Last updated: 20 September 2026

This policy describes what personal data Softagram Oy processes, why, and for how long. It covers three situations: visiting the website softagram.com (section 2), contacting us or doing business with us (section 3), and using the Softagram Analyzer service (section 4). Sections 5 to 9 apply to all three.

1. Data controller

• Company: Softagram Oy, Business ID 2532004-3 (VAT FI25320043)
• Address: Ketolanperäntie 469, 90450 Kempele, Finland
• Email: info@softagram.com

Softagram has not appointed a data protection officer. Questions about this policy go to the email address above.

2. The website softagram.com

2.1 Server logs

When you open a page, our web server records your IP address, the address of the page, the time, the response code, the page you came from and your browser's identification string. We use these logs to keep the site running and to investigate abuse. They are deleted after 24 months. The website runs on servers rented from Hetzner Online GmbH in its Helsinki data centre.

2.2 Language redirect

On the front page, our server looks up the country of your IP address in a database stored on the server itself. The address is not sent to anyone for this. Visitors from the United States, Canada, the United Kingdom, Ireland, Australia and New Zealand are sent to the English site once. The cookie geoip_redirected records that this has happened, so you are not redirected again if you switch language.

2.3 Cookies

The cookie bar offers two choices: essential cookies only, or all cookies. The cookies marked "No" below are set regardless of your choice. The cookies marked "Yes" are set only after you choose all cookies.

To change your choice, open the cookie policy page. A button there reopens the cookie bar. Deleting cookies in your browser also brings the bar back on your next visit.

2.4 Analytics

We measure how the site is used with Google Analytics 4. The measurement code is loaded through Google Tag Manager (container GTM-K9MLJ8SZ) on every page. Loading it means your browser fetches a script from Google's servers, so Google sees your IP address and browser identification string even if you decline cookies. The page also opens an early connection to Google's font server, although no fonts are loaded from it.

Until you accept all cookies, Analytics runs in a restricted mode. For each page view it sends one cookieless ping: the page address, the page you came from, the page language, screen size and browser type. No cookie is set and no identifier is stored, so pings from different visits cannot be linked together. Google uses them to estimate aggregate visitor counts.

After you accept all cookies, Analytics sets the two cookies listed above and records page views and these events:

• generate_lead: a contact form was sent successfully
• book_demo: a link to our meeting booking calendar was clicked
• odoo_apps_click: a link to the Odoo Apps store was clicked
• app_access_click: a link to the Analyzer login was clicked

We read these reports to see which pages are visited and which of them lead to contact. We also use Analytics data for advertising: the Analytics property is linked to Google Ads, and we use it to measure our ads and to build audiences for them. Google may then show our ads to you on its own services and on partner sites. Google states that Analytics 4 does not store IP addresses. Event-level data is kept in Google Analytics for 14 months; aggregated reports are kept longer. Google processes this data on our behalf in the United States (section 6).

2.5 Contact forms

The contact form asks for your name, email address, company, subject and message, and optionally your phone number. When you send it, our server emails the content to info@softagram.com, a mailbox hosted in Google Workspace, and keeps a copy in our Odoo system as an outgoing email record. We use your message to answer you and, where it is a sales enquiry, to follow it up. The legal basis is taking steps at your request before a contract (GDPR Article 6(1)(b)) and our legitimate interest in answering enquiries (Article 6(1)(f)). Messages are deleted after 24 months.

2.6 Content loaded from other companies

Some pages load content from servers that other companies run. Your browser sends your IP address and identification string to those servers to fetch the content.

• YouTube (Google): five blog guides for Softagram Desktop embed videos from www.youtube.com. YouTube may set its own cookies when the page loads and when you play a video, under Google's privacy policy.
• Unsplash: two Finnish service pages load stock photographs from images.unsplash.com.

The site loads no other third-party scripts, fonts, chat widgets or social media plugins. Links to other sites, such as GitHub or our booking calendar, send nothing until you click them.

3. Customers, prospects and business contacts

When you or your employer do business with us, we keep contact and contract records in our Odoo system: name, job title, employer, work email address and phone number, correspondence, offers, orders, contracts, invoices and payment records. We use them to deliver and invoice our services, to keep in touch about our services, and to meet our bookkeeping obligations.

Legal bases: performance of a contract (Article 6(1)(b)); our legitimate interest in maintaining business relationships and in telling business contacts about our services (Article 6(1)(f)); and the legal obligation to keep accounting records (Article 6(1)(c)).

Accounting records are kept for the period the Finnish Accounting Act requires. Other customer records are kept for 24 months. Contact details of prospects who do not become customers are kept for 24 months. You can object to marketing messages at any time by replying to one or by writing to info@softagram.com.

When we analyse a customer's source code under a service agreement, the customer is the controller of any personal data in it, such as commit author names. We process it on the customer's instructions under a data processing agreement.

4. The Softagram Analyzer service

This section applies if you have an account on Softagram Analyzer (private.softagram.com).

What we collect

• Account data: email address and display name; GitHub profile information when you log in with GitHub; organisation and team membership.
• Repository metadata: repository names and structure, file paths, dependency relationships between code components, and commit metadata (author names, timestamps, commit messages). We do not store the content of your source code files beyond what structural analysis requires.
• Analysis results: dependency graphs, impact analysis reports, code health metrics.
• Usage data: login times, IP addresses, which features you use, browser type and operating system.

Why

• To run the analysis and show you the results.
• To authenticate you and manage your subscription.
• To improve the service, using aggregated usage data only. Repository data is never used for this.
• To send notices about the service, such as security alerts and changes to your account.

The legal basis is performance of the contract described in our Terms of Service (Article 6(1)(b)) and, for security monitoring and service improvement, our legitimate interest (Article 6(1)(f)).

Account data, repository metadata and analysis results are kept while your account is active and deleted within 30 days after you close it. Aggregated statistics that cannot identify you are kept. We keep data longer only where the law requires it or a dispute is open.

The service runs on servers rented from Hetzner Online GmbH in its Helsinki data centre. GitHub, Inc. receives data for login and for the pull request integration.

5. Who receives personal data

We do not sell personal data. These companies process it on our behalf or receive it when you use the site:

We also disclose data to authorities when the law requires it.

6. Transfers outside the EU and EEA

Our own systems are in Finland. Google LLC and GitHub, Inc. are in the United States. Both are certified under the EU–US Data Privacy Framework. Where a transfer is not covered by that framework, we rely on the European Commission's standard contractual clauses. Canada, where Unsplash is based, is covered by an EU adequacy decision for commercial organisations.

7. Your rights

Under the GDPR you can ask us to:

• tell you what personal data we hold about you and give you a copy (Article 15)
• correct inaccurate data (Article 16)
• delete your data (Article 17)
• restrict processing (Article 18)
• give you your data in a machine-readable format (Article 20)
• stop processing that is based on legitimate interest, including marketing (Article 21)

Where processing is based on your consent, such as analytics cookies, you can withdraw it at any time as described in section 2.3. Send requests to info@softagram.com. We answer within one month.

8. Changes to this policy

When we change this policy, we update the date at the top. If a change materially affects how we process Analyzer account data, we email account holders at least 30 days before it takes effect. This policy is published in English and Finnish. If the two versions differ, the English version applies.

9. Contact and complaints

• Email: info@softagram.com
• Address: Softagram Oy, Ketolanperäntie 469, 90450 Kempele, Finland

If you think we have handled your data unlawfully, you can complain to the Finnish supervisory authority, the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto), tietosuoja.fi.