DRAFT — pending a human-lawyer skim before public launch. This document is a first-pass legal draft prepared with AI assistance (product-counsel triage) grounded in the actual GearManifest architecture (ADR-0003). GM-49's controller-identity values were confirmed by the founder on 2026-07-22 and are filled in below, but this is still not final legal advice and must not be treated as cleared copy until a qualified lawyer has reviewed it — see the internal notes below for the specific open question (postal address) flagged for that review.

Privacy Notice

This notice explains what personal data GearManifest ("the Service") collects, why, and what rights you have. It applies to everyone who creates a GearManifest account.

1. Who is responsible for your data (the "controller")

GearManifest is operated by Simo Parviainen, as a private individual based in Finland — GearManifest is not currently operated through a registered business (no toiminimi, no Y-tunnus / Business ID). For data protection purposes, Simo Parviainen is the GDPR data controller for GearManifest.

• Name: Simo Parviainen
• Operating as: a private individual in Finland (no registered business / Y-tunnus)
• Contact for privacy questions and data-rights requests: Hi@polkuopas.fi

This email address is the controller's designated contact point for all privacy questions, data-subject-rights requests, and complaints under this notice.

2. What data we collect

We collect only what the product needs to work. Specifically:

Account data

• Your email address, used to send you a magic-link sign-in email. We do not use passwords.
• Display name (optional, set in Settings).
• Your preferred weight unit (g/kg/oz/lb) and preferred currency — display preferences only, stored so the app remembers your choice.
• Two fields (bio, location) exist in our database schema as stubs for a possible future profile feature. They are not currently exposed anywhere in the product and, if unused, hold no data about you.

Gear and build data

This is the core content you create in GearManifest:

• Gear items — the things in your inventory: name, brand, model, weight, price, your own notes, category, condition, and (if you used the AI lookup) a confidence marker showing whether a field came from you or from an AI estimate.
• Wishlist items — gear you've marked as "wished" rather than owned. These are stored as regular gear items with a wished status; we're calling this out explicitly so it's clear wishlist entries are not silently treated as something other than your inventory data.
• Builds — named loadouts you create (e.g. "3-day summer trip"), including trip context you choose to record: trip type, season, group size, duration, and free-text notes.
• Build items — which gear items belong to which build, and per-build overrides (e.g. whether an item is worn vs. packed, or a consumable) for that specific build.

AI SKU-lookup inputs

When you use the "look up specs" feature on a gear item, GearManifest sends only the product name and model you typed to Anthropic's API to fetch likely specifications (weight, etc.). This request is made from our server, not your browser, and does not include your email, account ID, or any other information that identifies you. Anthropic processes this as a short-lived API request; see "Processors," below.

What we do not collect

We do not collect payment information (GearManifest has no paid tier in its current version), government ID numbers, precise device location, or biometric data.

3. Why we process your data (lawful basis)

• Account, gear, and build data — processed under Art. 6(1)(b) GDPR (necessity for performance of a contract): this data is what lets us provide the inventory and build-planning service you signed up for. We don't have a separate consent flow for this because the processing is the product.
• AI SKU-lookup data — the same basis (Art. 6(1)(b)): looking up specs is a feature you actively trigger, and only the minimum data (product name/model) needed to answer your request is sent.
• Product analytics (PostHog) — GearManifest currently runs PostHog configured to store no persistent identifier on your device: no cookies, no localStorage, memory-only session state, no identify() calls linking events to your account, and autocapture turned off. Because nothing is stored on or read from your device, this configuration falls outside the scope of ePrivacy Directive Art. 5(3) (which governs storage of/access to information on a user's device) — which is why you will not see a cookie-consent banner for analytics. To the extent this minimal, non-persistent processing touches personal data at all (e.g. transient, session-scoped event data), we rely on our legitimate interest (Art. 6(1)(f) GDPR) in understanding aggregate, non-identifying product usage to improve GearManifest, weighed against the low impact on you given the cookieless, non-identifying configuration. This is a founder-approved design choice pending a pre-launch human-lawyer check (see GM-51); if PostHog's configuration ever changes to use persistent identifiers, cookies, or account-linked tracking, we will introduce a proper consent mechanism before making that change, and this notice will be updated.
• We do not rely on a vague "legitimate interest" basis for your core account, gear, or build data — that data has a specific contractual basis as described above.

We may also produce and license aggregated, anonymized, non-identifying statistics about gear trends — for example, which categories or types of gear are commonly owned or wished for — to industry partners. These statistics are always about many users in aggregate; they never include, and are not derivable back to, any individual's inventory, username, email address, or any other identifier. We will never sell or license your individual inventory, your identity, or anything that could single you out.

4. Who else processes your data (our processors)

We use the following service providers ("processors") to run GearManifest. Formal Data Processing Agreements (Art. 28 GDPR) with our processors are part of our pre-launch checklist and had not all been finalized as of the date of this draft — this notice will be updated once that work (tracked internally as GM-40 and equivalent) is complete, and we will not claim signed agreements are in place until they are.

On Anthropic and international transfer: because only the product name and model you type are sent — not your account identifiers — we do not believe this constitutes a transfer of your personal data in the ordinary case. This assessment depends on you not including personal information in the free-text fields you send to the lookup feature; please don't. This point is flagged for confirmation in the pre-launch lawyer review.

5. How long we keep your data

• While your account is active, we keep your data for as long as you keep your account — there's no automatic expiry on an active account.
• If you delete your account, your data is fully and permanently removed from our active systems within 30 days. GearManifest's current (free-tier) infrastructure does not retain separate long-term or restorable backup copies of your data beyond that active-system removal — there is no additional backup-purge window on top of the 30 days.

6. Your rights and how to exercise them

Under GDPR you have the right to access, correct, export, delete, restrict, and object to our processing of your data, and the right to withdraw any consent you've given. In practice:

• Export your data: planned self-service export (JSON/CSV) from your account settings (tracked as GM-54). Until that ships, request an export at Hi@polkuopas.fi.
• Delete your account and data: planned self-service account deletion from your account settings (tracked as GM-56), which triggers the 30-day full purge described above. Until that ships, request deletion at Hi@polkuopas.fi.
• Anything else (access, correction, restriction, objection): email Hi@polkuopas.fi. We will respond within one month of your request, as required by GDPR; in complex cases we may extend this by a further two months, and we'll tell you if we do.

7. Complaints

If you believe we've mishandled your data, we'd like the chance to fix it — email Hi@polkuopas.fi first. You also have the right to lodge a complaint directly with Finland's data protection authority:

Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto) https://tietosuoja.fi/en/home

8. Cookies and similar technologies

GearManifest uses one essential cookie: the Supabase authentication session cookie, which keeps you signed in. This is strictly necessary for the Service to function and is exempt from consent requirements under ePrivacy Art. 5(3).

We do not use any non-essential cookies. Our analytics (PostHog) is configured to be cookieless and store nothing on your device — see Section 3 for the full explanation of why no cookie-consent banner is shown. This is a deliberate, documented configuration choice, not an oversight; see GM-51 for the engineering-side implementation and its own pre-launch verification note.

9. Changes to this notice

We'll update this notice as the product changes, particularly once export/deletion self-service (GM-54/GM-56) ships and once the pre-launch human-lawyer review (including the open postal-address question flagged in Section 1) is complete. Material changes will be reflected here with an updated date once this document leaves draft status.