Last updated: 31 August 2026 · Version 2026-08-31.1

Privacy Policy

Paysoff is a subscription-value calculator. Today it is a waiting list and nothing more. This policy explains exactly what happens to the one piece of personal data we ask for, and to the anonymous statistics we keep about the page itself.

1. Who is responsible for your data

The data controller for the personal data described in this policy is:

• Weekend Inc. (in formation), trading as Paysoff
• Revontultentie 6-8, 96500 Rovaniemi, Finland
• Email: [email protected]

Weekend Inc. is currently being incorporated. Until that is complete, Gabriele Michieletto acts as the data controller personally and is the person accountable for everything described here. The role passes to Weekend Inc. on incorporation; we will update this page and email everyone on the waiting list when it does.

We have not appointed a Data Protection Officer, as we are not required to under Art. 37 GDPR. Write to the address above for anything concerning your data.

2. The waiting list

We do not ask for your name, we do not profile you, we make no automated decisions about you, and we have no access whatsoever to your bank, your card, or your actual subscriptions.

3. Analytics

We want to know whether this page works: how many people arrive, roughly where from, and how far down they read before losing interest. So we run Umami, an open-source analytics tool, on our own server. It is not a hosted service and nothing is sent to anyone else.

Why this does not need a cookie banner

Consent under the ePrivacy rules is required when a site stores information on your device or reads what is already there. This one does neither:

• No cookies, no localStorage, no sessionStorage, no fingerprinting.
• Your IP address is never stored. It is used for a fraction of a second, in memory, to work out your country and to compute a visitor count, then discarded.
• That visitor count works by hashing your IP address together with your browser's user-agent and a random salt that changes every day. The hash cannot be reversed, and because the salt rotates, yesterday's visitor cannot be matched to today's. We cannot follow you across days, and we could not identify you if we tried.
• No cross-site tracking. The data exists only for this site and is never combined with anything else or shared.
• We honour your browser's Do Not Track setting. Turn it on and we count nothing at all.

We think that is the right trade: we learn whether the page works, and you give up nothing that points back at you. If you would still rather not be counted, opting out is one click.

The iPhone app

The app counts the same kind of thing, on the same server of ours, for the same reason: to find out which screen of the setup flow loses people. It records which screen you reached, a short list of fixed labels (which of the three subscriber types you picked, whether a subscription came out as good or poor value, which button you tapped on the price screen), and roughly how long a screen took, as a range rather than a figure.

What it never sends: your name, your email, the subscriptions you add, their prices, or anything else you type. That stays on your phone. There is no advertising identifier, no device identifier, no third-party analytics kit, and nothing about this is written to your phone, which is also why the app never shows you a tracking permission prompt. Apple is told the same thing in the app's privacy manifest: data not linked to you, not used for tracking.

Same lawful basis, same 14 months, same right to say no: Profile → Privacy → Anonymous usage stats. Switch it off and the app sends nothing at all. Deleting all your data in the app leaves that choice switched off; we are not going to quietly turn it back on.

4. Cookie policy

We set no cookies. The one exception is outside our code: Cloudflare, which protects this site from attacks and bots, may set a cookie named __cf_bm that lasts about thirty minutes and exists purely to tell a human browser from an automated one. It is strictly necessary to deliver the site securely, it is not used for analytics or advertising, and it does not follow you to other websites.

And the things we do not do:

• No third-party analytics. No Google Analytics, no Meta pixel, no advertising tags, no session recording, no heatmaps.
• No third-party fonts or CDNs. Every asset on this page comes from our own server. Loading fonts from Google would disclose your IP address to Google, so we host them ourselves instead.
• No access logging. Our web server is configured not to record visitor IP addresses at all.
• No cross-site tracking or profiling. We do not build a picture of you, and we have nothing to build it from.
• No selling or sharing. Your address is never passed to advertisers, data brokers, or partners.

5. Who else touches your data

One processor, engaged under a data processing agreement as required by Art. 28 GDPR:

• Supabase hosts the database that stores the waiting list. The project is hosted in the European Union (eu-central-1, Frankfurt, Germany). See supabase.com/privacy.
• Cloudflare sits in front of this site as a content delivery network, providing TLS encryption and protection against attacks. Your request passes through it, so it necessarily sees your IP address, and it processes that to route and filter traffic. It does not store our data. Cloudflare also asks your browser to report failed connections back to it (a standard web mechanism called Network Error Logging), which tells it that a request broke — not who you are or what you read. Engaged under Cloudflare's data processing addendum, which incorporates the Standard Contractual Clauses. See cloudflare.com/privacypolicy.

