Privacy Policy

Last updated: 8 November 2026

This privacy policy explains how personal data is processed in Sykki Finance, the budgeting, cash-flow forecasting and scenario planning service of Sykki ry (the "Service"), including its web application, REST API and Model Context Protocol (MCP) interface for AI assistants.

1. Controller and contact

Sykki ry, Business ID 0291305-7, Finland.
Privacy contact: privacy@sykki.fi

2. Whose data we process

The Service is used by club officials, staff and other persons to whom Sykki ry has granted an account. The budgets and forecasts stored in the Service concern the association's finances, not individual people. We process personal data only as needed to provide user accounts, sign-in and access control.

3. Personal data we process

• Account data: name, email address, user role and access permissions, account status and creation date.
• Sign-in data:
  • Password: stored only as a one-way Argon2 hash. Nobody, including administrators, can see your password.
  • Passkeys: the credential identifier, public key, signature counter and the device name you choose. Your private key never leaves your device.
  • Google sign-in: your Google account identifier and email address. At sign-in, Google also tells us your name and whether your email address is verified; we use these only for that sign-in and do not store them. We never receive your Google password and do not store Google access tokens.
• Access tokens: personal access tokens and the tokens issued to AI assistants you connect, stored only as hashes, together with their name, creation time, last use, expiry and scope. For connected applications we store the application name and redirect addresses it registered.
• Audit log: which user (name and email address at the time) changed what and when, through which channel (web application, personal access token or AI assistant connector), and the previous and new values of the changed fields. It covers financial figures, cost drivers, plan versions, master data (accounts, teams, locations, dimensions) and user accounts and permissions. Passwords, password hashes, tokens and keys are never recorded; a password change is logged only as an event.
• Security events: sign-ins, failed sign-in attempts, sign-outs, password changes, added or removed passkeys, personal access tokens and Google links, and approvals of AI assistant connectors, with the IP address they came from. For a failed sign-in to an email address that has no account, the typed address is not stored.
• Session and security data: session cookies and short-lived sign-in challenges (see section 6).
• Technical log data: IP address, date and time, requested address, response status and browser information, recorded by the server when the Service is used.

4. Purposes and legal bases

• Providing the Service and managing access: creating and maintaining user accounts, signing users in and enforcing which plan versions and teams each user can view or edit. Legal basis: Sykki ry's legitimate interest in running its financial planning securely and in enabling its officials to carry out their duties (GDPR Art. 6(1)(f)).
• Security and preventing misuse: protecting accounts, detecting and investigating unauthorized access and incidents. Legal basis: legitimate interest (Art. 6(1)(f)).
• Accountability: keeping an audit log of who changed financial plans, master data and user accounts, so that changes can be traced and errors corrected. Legal basis: legitimate interest (Art. 6(1)(f)).
• Legal obligations: where the law requires us to process or disclose data (Art. 6(1)(c)).

We do not use personal data for marketing, we do not sell it, and we do not make automated decisions or profiles that have legal or similarly significant effects on you.

5. Where the data comes from

Your name and email address are entered by a Sykki ry administrator when your account is created, or by you. Sign-in data comes from you and, if you choose Google sign-in, from Google. Technical and change-history data is generated when you use the Service.

6. Cookies

The Service uses only cookies that are strictly necessary for it to work. It uses no analytics, advertising or tracking cookies.

7. Recipients and third parties

• Hosting provider: the Service runs on a server in Finland operated by a hosting provider acting on our behalf.
• Google: if you choose Google sign-in, Google processes your sign-in under Google's Privacy Policy.
• AI assistants you connect: if you connect an AI assistant (for example Claude, ChatGPT or Gemini) to the Service, it can read and, if you allow it, change data within your own permissions. The data it retrieves is then processed by that provider under its own terms and privacy policy. We share data with AI providers only when you connect one, and you can revoke the connection at any time.
• Authorities: when required by law.

8. Transfers outside the EU/EEA

We store the Service's data on a server in Finland, and the Service's pages, fonts and scripts are served only from that server. Google and the AI assistant providers described above may process data outside the EU/EEA, for example in the United States, under their own safeguards such as the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.

9. How long we keep data

• Account and sign-in data: as long as you need access to the Service. When your role ends, your account is deactivated, and it is deleted on request or once it is no longer needed.
• Access tokens: AI assistant access tokens expire after one hour and their refresh tokens after 30 days without use; personal access tokens remain valid until you revoke them.
• Sign-in challenges and temporary cookies: minutes (see section 6).
• Technical logs: at most 3 months.
• Audit log: as long as the related financial planning records and master data are kept.
• Security events (including IP addresses): 12 months, after which they are deleted automatically.

10. Security

Connections to the Service are encrypted (HTTPS). Passwords and tokens are stored only as hashes, access to data is limited by per-version and per-team permissions, and changing your password or signing out ends your other sessions.

11. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you,
• have inaccurate data corrected,
• have your data erased,
• restrict processing,
• object to processing based on our legitimate interest,
• receive your data in a commonly used format where the right to data portability applies.

To use your rights, contact privacy@sykki.fi. We will respond within one month. If you think we process your data unlawfully, you can lodge a complaint with the Office of the Data Protection Ombudsman (tietosuoja.fi).

12. Changes to this policy

We may update this policy. The date at the top shows when it last changed. We will tell users about significant changes in the Service or by email.