You Say Fine: Privacy Notice
Version: 1.0 (content launch)
Last updated: 2026-10-22
Applies to: our website https://www.yousayfine.com (yousayfine.com) and emails you send to support@yousayfine.com.
This notice explains, in plain English, what personal data we collect, why, who we share it with, how long we keep it, and what rights you have. We keep it short where we can and specific where it matters.
1. Who we are and how to reach us
"You Say Fine" is a stress-regulation coaching brand of Maradevi Oy, a company based in Finland (EU). For the data described here, Maradevi Oy is the data controller.
- Trading name: You Say Fine
- Legal identity: Maradevi Oy (private limited company registered in Finland), Business ID (Y-tunnus) 3323765-3
- Postal address: Fredrika Runebergin katu 1-3 H 16, 06100 Porvoo, Finland
- Privacy contact: support@yousayfine.com, subject line "Privacy"
If you can't use email, you can write to us at the postal address above.
We don't have a Data Protection Officer because the law doesn't require one for a business of our size and type. You can send any privacy question to the address above.
2. The short version
- We collect as little as we can: the emails you send us and basic technical data needed to run the website.
- We use no analytics and no tracking cookies. Our website sets no cookies at all.
- We do not sell your personal data, and we do not use it for targeted advertising.
- You can ask us to see, correct, export or delete your data. See section 7.
3. What we collect, why, and our legal basis
Under the EU General Data Protection Regulation (GDPR), we need a legal basis for each use of your data (GDPR Article 6).
| What | Why | Legal basis |
|---|---|---|
| Website technical data in our host's request logs: IP address, approximate location derived from it, browser and device information, page requested, time of request | To deliver the website, keep it secure and fix errors | Our legitimate interest in running a secure, working website (Art. 6(1)(f)). See section 4 |
| Emails you send us at support@yousayfine.com | To answer you. Please don't include health details (see section 10) | Our legitimate interest in answering you (Art. 6(1)(f)) |
| Emails that suggest someone may be at risk (these may reveal information about health) | Only to send a pre-written safety reply that points to emergency services and to findahelpline.com, to mark that contact in our support inbox until a person has checked, and to alert our team | Our legitimate interest in keeping people safe (Art. 6(1)(f)) and, where a life may be at risk, vital interests (Art. 6(1)(d)). For health information: vital interests where the person may not be able to consent (Art. 9(2)(c)). See section 10 |
| Data needed for legal claims | To set up, exercise or defend legal claims | Legitimate interest (Art. 6(1)(f)) |
Where we rely on legitimate interest, you can object (see section 7).
Do you have to give us your data? No. You don't have to give us anything to use the website, but our host logs basic technical data when you visit (see section 4). If you email us, we need your email address to reply, and without it we can't answer you.
Automated decisions: we don't make decisions about you that are based only on automated processing and that have legal or similarly significant effects (GDPR Art. 22).
4. Website hosting and request logs
Hosting. Our website, https://www.yousayfine.com, is hosted by Vercel Inc. (USA).
What's logged. When you visit, your browser sends a request to Vercel's servers. Like any web server, Vercel receives and briefly logs technical data, such as:
- your IP address and the approximate location derived from it;
- your browser and device information;
- the page requested and the time of the request.
Purpose. To deliver the pages you ask for, keep the site secure (for example against attacks and abuse), and fix errors.
Legal basis. Our legitimate interest in running a secure, working website (GDPR Art. 6(1)(f)). You can object (section 7). We can't serve the website without processing this data, but we keep it to a minimum.
Retention. Request logs are available to us for 1 day. Vercel may keep its own security and service logs as described in its privacy notice (https://vercel.com/legal/privacy-notice).
Vercel's role. Vercel processes this data for us as our processor, under its Data Processing Addendum. For its own service and usage data, Vercel acts as an independent controller under its privacy notice. For transfers outside the EU, see section 6.
No analytics, no tracking. We don't use any analytics or statistics tool, and no tracking cookies. If we add analytics later, it will load only after you give opt-in consent, and we'll update this notice first.
5. Who we share data with
We use a small number of service providers. They process data for us under contract (processors) or decide for themselves how to use it (independent controllers).
| Provider | Role | What they do |
|---|---|---|
| Vercel Inc. (USA) | Processor (website hosting). Independent controller only for its own service and usage data, as set out in its DPA and privacy notice | Hosts www.yousayfine.com and keeps short-lived request logs |
| HighLevel (GoHighLevel): HighLevel, Inc. and its affiliates (USA) | Processor | Runs our support inbox at support@yousayfine.com: it receives, stores and lets us answer your emails. Our website loads no HighLevel scripts, forms or cookies. HighLevel's sub-processors are mainly in the United States, including Mailgun (sending and receiving our emails) and Google Cloud and Amazon Web Services (data storage): https://www.gohighlevel.com/sub-processors |
| Ancient Science OÜ (Estonia), a related company | Processor | Holds the HighLevel agency account under which our HighLevel account runs. It acts only on our instructions; HighLevel is its sub-processor |
We may also share data when the law requires it, or to protect someone's life or safety.
