Privacy
This notice describes what data The Agentic Foresight Registry (the "Registry") processes, what it deliberately does not collect, who receives data, and how a data subject exercises their rights under the General Data Protection Regulation.
The short version, stated plainly: the Registry does not collect a visitor identifier of any kind, does not set cookies, and does not store the task description submitted with an order. The personal data involved in a purchase — the buyer's email address and payment details — is collected and held by Stripe, the payment processor, not by the Registry.
Controller
The controller is the operator of the Registry: a private trader established in Finland.
Controller: Simo Parviainen, a private individual established in Finland, at Katajanokanranta 17, 00160 Helsinki, Finland.
Data-protection enquiries are sent to hi@polkuopas.fi, the address listed at /contact.
What is processed
1. The engagement log
The Registry keeps a log of requests to the site. Each row records
three things: a timestamp rounded to the hour, a normalized route
pattern such as /pricing.json or /c/{token},
and a class marker distinguishing machine-readable endpoints from
everything else. Rows created by the Registry's own test runs carry
an origin marker so they are never mistaken for real traffic.
The engagement log contains no IP address, no user agent, no cookie, no browser storage value, no fingerprint, no session identifier, and no hash of any of them — not even transiently. A hash of an IP address is a pseudonym under the GDPR, not an anonymisation, which is why none is created at any point. A row in this log describes an event. It does not describe a person, and it cannot be linked back to one.
There is no client-side analytics of any kind on this site: no third-party script, no tag manager, no pixel, no beacon.
2. Purchase data
The buyer's email address and payment details are collected and stored by Stripe, which processes the payment on the Registry's behalf. Checkout takes place on Stripe's hosted page, and the Registry's own pages never load a Stripe script or receive payment-card data.
What the Registry stores for a completed purchase is an order reference from the payment platform and the certificate parameters submitted with the order: the model name, the training cutoff, the temperature value, the task class, any tool names, the purchased tier, and the computed certificate content. These are self-declared product facts about a model configuration. The Registry's certificate records contain no name, no email address, and no payment information.
3. The task description
The free-text task description submitted with an order is hashed with SHA-256 and the original text is discarded immediately. It is never stored: it does not appear in the database, in server logs, in an error message, in the certificate, or in any response the Registry returns. Only the resulting digest is used, and a digest of free text cannot be reversed into the text.
Summary of this section
Three categories, three treatments: the engagement log holds no personal data at all, purchase-related personal data sits with Stripe, and the task description is destroyed on arrival.
What is never collected
- ❌ No cookies. The site sets none, of any kind, for any purpose.
- ❌ No browser storage. No localStorage, no sessionStorage, no IndexedDB.
- ❌ No IP addresses or user agents in any stored record, and no hash of either.
- ❌ No fingerprinting and no device or browser characteristics.
- ❌ No third-party scripts and no client-side analytics.
- ❌ No accounts, logins, or profiles. There is nothing to register for.
No cookie banner appears on this site because there are no cookies to consent to. Consent is required for storing or accessing information on a user's device; the Registry does neither, so the question does not arise.
Legal bases and retention
Purchase records are processed to perform the contract of sale (Article 6(1)(b) GDPR) and to meet accounting and tax obligations (Article 6(1)(c) GDPR). Finnish accounting law requires retention of the relevant records for the statutory period.
Certificate records are retained indefinitely, because a certificate is a permanent, immutable record by design. A certificate record contains no visitor identifier and nothing the buyer wrote about themselves: the task description is hashed and discarded, and no name, address or payment detail is stored. It does carry one field that reaches a person indirectly — the payment platform's order reference. On its own that reference identifies nobody, but the Registry can use it to look up the purchase in its own payment account, so it is treated as pseudonymous personal data rather than described as anonymous. It is not published: the public registry shows the certificate number, issue time, tier and declared parameters, never the order reference.
The engagement log is retained indefinitely and published in aggregate at /engagements. It contains no personal data.
Processors and recipients
The Registry uses the following service providers. No data is sold, rented, or shared for advertising, and there is no advertising network on this site.
| Recipient | Role | Data involved | Location |
|---|---|---|---|
| Stripe | Payment processing and checkout | Buyer email address, payment-card details, transaction records | Collected and stored by Stripe under its own privacy notice |
| Vercel | Website hosting and request serving | Requests to the site, handled in transit | Hosting infrastructure |
| Supabase | Database | Certificates and the engagement log | European Union (eu-central-1) |
| PostHog | Server-side aggregate product events | Event counts carrying no visitor identifier | European Union |
The Registry's database is hosted on Supabase in the European Union (eu-central-1). PostHog receives server-side aggregate events only; those events carry no visitor-derived identifier, so nothing sent to PostHog identifies a person. Stripe's own processing of buyer data is governed by Stripe's privacy notice.
Data-protection rights
Under the GDPR a data subject has the right to access their personal data, to have inaccurate data corrected, to have data erased, to restrict or object to processing, and to receive their data in a portable form.
In practice these rights mostly concern purchase data held by Stripe. The engagement log contains no personal data, and certificate records contain no buyer identity, so there is normally nothing in the Registry's own database that can be matched to an individual. A request that concerns the buyer email address or payment details is directed to Stripe, and the Registry will assist in routing it.
Requests are sent to hi@polkuopas.fi. Where a request concerns a specific purchase, include the order reference so the record can be located; the Registry cannot identify a purchase from a name.
A data subject also has the right to lodge a complaint with a supervisory authority. In Finland that authority is the Office of the Data Protection Ombudsman (tietosuoja.fi).
Changes to this notice
This notice is updated when the processing it describes changes. The version in force is the one published on this page, and the page carries the time it was served.
Related pages: the terms of sale at /terms, the refund and withdrawal policy at /refunds, and the contact address at /contact.