Privacy Policy

Provider

Selvia, a private trader (sole trader) (yksityinen elinkeinonharjoittaja)

Business ID

3554334-7

Domicile

Helsinki, Finland

Address

Konalantie 7, 00370 Helsinki, Finland

Email

support@selvia.fi

Selvia is the controller of the personal data described in this policy.

Where Selvia processes personal data contained in your business's own accounting or professional-service material — for example your customers' or suppliers' names on your invoices, or information in documents you give us for a professional-service engagement — Selvia processes that data as a processor, on your instructions, under the Data Processing Agreement.

For any question about this policy or your personal data, email support@selvia.fi.

• The selvia.fi website, including the contact form and the account deletion request form.
• Selvia Accounting — the mobile app and the back office the Selvia team uses to provide it.
• Selvia POS at pos.selvia.fi.
• Selvia’s professional services: Accounting & Tax, Financial Advisory, Business Services and Immigration Services.
• Your communication with Selvia by email and in the app’s Support Inbox.

Your business’s own accounting material can contain personal data about other people — for example the names of your customers or suppliers on invoices and receipts. Your business is responsible for that data in its own accounting; Selvia processes it to provide the service to you.

Selvia’s services are offered to businesses and to people setting up a business in Finland, not to the general consumer public, and only to people old enough to hold the agreement in their own name or their business’s name (18 or older). This policy describes the personal data Selvia processes in that context.

Account and profile

Name, email address, phone number, address, business name, Business ID and the bank account details shown on your invoices. If the service requires your personal identity number, it is stored encrypted.

Sign-in

The email address and password of your Selvia account. Passwords are handled by our authentication service and Selvia does not store them in readable form. If you use app lock, the fingerprint or face check happens on your device and Selvia does not receive it.

Accounting material

Receipts and their images, expenses, uploaded income statements, sales invoices and their PDFs, your customers’ details on those invoices, bank statements and transactions you upload, VAT periods and returns, ledger entries and reports.

Text read from documents

When you scan a receipt or upload an income statement, the text and figures read from it, kept as evidence of what the document said.

Subscription and billing

Your package, your subscription requests and their status, and the invoices Selvia sends you.

Support

Messages and attachments you send in the in-app Support Inbox, emails you send us, and messages you send us by WhatsApp.

Notifications

Device tokens used to deliver push notifications, the notifications themselves and your notification settings.

Technical and security data

Crash reports from the mobile app (with your account’s internal ID, the app version and device details), records of changes made to accounting data, and service logs kept by our hosting providers.

Website contact form

The topic, your name, email address and message, and the IP address and time of sending, which are included in the email the form sends to Selvia.

Account deletion requests

The email address, name and optional business name and Business ID you enter, and a keyed hash of your IP address used only to limit repeated requests. The IP address itself is not stored.

Professional services

The information and documents you give us for the agreed work — for example company and ownership details for a registration, or the identity, travel document and other details a residence-permit application requires.

Payroll service

If your business uses Selvia’s payroll service, the employee and payroll information you submit through Selvia’s payroll data-collection form. Selvia receives this by email and keeps a backup copy in Selvia’s paid business Google Workspace account — not a personal Google account.

Immigration-service documents

For an Immigration Services engagement, the identity, application and supporting documents you provide, stored in Selvia’s paid business Google Workspace account (Google Drive) — not a personal Google account.

Selvia POS

The user accounts of a venue’s staff — name, email address, role and time of last sign-in — and the venue’s sales, refund and stock records.

Providing the software and services you use or have agreed with us — your account, the work itself, support and messages about the service

Performance of a contract (GDPR Article 6(1)(b))

Preparing and filing the returns and reports you have asked Selvia to handle

Performance of a contract

Invoicing subscriptions and keeping Selvia’s own accounting

Legal obligation (Article 6(1)(c)) and performance of a contract

Keeping accounting material and its audit trail for as long as accounting and tax law requires, also after an account is deleted

Legal obligation, and our legitimate interest in being able to show what was recorded and filed (Article 6(1)(f))

Keeping the services secure, preventing misuse and fixing errors (crash reports, logs, limits on repeated requests)

Legitimate interests

Answering messages sent through the website

Legitimate interests, or steps taken at your request before entering into a contract

Handling account deletion and other data protection requests

Legal obligation

Some professional-service work — particularly a residence-permit or other immigration application — involves identity and application documents. Most of this, including nationality, passport details and residence status, is ordinary personal data, not a special category of data under GDPR Article 9. We ask only for what the specific application genuinely requires.

Occasionally, a document you choose to give us as evidence for a specific application may itself contain genuinely special-category data under Article 9 — for example a medical certificate a particular permit type requires, or evidence of a religious ceremony for a family-reunification application. Selvia does not ask for this as a matter of course. Where it is genuinely unavoidable for a specific application, Selvia asks for your separate, explicit consent to hold and use that specific document for that purpose, before accepting it as part of the engagement.

We do not sell personal data and we do not use it for advertising. Selvia does not make decisions based solely on automated processing that have legal or similarly significant effects on you: features that read documents suggest values for a person to check.

• From you, and from people you authorise to act for your business.
• From the documents you upload or send us.
• From your use of the services, and from the Selvia team’s work when it provides a service to you.
• From public registers, such as the Business Information System (YTJ), when business details are checked.