6. International transfers
Some of our providers are in the United States or elsewhere outside the EU/EEA. When data leaves the EU/EEA, we rely on one of the safeguards in GDPR Chapter V (Articles 44-49):
- Vercel (hosting): certified under the EU-US Data Privacy Framework (which has an EU adequacy decision). Its Data Processing Addendum also includes the EU Standard Contractual Clauses (2021) and, for UK data, the UK International Data Transfer Addendum.
- Ancient Science OÜ: in the EU (Estonia), so no transfer outside the EU on its side.
- HighLevel (support inbox; USA): certified under the EU-US Data Privacy Framework. Its Data Processing Agreement also includes the EU Standard Contractual Clauses. Its sub-processors, including AI providers, are listed at https://www.gohighlevel.com/sub-processors.
You can ask us for more information about these safeguards (see section 1).
7. Your rights
If GDPR applies to you, you have the right to:
- Access your data and get a copy (Art. 15)
- Correct inaccurate data (Art. 16)
- Delete your data in certain cases (Art. 17)
- Restrict how we use it in certain cases (Art. 18)
- Data portability: receive the data you gave us in a common format, or have it sent to someone else, where processing is based on consent or contract (Art. 20)
- Object to processing based on legitimate interest (Art. 21)
How to use your rights: email support@yousayfine.com with the subject "Privacy request". We may ask you to confirm your identity, usually by replying from the email address we hold. We'll answer within one month. If a request is complex, we may extend this by up to two more months and will tell you why. Using your rights is free.
Complaints: you can complain to a data protection authority. Our lead authority is the Office of the Data Protection Ombudsman in Finland (Tietosuojavaltuutetun toimisto): https://tietosuoja.fi/en/notification-to-the-data-protection-ombudsman. You can also complain to the authority in the EU country where you live or work, or where you think the problem happened. We'd appreciate the chance to fix things first, so please contact us.
8. How long we keep data
| Data | How long |
|---|---|
| Support emails (kept in our HighLevel inbox), including any safety marker on that contact | 2 years after the last message. After deletion, HighLevel can restore them for up to 60 days |
| Website request logs (Vercel) | Available to us for 1 day; Vercel's own security logs per its privacy notice |
If a question, complaint or legal claim is still open when one of these periods ends, we keep only the data needed for it until it's resolved, then delete it.
9. Cookies and similar technologies
Our website sets no cookies and stores nothing on your device (no local storage or similar). It runs no analytics, advertising or tracking script, and no third-party script at all. It loads no outside fonts (text uses the fonts already on your device), and it has no embedded videos, maps or social media widgets. Links to other websites (for example the studies on our Sources page) are ordinary links: nothing from those sites loads until you click. Because nothing on our site needs consent, we don't show a cookie banner, and we don't store any consent choice.
Under EU rules (the ePrivacy Directive, as applied in Finland by section 205 of the Act on Electronic Communications Services), anything stored on or read from your device that isn't strictly necessary needs your prior consent. If we ever add something like that (for example analytics), it will load only after you opt in. Declining will be as easy as accepting, and you'll be able to change your mind at any time. We'll update this notice first.
10. Safety
We are a coaching service, not a medical, therapy or crisis service. Please don't send us health details: we don't need them to answer you. If an email includes them anyway, we use them only to answer that email or for the safety steps below, we don't copy them into our own notes, lists or logs, and you can ask us to delete that email at any time (section 7). Our inbox is not monitored in real time. If an email suggests someone may be at risk, we reply by hand with a pre-written safety message that points to emergency services and to findahelpline.com. We also mark that contact in our support inbox until a person has checked. We use such emails only for these safety steps (legal bases in section 3). We keep counts only. We don't copy message contents into our own notes or logs. Emails stay in our inbox (HighLevel) for the period in section 8.
If you or someone else is in danger, call your local emergency number now. For free, confidential support in your country: findahelpline.com
11. If you're in the US, UK or Canada
- United States: we don't sell your personal information, and we don't "share" it for cross-context behavioural advertising, as those terms are used in US state privacy laws such as California's. We don't use sensitive personal information to infer characteristics about you. Wherever you live, you can ask us to access, correct or delete your data (section 7), and we won't treat you differently for doing so.
- United Kingdom: we handle your data to the same standard described in this notice, and you can use the same rights. You can also complain to the UK Information Commissioner's Office (ico.org.uk).
- Canada: you can ask to access or correct your personal information, or withdraw consent, using the contact details in section 1.
12. Age
Our website is for adults aged 18 and over. We don't knowingly collect data from anyone under 18. If you think a minor has given us data, contact us and we'll delete it.
13. Changes to this notice
If we change this notice, we'll update the "Last updated" date above.
Not therapy or medical care. If you're in crisis, contact local emergency services.