marketing or analytics purposes.

We use the following data processors (Art. 28 GDPR):

  • Payment provider (EU) — payment processing, card charges and receipts.
  • Hosting provider (EU/EEA) — servers and data centre services.
  • Email delivery service (EU) — transactional and receipt emails.

A data processing agreement (DPA) under Art. 28 GDPR is in place with every processor. An up-to-date list is available on request at [email protected].

6. Your rights (Art. 15–22 GDPR)

  • Right of access to your data (Art. 15).
  • Right to rectification (Art. 16).
  • Right to erasure / to be forgotten (Art. 17).
  • Right to restriction of processing (Art. 18).
  • Right to data portability (Art. 20) — you receive your account data in JSON format.
  • Right to object (Art. 21), in particular to direct marketing.
  • Right to withdraw consent (Art. 7(3)) at any time.
  • Right to lodge a complaint with the Office of the Data Protection Ombudsman.

To exercise your rights: [email protected]. We verify your identity and respond without undue delay, at the latest within 30 days.

7. Consequences of not providing data

A name and email address are required to create an account. A Premium subscription additionally requires a valid payment method, entered directly with the payment provider. Without these we cannot provide Premium features or the newsletter. Public content (results, archive, history) is available without an account.

8. Automated decision-making and profiling

We do not make automated decisions that have legal or similarly significant effects on users (Art. 22). We do not profile users.

9. Security

Passwords are stored only as bcrypt hashes. Traffic is protected with TLS. Accounts are locked after repeated failed login attempts.

10. Changes to this policy

We update this policy when necessary. We notify registered users of material changes by email or with an on-site notice at least 14 days in advance.

Last updated 21 October 2026