Privacy statement
This is a machine translation. If it differs from the Finnish version, the Finnish text prevails.
This statement explains what personal data Kinky Art Café processes, why, and how we protect it.
1. Controller
Your personal data is the responsibility of Susa Tyrniluoto / Namu Amore (Business ID 1943569-6). Contact in privacy matters: security -at- kinkyartcafe.com.
2. What data we process and on what basis
| Data | Purpose | Legal basis |
|---|---|---|
| Email, password (never stored in readable form at all), optional alternative email, email verification status | Account creation, login and account recovery | Contract |
| Display name, profile picture, account type | Your profile and use of the service | Contract |
| Session data (session identifier hashed, expires in 30 days) | Staying logged in, and security | Contract and legitimate interest |
| IP addresses | Preventing abuse and harassment, service security | Legitimate interest |
| Activity log (actions taken, moderation entries) | Accountability of moderation, and security | Legitimate interest and legal obligation |
| Community application (application text) | Access control in the early phase of the service | Contract and legitimate interest |
| Posts, uploaded images (location data, i.e. EXIF, is removed during image processing), comments (encrypted) | Sharing content within the community | Contract |
| Relationships, follows, events and notifications | The social features of the service | Contract |
Legal bases under the GDPR: contract (providing the service to you), legitimate interest (community safety and abuse prevention), legal obligation (e.g. moderation and record-keeping required by the Digital Services Act), and consent where it is separately requested.
3. Special categories of personal data
Because Kinky Art Café is a meeting place for the spectrum of sex-gender and sexuality, your participation alone may reveal, for example, your sexual orientation — the GDPR protects such data with particular care (special categories of personal data, Art. 9). We process this data only because you yourself have chosen to share it on a service created for this purpose, and we protect it with special care. You can delete the content you have shared, or your entire account, at any time.
4. Where the data comes from
Almost all data comes directly from you: when you create an account, fill in your profile, apply to the community or publish content. Some data is generated technically in the course of using the service (for example session data and IP addresses). We do not buy personal data from outside parties.
5. To whom data is disclosed
We do not sell your data, nor disclose it to outside parties for their own purposes. To deliver the service, however, data is processed by carefully selected sub-processors (sub-handlers) on our behalf and in accordance with our instructions:
| Operator | Task | Location |
|---|---|---|
| UpCloud | Server space, database and file storage | Finland |
| Hanko | User authentication (sign-in and email address verification) | Germany |
| Scaleway | Emails sent by the service (e.g. verification and notification messages) | France |
| OpenCage | Place-name search, when you use location search | United Kingdom |
| Adobe | Displaying web fonts | United States |
User authentication is handled by Hanko, a German company. Hanko has accepted Kinky Art Café into its startup programme, through which the authentication service is available to us free of charge.
We disclose data to authorities only where required by law.
6. Where data is stored
Your data is stored primarily on servers located in Finland. For the sake of service speed, data may also be stored elsewhere, but server space is purchased only from European service providers.
Some functional services (displaying web fonts and place-name search) operate outside the EU. Only limited information is transmitted to these — not your stored content. For the United Kingdom, the data transfer relies on the EU adequacy decision.
7. How long we retain data
We retain data only for as long as is necessary for each purpose:
- Sessions: at most 30 days.
- Account and profile: until you delete your account.
- After account deletion: we delete your data. However, if an open disturbance report has been made about you, or an active restriction concerns you, we retain only the necessary data for a reasonable time in order to investigate the matter (GDPR Art. 17(3)).
- Statutory retention periods (for example accounting) are observed when such an obligation arises.
8. How we protect your data
We protect your data by both technical and organisational means. The connection to the service is encrypted, and private messages are stored encrypted. Passwords are never stored in any form that could be read or recovered — not even by the administration. Processing rights are restricted only to those that running the service strictly requires.
9. Your rights
You have the rights under the GDPR concerning your own data. You may:
- see what data is processed about you,
- rectify incorrect data,
- erase your account and be forgotten (subject to the exceptions described above),
- restrict or object to processing,
- transfer the data you have provided to another service, and
- withdraw your consent where processing is based on consent.
You can exercise your rights by contacting us: security -at- kinkyartcafe.com. We will reply to you as a human to a human, and as soon as possible.
10. Right to lodge a complaint
If you feel that we are not processing your data appropriately, you have the right to lodge a complaint with a supervisory authority. In Finland this is the Office of the Data Protection Ombudsman (tietosuoja.fi). We hope, however, that you will first contact us — most matters are resolved through discussion.
11. Cookies
We use only cookies that are strictly necessary for the operation of the service (for example to maintain the login session). We do not use tracking or advertising cookies, nor do we track your activity on other sites.
12. Automated decision-making
We do not make significant decisions about you based solely on automated processing. Moderation decisions are made by a human.
13. Changes to this statement
We update this statement as the service develops. We will announce significant changes on the service. You can always find the current version of this statement here.