Privacy policy
Effective date: 25 September 2026
This Privacy Policy explains how Avastorm Oy ("Avastorm", "we", "us") collects, uses, stores, and protects personal data when you visit our websites, purchase or use our software products, create an account, contact us, or otherwise interact with our services.
We are committed to protecting your privacy and processing personal data in accordance with applicable data protection legislation, including the EU General Data Protection Regulation (GDPR).
1. Data Controller
The data controller for personal data processed by Avastorm is:
Avastorm Oy
Business ID: FI34558256
Finland
Email: info@avastorm.com
2. Data Processed by Our Products
Our software products may operate within your own website, server, application, or other environment.
Unless the documentation or privacy information for a specific Product states otherwise, our software products are not designed to send your website visitors' or customers' personal data to Avastorm.
For example, where a Product operates within your own WordPress or WooCommerce installation, data processed by that Product may remain within your own hosting environment.
You are responsible for determining how personal data is processed within your own website or systems and for providing any privacy notices or obtaining any consents required by applicable law.
Some Products may require communication with Avastorm's servers or third-party services for functions such as:
- License validation
- Software updates
- Product activation
- Subscription management
- Error reporting
- Product functionality
- Customer support
Where a Product processes or transmits personal data in connection with such functions, the applicable processing is described in the documentation or other privacy information for that Product where necessary.
3. Personal Data We Collect
Depending on how you interact with Avastorm, we may collect and process the following categories of personal data:
| Category | Examples | Purpose | Legal basis |
|---|---|---|---|
| Customer account | Name, email address, account details | Creating and managing your account and providing purchased Products | Contract performance (Art. 6(1)(b) GDPR) |
| Purchase information | Products purchased, subscription details, billing information | Processing purchases and managing subscriptions | Contract performance (Art. 6(1)(b) GDPR) |
| Billing and tax information | Billing address, company name, VAT number | Invoicing, accounting, and tax compliance | Contract performance; Legal obligation (Art. 6(1)(b), (c) GDPR) |
| Payment information | Payment status and transaction information | Processing and reconciling payments | Contract performance; Legal obligation (Art. 6(1)(b), (c) GDPR) |
| License information | License key, registered domains or installations, activation information | License management, product activation, and abuse prevention | Contract performance; Legitimate interests (Art. 6(1)(b), (f) GDPR) |
| Support information | Emails, support requests, technical information you provide | Providing customer support and resolving problems | Contract performance; Legitimate interests (Art. 6(1)(b), (f) GDPR) |
| Website information | IP address, browser information, pages visited, technical logs | Security, fraud prevention, diagnostics, and maintaining our websites | Legitimate interests (Art. 6(1)(f) GDPR) |
| Communications | Information you provide when contacting us or subscribing to communications | Responding to enquiries and sending requested communications | Contract performance; Consent; Legitimate interests (Art. 6(1)(b), (a), (f) GDPR) |
We only collect personal data that is reasonably necessary for the relevant purpose.
4. Payment Processing
Payments for Avastorm Products may be processed by third-party payment providers.
Where payment processing is handled by a third-party payment provider, Avastorm generally does not store full payment card numbers, CVV codes, or equivalent sensitive payment credentials on its own servers.
The payment provider may process your payment information in accordance with its own privacy policy and applicable data protection requirements.
We may receive information such as payment status, transaction identifiers, amount paid, currency, billing information, and other information necessary to manage your purchase, subscription, refunds, and accounting.
5. Cookies and Similar Technologies
Our websites may use cookies and similar technologies.
Some cookies may be necessary for functions such as:
- Login and authentication
- Shopping cart and checkout functionality
- Security
- Session management
- Remembering user preferences
We may also use analytics, marketing, or other non-essential technologies where permitted by applicable law.
Where required, we will request your consent before placing or using non-essential cookies or similar technologies.
You can manage cookie preferences through the cookie controls provided on our websites and through your browser settings.
6. Data Sharing
We do not sell or rent your personal data.
We may share personal data with trusted third parties where necessary to operate our business and provide our Products and services.
These may include:
- Payment providers – to process payments, subscriptions, refunds, and related transactions.
