Legal, Terms and Conditions

What this site knows about you, and what it does not.

The short version. The questionnaire stores your answers without your name, your email or your IP address. If you hand over an address, it is so we can write to you, and for nothing else. There are no trackers here, and the two cookies exist only after you have asked for something that needs them. One note is kept for the length of a visit so we can tell where people arrive from, and it goes when you close the tab.

Privacy

What the questionnaire stores

The review records the answers you choose: how you decide, the roles you picked, the seats you composed, and what you said about your week. It also records a random identifier for that visit and where the visit came from, which is a campaign tag if you arrived through one, or the name of the site that linked you.

It does not record your name, your email address or your IP address. Nothing in it points back at a person. That is deliberate and not an oversight: the questionnaire was built to tell us which kind of person shows up, which does not require knowing who they are.

What happens when you leave an address

There are four kinds of place: the interest list, the founding places, the box at the end of the review, and the form at the foot of each room on the roadmap. Every one of them stores the address, the language you were reading in, that visit identifier, and where the visit came from.

The room forms hold a little more, because they ask for a little more: which rooms you ticked, your name if you chose to give one, and your message if you wrote one. A message is kept exactly as you wrote it, and it is used to reply to you and for nothing else.

All of it exists so we can write to you about Finakets. That is the entire purpose. It is not sold, not rented, not handed to advertisers, and not used to find you anywhere else. You can be removed whenever you like, and you never have to give a reason.

The visit note, and what can link it to you

When a visit begins, your browser is handed a random string, and beside it we keep where the visit came from: a campaign tag if you arrived through one, or the name of the site that linked you. It sits in session storage rather than in a cookie, and it is gone the moment you close the tab. It is written on the first page you land on, because by the time you reach the questionnaire that origin has already disappeared from the address bar.

On its own it counts, and nothing more. It says how many people arrived from where, and how many of those got as far as answering. It holds no name and no address, it is never sent anywhere else, and it is never matched against anything outside this site.

It becomes something about you in one case only. If you leave an address, the same string is stored on that row, and that is what lets a set of answers and a person be recognised as the same visit. That link is the reason the questionnaire is worth running at all, so we would rather explain it here than bury it. If you would prefer it did not exist, write to the address at the foot of this page: the link goes and your address stays on its own.

On what basis any of this happens

Your address, and whatever came with it, is held because you gave it to us for that purpose. That is consent, and it is one email away from being withdrawn.

The questionnaire answers are held on our legitimate interest in knowing which kind of person turns up, which is a low bar to clear when the answers carry no name, no address and no IP. The short-lived server logs our host keeps rest on the same interest, for keeping the site up and turning abuse away. The two cookies are neither of those things: they exist because you pressed something, and what they store is a preference rather than a person.

Where the data actually sits

Two suppliers handle it and nobody else does. The database is Supabase, in their London region, run by Supabase Pte. Ltd of Singapore. The site is served by Vercel Inc., a US company, which keeps short-lived server logs that include IP addresses, as every web host does.

Both act only on our instructions, and neither is given this data for its own purposes. Because both are outside the European Union, each transfer rides on the standard contractual clauses the Commission publishes for exactly this, together with the United Kingdom addendum. In both cases those terms come with the service rather than being something we could forget to sign.

How long it is kept

An email address is kept until you ask for it to go, or until the list is plainly finished with, whichever comes first. Whatever came with it, a name, a message, the rooms you ticked, goes at the same moment and by the same act: the row is deleted, not flagged and kept.

Questionnaire answers are kept while they are still useful for deciding what to build. Because they carry no name, no address and no IP, keeping them longer does not quietly accumulate a picture of you.

What you can ask for

A copy of whatever is held about you. A correction, if something is wrong. Deletion. An objection to it being used at all. A portable copy you can take elsewhere. And you can withdraw your consent at any point, which stops things from then on rather than rewriting what was already lawful.

Write to the address below and you get an answer within thirty days, in practice much sooner. If you think it has been handled badly, you can complain to the data protection authority for the country you live in.

If this page changes

The date at the top moves with it. If a change affects what happens to an address already on the list, the people on that list hear it from us directly rather than discovering it in a quiet edit.


Cookies

What is kept on your device, and what would have to happen first for that to grow.

Two cookies, and neither exists until you press something that needs it. No analytics, no advertising pixel, no third-party script of any kind. The four categories below cover more than that on purpose: they are the ones a site like this ends up with, three of them are empty today, and naming them while they are empty is what lets you check in ten seconds whether that is still true.

CategoryWhat it meansOn this site today
Strictly necessaryThings the site cannot work without: holding a session together, stopping a form being sent twice, carrying a checkout from one page to the next. Nowhere in Europe do these need your permission, because refusing them would mean refusing the thing you asked for.None. Nothing here needs one yet.
PreferenceRemembering a choice you already made, so you are not asked again on the next page.Two, listed below. Each appears only when you press the thing that sets it.
AnalyticsCounting visits and reading what people do, so we know what to build and where readers come from.None. What measurement exists here is a note that lasts one visit, described below, and it never becomes a cookie.
AdvertisingRecognising you across other sites in order to show you something, almost always set by a third party rather than by us.None, and this is the one we would argue hardest about before ever changing.

The two that exist

Both are ours, both are set by this site alone, and both hold a choice rather than a person.

CookieWhat it doesHow longWhen it appears
finakets-themeRemembers light or dark1 yearOnly when you press the theme switch
NEXT_LOCALERemembers English or Italian1 yearOnly when you change the language

The one thing that is not a cookie

Your browser also holds the visit note described in the privacy half of this page: a random string and where the visit came from, kept in session storage and erased the moment you close the tab.

It is named here rather than left to the section above, because the rule that governs it is the same rule that governs cookies. What the law actually restricts is storing anything on your device, not cookies in particular, so a table of cookies alone would be a true list and an incomplete answer.

What happens the day this list grows

If analytics or advertising ever arrive, three things happen together and none of them quietly. Nothing in either category runs before you have agreed to it, which means the script is not loaded rather than loaded and well behaved. You get a real choice, where refusing is as easy as accepting and nothing is ticked on your behalf. And the table above names the thing before it is ever set, so you can come back to this page and see what changed instead of taking our word for it.

That is also the honest answer to why there is no consent banner today. A banner asking you to accept analytics we do not run would be a false statement on the page that tells you we do not track you. And it would save none of the work above: a consent notice that genuinely blocks something has to be built against the scripts it blocks, and there are none.

How to be rid of them

The two preference cookies have no settings panel, because they already have one. The theme switch and the language switch in the header are the controls that create them, and the only thing either holds is the answer you gave it.

Beyond that, your browser can block or delete cookies for this site or for every site, and clearing them here costs you a colour scheme and a language. The visit note needs no clearing at all: closing the tab is what removes it.


Getting in touch, or getting removed

One address for anything on this page: a question, a correction, a copy of what is held, or deletion. It is real, it is read, and every request that reaches it gets acted on. Deletion means the row is gone, not flagged and kept.

privacy@finakets.com