We share personal data only as far as it is needed to provide the services. These service providers process it for Selvia:

Supabase

Database, sign-in and file storage for Selvia Accounting and Selvia’s back office, and database and sign-in for Selvia POS. The Selvia Accounting database is located in the EU (Ireland); the Selvia POS database is located in the EU (Sweden).

Vercel

Hosting of selvia.fi and of the server functions the app and the back office use.

Google Cloud (Document AI)

Reading text from receipts and income statements you upload.

Google Firebase

Delivering push notifications (Firebase Cloud Messaging) and, as the primary backend, crash reports from the mobile app on a phone or tablet (Crashlytics).

Sentry

A fallback crash-diagnostic backend for the mobile app, used only on a session where Firebase itself fails to start, and the backend used for a browser-based build of the app. Never active at the same time as Firebase Crashlytics.

Google Workspace

Selvia’s paid business email and file-storage environment, used to receive and keep a backup of payroll information submitted through Selvia’s payroll data-collection form, and to store documents provided for an Immigration Services engagement.

Resend

Sending email from Selvia’s services — for example invoices you send to your customers, and messages from the website contact form.

See the Subprocessor List for more detail on each provider’s role, including the safeguard that applies where it is based outside the EU/EEA.

Personal data is also disclosed to the Finnish Tax Administration and other authorities when we file or submit something you have asked us to, or when the law requires it. Apple and Google distribute the mobile app under their own terms and privacy policies.

If you contact Selvia by WhatsApp, that conversation is handled through the WhatsApp app itself, the same as any other message or call to Selvia. We have no automated system that receives WhatsApp message data, and WhatsApp/Meta does not process Selvia’s service data on our behalf.

Some of the providers above are based in the United States or may process data outside the EU and the European Economic Area — the Subprocessor List states this where currently known. When personal data is transferred outside the EEA, the transfer relies on a safeguard the GDPR allows, such as an adequacy decision of the European Commission (including the EU–US Data Privacy Framework for certified companies) or the Commission’s standard contractual clauses.

You can ask us for more information about these safeguards at support@selvia.fi.

We keep personal data only as long as it is needed for the purposes above, or as long as the law requires.

• Accounting material and its audit trail are kept for the periods Finnish accounting and tax legislation requires. The period depends on the type of record, so it is not the same for every document. This material is kept even if an account is deleted.
• Profile and sign-in data are kept while your account exists. When the account is deleted, they are erased or anonymised as described on the account deletion page.
• Support messages: the text you wrote is removed when your account is deleted. The conversation record, and attachments that are accounting evidence, are kept with the accounting material.
• Push notification tokens, notifications and notification settings are deleted when your account is deleted.
• Messages sent through the website contact form are kept in Selvia’s email for as long as they are needed to handle the enquiry and any customer relationship that follows.
• Payroll information is kept for as long as needed to run your business’s payroll and to meet the retention periods Finnish accounting, tax and employment law set for payroll and payment records. The email copy and the backup kept in Selvia’s Google Workspace account are kept only for as long as that purpose requires, not indefinitely.
• Documents provided for an Immigration Services engagement are kept in Selvia’s Google Workspace account for as long as the engagement requires and for the period needed to show what was done for you, then deleted.
• Account deletion requests are kept as a record of the request and of how it was handled.
• Crash reports are kept for the period set in the crash-reporting service in use for that report.

Access to data is limited by account, role and database access rules; connections are encrypted; and changes to accounting data leave an audit trail. No online service can promise absolute security. The Security & Data page describes the measures in more detail.

Under the GDPR you have the right to:

• get access to your personal data and a copy of it;
• have inaccurate data corrected;
• have your data erased, where the law does not require us to keep it;
• restrict processing in certain situations;
• object to processing that is based on our legitimate interests;
• receive data you have given us in a machine-readable format, where processing is based on a contract or consent and is automated;
• withdraw consent at any time, where processing is based on consent.

To use your rights, email support@selvia.fi. We may need to verify your identity first. We respond without undue delay and within one month; if a request is complex, the GDPR allows the time to be extended, and we will tell you if that happens.

If you think your data is processed unlawfully, you can lodge a complaint with the Office of the Data Protection Ombudsman in Finland: tietosuoja.fi.

You can delete your Selvia account in the Selvia app, or request deletion on our account deletion page if you cannot use the app. Deletion erases or anonymises your profile, sign-in details, devices, notifications and the text of your support messages.

Deleting an account does not erase accounting and tax records that the law requires to be kept — such as invoices, receipts, VAT records and ledger entries. They are kept for the required period, are no longer linked to your personal profile, and stay under the same protection. For a sole trader, business details on those records may still identify you.

The public selvia.fi website does not use analytics, advertising or tracking cookies, and does not set cookies for visitors. That is why it shows no cookie banner.

The Selvia mobile app stores your sign-in session and settings on your device so that the app works. Selvia’s staff back office uses cookies that are needed for staff sign-in.

If we add optional analytics or marketing technologies to the website in the future, we will ask for your consent before using them and update this policy.

Selvia’s services are intended for businesses and for people 18 or older acting for their own or a business’s purposes. They are not directed at children, and Selvia does not knowingly process personal data about a child.

We update this policy when our services or the law change. The date at the top shows the latest version. If a change is significant, we also tell customers about it in the app or by email.

Questions about privacy or your personal data: support@selvia.fi.