- Email and communications providers – to send transactional emails, account messages, product updates, and other communications.
- Hosting and infrastructure providers – to host websites, applications, databases, and related services.
- Customer support and service providers – where necessary to provide customer support and manage customer relationships.
- Analytics and security providers – where used to understand website usage, maintain security, prevent abuse, or diagnose technical problems.
- Professional advisers – such as accountants, auditors, lawyers, or other professional service providers where reasonably necessary.
- Authorities and public bodies – where disclosure is required by applicable law, regulation, legal process, or a valid authority request.
Where required by GDPR, we enter into appropriate data processing agreements with service providers that process personal data on our behalf.
7. International Data Transfers
Avastorm Oy is based in Finland and the European Union.
We aim to process personal data within the European Economic Area (EEA) where reasonably possible.
Some service providers we use may process personal data outside the EEA. Where personal data is transferred outside the EEA, we take appropriate measures to ensure that the transfer is lawful under applicable data protection legislation.
These measures may include an adequacy decision, Standard Contractual Clauses, or other legally recognised safeguards.
8. Data Retention
We retain personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy, unless a longer retention period is required by law.
Retention periods may vary depending on the type of data and the reason for processing.
For example:
- Customer and account information may be retained for the duration of the customer relationship and for a reasonable period afterwards.
- License and subscription information may be retained for as long as necessary to manage licenses, subscriptions, support, and related records.
- Invoices and accounting records are retained for the period required by applicable Finnish accounting and tax legislation.
- Support correspondence may be retained for a reasonable period after the support matter has been resolved.
- Security and server logs may be retained for a limited period appropriate for security, troubleshooting, and abuse prevention.
When personal data is no longer required, we will delete it or anonymise it where reasonably possible.
9. Your Rights Under GDPR
If the GDPR applies to the processing of your personal data, you may have the following rights:
- Right of access – request confirmation of whether we process your personal data and obtain a copy of that data.
- Right to rectification – request correction of inaccurate or incomplete personal data.
- Right to erasure – request deletion of your personal data in certain circumstances.
- Right to restriction – request that we restrict processing in certain circumstances.
- Right to data portability – receive certain personal data in a structured, commonly used, machine-readable format.
- Right to object – object to processing based on legitimate interests in certain circumstances.
- Right to withdraw consent – where processing is based on consent, you may withdraw your consent at any time.
- Right to lodge a complaint – you have the right to lodge a complaint with a competent data protection supervisory authority.
To exercise your rights, contact us at:
We will respond to requests within the timeframe required by applicable law. In certain circumstances, we may need to verify your identity before fulfilling a request.
In Finland, the relevant supervisory authority is the Office of the Data Protection Ombudsman.
10. Security
We take reasonable technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, loss, or destruction.
Depending on the service, these measures may include:
- HTTPS and encrypted communications
- Access controls
- Authentication and authorisation controls
- Secure hosting infrastructure
- Backups and recovery procedures
- Monitoring and security reviews
- Limited access to personal data by authorised personnel
No internet-based service or storage system can be guaranteed to be completely secure.
If a personal data breach occurs that requires notification under applicable law, we will take the required steps to investigate and address the incident and notify affected individuals and/or the relevant supervisory authority where legally required.
11. Children's Privacy
Our Products and services are primarily intended for businesses, organisations, and adults.
We do not knowingly collect personal data from children where such collection is prohibited by applicable law.
If you believe that a child has provided personal data to us without appropriate consent, please contact us at info@avastorm.com so that we can investigate and take appropriate action.
12. Third-Party Websites and Services
Our websites and Products may contain links to or integrations with third-party websites, applications, or services.
This Privacy Policy does not apply to the privacy practices of third parties.
We recommend reviewing the privacy policies of third-party services before providing them with personal data.
13. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our services, technology, legal requirements, or data processing practices.
If we make material changes, we may notify customers through email, our website, customer accounts, or other appropriate means where required.
The Effective date at the top of this page indicates when this Privacy Policy was most recently updated.
14. Contact
If you have questions about this Privacy Policy, our processing of personal data, or your data protection rights, please contact us:
Avastorm Oy
Business ID: FI34558256
Finland
Email: info@avastorm.com