Analytics has no processor at all. Umami is software we run ourselves on our own infrastructure, so that data never leaves our hands. Beyond the above, we disclose personal data only where the law obliges us to, for example a valid order from a court or a competent authority.

6. Where your data is stored

Both the waiting list and the analytics database live on servers in the European Union, and we do not transfer them outside the European Economic Area. This is true regardless of where you live. Paysoff is aimed at a US audience, but the data stays in the EU either way.

Two qualifications. Cloudflare's network is global, so the request that carries your page is handled at whichever of its locations is nearest you, which for a US visitor means a US server. It relays the request and stores nothing. And our processors may, in limited support situations, need to access data from outside the EEA. Both are covered by the European Commission's Standard Contractual Clauses in our data processing agreements (Art. 46(2)(c) GDPR). You may request a copy of those safeguards by writing to [email protected].

7. How it is protected

The waiting-list table is protected by row-level security that allows inserts only. The key published in this website's source code can add an address but cannot read, change, or delete the list, so even someone reading our page source cannot retrieve a single email. The list itself is readable only through an authenticated administrator session. The analytics dashboard is not reachable from the public internet at all. Traffic to and from this site is encrypted in transit.

8. Your rights

Under Articles 15 to 22 GDPR you have the right to:

• Access. Get confirmation of whether we hold your data, and a copy of it.
• Rectification. Have an inaccurate address corrected.
• Erasure. Have your address deleted ("right to be forgotten").
• Restriction. Ask us to hold your data but stop using it.
• Portability. Receive your data in a structured, machine-readable format.
• Objection. Object to processing based on legitimate interest, including our analytics, and at any time to direct marketing. For analytics, the opt-out button above is the fastest way.
• Withdrawal of consent. Withdraw at any moment, without giving a reason. Withdrawing does not affect the lawfulness of what we did before you withdrew.

There is one limitation. The analytics data contains nothing that identifies you, so we genuinely cannot find "your" rows in it to show or delete them. Art. 11(2) GDPR covers this: where a controller cannot identify a data subject, the access, rectification, erasure and portability rights do not apply. The opt-out is there so you can stop it at the source.

These rights are yours wherever you live. We do not distinguish between visitors by country. It would cost us more to build two standards than to hold everyone to the higher one.

To exercise any of these, email [email protected]. We will respond within one month (Art. 12(3)). It costs you nothing, and asking us to delete your address is not going to offend us.

Providing your email is entirely optional. It is not a legal or contractual requirement. The only consequence of not giving it is that we cannot tell you when Paysoff opens.

9. If you are in the United States

Every marketing email we send carries a working unsubscribe link and our postal address, and we act on opt-outs promptly, well inside the ten business days the CAN-SPAM Act allows. You can also just reply and ask.

We do not sell or share personal information as those terms are defined under the California Consumer Privacy Act, and we have never done so. If California residents ever gain rights against us that this policy does not already grant, we will add them here.

10. Complaints

If you think we have handled your data badly, please tell us first — we would rather fix it. You also have the right to lodge a complaint with a supervisory authority, in particular in the country where you live or work. We are established in Finland, where the authority is the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto), Lintulahdenkuja 4, 00530 Helsinki (postal address PO Box 800, 00531 Helsinki), tietosuoja.fi.

11. Children

Paysoff is not directed at children. Do not sign up if you are under 16, or under the lower age set by your own country where that applies. In Finland it is 13, under § 5 of the Data Protection Act (1050/2018); in the United States, the Children's Online Privacy Protection Act sets 13. If we learn that we hold the address of a child below the applicable age, we will delete it.

12. Changes to this policy

If we change how we handle your data, we will update this page and move the date at the top. Where a change materially affects you (a new purpose, a new processor, a new category of data, or the handover of control to Weekend Inc. once it is incorporated), we will email everyone on the waiting list before it takes effect, and ask for fresh consent where consent is what we rely on.