Privacy policy

1Controller

Name Company Oy (Moi Store) — Y-tunnus 2673679-6 · Uutiskuja 3 A9, 01770 Vantaa, Suomi. Requests and questions: info@moistore.fi.

Moi Pass is opened for you by your employer. Your employer decides the benefit amount and who may use it; for those decisions your employer is a separate controller.

2What data we process

• Account and contact: your email address (sign-in codes are sent to it). A phone number is optional.
• Purchases: the items you take from a cabinet, amounts, date/time and cabinet; receipts, refunds and problem reports.
• Payment: your card number is not stored in the app or on our servers. Card details go directly to the payment provider (Stripe); we keep only the provider’s card reference (token), the last 4 digits and the time you consented to saving the card. Apple Pay / Google Pay are processed through Stripe as well.
• Age confirmation: the time of your 16+ confirmation for age-restricted products.
• Moi Pass (if your employer has opened it): your work email, company, department and employee number if any (from your employer); benefit transactions; treat, shared-item, order and donation choices.
• Optional health and lifestyle data (only if you turn it on, with your explicit consent): step count only from Apple Health / Apple Watch or Android Health Connect; calorie summary, food preferences, height-weight-birth year-gender, activity level and goal (to give suggestions).
• Other optional data: profile photo and photos you attach to a problem report (only if you add them), birthday (day/month), busy times from your calendar (titles and attendees are not read), notification permission.
• Technical: session data (one strictly necessary session cookie), notification subscription, error and security logs.
• What we do not process: location, contacts, advertising identifiers. The app contains no analytics or advertising software (third-party SDKs); we do not track you across apps or websites.

3Why, and on what legal basis

• Opening the cabinet, taking payment, issuing receipts, deducting your benefit and invoicing your company — performance of a contract and legal obligation (GDPR Art. 6(1)(b), (c)).
• Problem reports, refunds, security and fraud prevention — legitimate interest (GDPR Art. 6(1)(f)).
• Steps and other health data, calorie summary, step bonus — only with your explicit consent (GDPR Art. 9(2)(a)). You can withdraw consent at any time in Profile.
• Optional notifications and preferences — your choice.

4What your employer sees (Moi Pass)

• Company totals and anonymous reports (small groups are hidden). If your company has enabled it, amounts and items per employee; every view is logged.
• Your health data never reaches your employer on a per-person basis. If you separately choose to share, you only join a company-wide anonymous total, and nothing is shown until at least 10 people take part.
• Your step count is never shared; if you join the step bonus, only the bonus amount is visible.

5Apple Health and Health Connect

With your permission the app only reads your daily step count; it does not write to Health. This data is not used for advertising, marketing or data sales, is not shared with third parties and is not stored in iCloud. You can disconnect in Profile → “Watch and health” and remove the permission in your phone’s Health / Health Connect settings.

6Who receives data (processors)

• Vercel — hosting of the app (European Union, Frankfurt).
• Neon — database (European Union).
• Resend — sign-in code, receipt and notification emails.
• Stripe — card payments and saved cards.
• Selfly — smart-cabinet platform (only what a cabinet transaction needs: opening the door and the items taken).
• Apple and Google — notification services and Health / Health Connect on your phone.
• Your employer (Moi Pass, within the limits above) and public authorities where required by law.
• Where a provider processes data outside the EU/EEA, the transfer is made under standard contractual clauses. Your data is never sold.

7How long we keep data

Purchase and accounting records for the period required by law (detached from your account if you delete it); health, step and preference data while your account is open or until you withdraw consent; technical logs for at most 1 year.

8Deleting your account

You can delete your account and personal data yourself in the app: Profile → Delete my account (in Moi Pass: Profile → Delete my account and data). Saved cards, sessions, sign-in details, health and preference data are deleted; purchase records that must be kept by law are kept detached from your account. Any unpaid amount must be settled first.

9Your rights

Under the GDPR you have the right to access, rectify and erase your data, to restrict processing, to object, to data portability and to withdraw consent. You may also lodge a complaint with the supervisory authority (in Finland: the Office of the Data Protection Ombudsman).

Contact: info@moistore.fi. We reply within one month at the latest.

10Contact

Name Company Oy (Moi Store) · info@moistore.fi