Privacy Policy

1. Controller

Aia Media Oy is the controller for the marketplace data described here. Its verified identity and contact details appear above. Independent stores remain the sellers of their products. When an order is placed, a store receives only the customer and order information needed for its seller responsibilities, while Aia Media Oy remains the controller for ZUPII marketplace processing.

2. Data we process

• Account and login data: email address, authentication credentials handled securely by the authentication service, Google account details supplied when you choose Google sign-in, session data, name, phone number and language preference.
• Customer and service data: profile details, launch-notice email, postal code, optional store or product request, consent record, support messages, complaint details, attachments and private feedback.
• Historical order and payment data: products, prices, store, order status, delivery details, transaction references, refund records and related communications. New orders and payments may be processed where checkout is enabled.
• Address and location data: an address or postal code you enter, device coordinates when you grant browser permission, a resolved location and map requests used to show relevant stores. Your chosen location may be kept in this browser.
• Merchant data: business and store details, staff contact details, membership, approval and catalogue information.
• Courier applicant and rider data: identity and contact details, service areas, vehicle, availability, right-to-work confirmation, application messages, verification and assignment records.
• Security and operations data: sign-in events, technical request information, access records, notification outcomes and error logs needed to operate and protect the service.
• Usage data: first-party events such as a home, store or product view, with limited context such as store or city and a timestamp. These events do not include a user ID, email, address, session ID or device fingerprint.

3. Purposes and legal bases

We do not sell personal data or use it for advertising profiles. The launch-notice consent covers one requested notice only.

4. Recipients and service providers

• Authorised ZUPII staff receive only the information needed for their role.
• Lovable Cloud provides hosting, authentication, database and private file storage. Lovable's managed email service receives recipient and message data for transactional emails.
• Google receives authentication data when you choose Google sign-in. Google also supplies the Geist web font requested by the website.
• OpenStreetMap supplies map tiles. Its Nominatim service receives an address or coordinates when ZUPII geocodes or reverse-geocodes a location.
• Stripe processes payment, refund and transaction data when card checkout is enabled.
• For active orders, the selling store and assigned rider receive only the order or delivery details needed for their responsibilities.
• Professional advisers, courts and public authorities may receive data where law requires or permits it.

We do not sell personal data for advertising profiles. Google Firebase Cloud Messaging processes opted-in Partner Hub and Rider Hub device tokens and generic Android notifications, while browser push services process opted-in web alerts.

5. International transfers

Some providers may process data outside the European Economic Area. Where GDPR requires a transfer safeguard, we rely on an adequacy decision, the European Commission's Standard Contractual Clauses, or another lawful mechanism together with appropriate supplementary measures.

6. Retention

We use the following purpose-based retention criteria:

• Account and profile data is kept while the account exists, then deleted or anonymised unless a legal record must remain.
• Launch requests are kept until the requested notice is sent or the request is withdrawn, then removed when no longer needed to document consent or delivery.
• Support, complaint, merchant and rider application records are kept while the matter or relationship is active and afterwards as needed to document decisions, protect rights and meet legal limitation periods.
• Historical order, payment, refund and delivery records are kept for applicable accounting, tax, consumer-protection and dispute periods, then deleted or anonymised where possible.
• Security, operational, notification and error logs are kept only as long as reasonably needed to detect problems, investigate misuse and maintain service reliability.
• Browser data remains until you clear it, sign out, its configured limit is reached, or the session expires. First-party usage events are kept only while needed for aggregated service analysis.

7. Your GDPR rights

• Access your personal data and receive a copy.
• Correct inaccurate or incomplete data.
• Request erasure where the legal conditions apply.
• Restrict processing in the situations set out in the GDPR.
• Receive data you provided in a portable, machine-readable format where applicable.
• Object to processing based on legitimate interests.
• Withdraw consent at any time without affecting earlier lawful processing.

Send a request to the privacy contact above. We may verify that the request concerns your data. You may also complain to the Finnish Data Protection Ombudsman.

• Account deletion instructions
• Office of the Data Protection Ombudsman

8. Security

We use encrypted connections, role-based and row-level access controls, private file storage, server-side validation, restricted privileged access, and authentication controls intended to protect personal data. Access is limited according to customer, store, rider and administrator responsibilities. No online service can guarantee absolute security.

9. Children

ZUPII is intended for people aged 13 or over and is not directed to children under 13. A parent or guardian should contact us if they believe a child under 13 has provided personal data; we will review and delete it where required. People who cannot legally enter a contract need a parent or guardian for contractual services.

10. Browser storage and automated decisions

The app uses essential browser storage for sign-in, language, entered location, saved favourites, interface state and your cookie choice. Optional measurement (anonymous view counts and a random story-viewer identifier) and personalisation (recent products, recent searches, seen stories and the local help chat) are used only if you opt in, and can be withdrawn anytime from Cookie settings in the footer. Details are in the Cookies & browser storage page. ZUPII does not make decisions with legal or similarly significant effects based solely on automated processing and does not create marketing profiles.

11. Zupii Rider Android app — updated 18 October 2026

This section describes how Zupii Rider handles information about applicants and approved delivery riders, including in the Android app.

• Rider accounts: name, email, phone, login/session details, approval status, service area, vehicle type, application and verification details, and applicable contractor business information.
• Deliveries: available/assigned jobs, pickup store, customer delivery address and contact details needed to complete deliveries, order and pickup verification status, delivery timestamps and completion records. Only authorised operations staff, stores and assigned riders receive the relevant information needed for their tasks.
• Location: while an approved rider has chosen to be online and already granted location permission, the running Rider app requests a location fix roughly every 60 seconds, including coordinates, accuracy and timestamp, for dispatch availability and nearby jobs. Going offline stops new location requests. The current Rider implementation does not request continuous background-location permission; Android location permissions can be revoked at any time.
• Push notifications: with permission, Zupii registers an Android Firebase Cloud Messaging device token so the app can receive generic job alerts while closed or in the background. Google Firebase receives the token and message delivery data. Alert text contains no customer address, phone, products or order amount. Disable alerts in Rider Account or Android settings.
• Earnings: Rider Hub displays job-specific fees, completed-delivery earnings and records of manually paid compensation. It does not make automated rider payouts. Business or invoicing records are used only when the applicable contractor option is enabled.
• Security, storage and providers: necessary session, alert preference and token records may be stored on the device and server. Authorised Zupii operations process security logs, technical requests and notification results. The authentication/database provider, Firebase notification infrastructure, and map/navigation providers chosen by the rider receive information needed to provide their services.

Purposes and legal bases: performing and administering rider work (GDPR Art. 6(1)(b)); security, fraud prevention and service reliability (Art. 6(1)(f)); and legally required pay, accounting and tax records (Art. 6(1)(c)). Location and alert access are controlled by the device permissions and rider online/notification choices. Information is kept for the active account and delivery duties or longer where justified by law, security incidents or claims, then erased or anonymised where possible. Contact the privacy email above to request access, correction or deletion; account-deletion instructions also cover rider accounts.