Privacy policy

Last updated 25 October 2026 · terms version 2026‑10‑25.2

In short: we use your information only to check your case and build your pack. We don't sell it, we don't use it for advertising and we never send it to the app. Case data and uploads are deleted 60 days after delivery. We never store card numbers or ID documents.

1. Who is responsible

Appeal My Gig is a name used by Elbek, a Finnish sole trader. Business ID 3570992-5 (Finnish Trade Register). Address: Myllyväenkatu 10 D 3, 00920 Helsinki, Finland. Phone +358 40 757 0116. Email [email protected]. We have not appointed a data protection officer and are not required to.

2. What we collect

Contact details: name, email, phone (if you give it), country where you live.
Case details: the app, the country where you work, your account email or ID, how long you have worked through the app, what the app did and when, the reason it gave and its message, whether anyone else used the account, what you have done so far, any pay held back, and your description.
Documents you upload: the screenshot of the app's message and any other documents you choose to add. Screenshots can show other information from your phone. You can crop it before you upload; we only need the message.
Payment information from Stripe: that you paid, the amount, your email and your billing country. We never see your full card details.
Your consents and choices on the order page and any withdrawal, with date, time, IP address and browser type, as proof of what was agreed.
Where you found us: the first page of our site you visited and the site you came from, saved with your case.
When you opened your pack link or PDF, as proof of delivery.
Emails you send us.
Technical data: IP address and request logs, used for security.

We do not ask for, and do not keep, card numbers, bank details or ID documents. If an upload shows them, we delete it and ask you to send a version with those details covered.

Please don't give us health details. If an accident or illness is part of what happened, a short mention is enough. We don't need medical details for your letters.

3. Why we use it and on what legal basis

Checking your case before you pay: steps you ask for before a contract (GDPR art. 6(1)(b)).
Building and delivering your pack, answering you, handling refunds and withdrawals: performance of our contract (art. 6(1)(b)).
Keeping accounting and tax records: legal obligation (art. 6(1)(c)), under the Finnish Accounting Act and VAT rules.
Keeping proof of the contract, of the information we gave you and of the pack we delivered: our legitimate interest in being able to prove it if there is a dispute (art. 6(1)(f)).
Keeping the website secure and preventing abuse: our legitimate interest in running a safe service (art. 6(1)(f)).
Statistics on which pages bring cases, and proof that we delivered your pack: our legitimate interest in running and improving the service and in handling disputes and chargebacks (art. 6(1)(f)).

We need the details marked as required to check your case and build your pack. Without them we can't provide the service.

We check your form answers against fixed rules before we send you a payment link. For most customers a person makes the decision. For customers living in Germany the check is automatic: our software checks the answers against the fixed rules in our terms (section 6) and sends the payment email or the answer that the pack does not fit. If an answer in your form was wrong, reply to our email: we correct it and run the check again. You can also ask for a person to look at an automatic decision, give your view and contest it: reply to our email (art. 22(3)).

The emails about your order are part of the service: the confirmation of your case, our answer, at most one payment reminder, the order confirmation, your pack, one reminder about letter 3 two weeks after delivery, short emails 30 and 90 days after delivery asking how it went, and the confirmation of any withdrawal. We send no newsletters or advertising.

4. Other people in your documents

Your documents may name other people, such as a customer, a restaurant or a member of the app's staff. We use those names only to prepare your documents.

5. Who processes it for us

Our own server in Finland: case data, uploads and the emails you send us.
Cloudflare (website delivery and security). All traffic to and from our site, including your form and uploads, passes through Cloudflare's network, including outside the EU.
Resend (sending and receiving our emails; EU region, Ireland, eu-west-1).
Google (Gmail): a copy of each email you send us, and a short notice of each new case (your name, email, countries and the main case details), go to our own Gmail mailbox, so we see them quickly. This is a personal Gmail account: Google handles it under its own terms, without a separate data processing agreement with us, and may store and access it outside the EU, including in the US.
Stripe (payments; Stripe is also an independent controller for fraud prevention and legal compliance).

Where these providers process data outside the EU/EEA, they rely on the EU-US Data Privacy Framework and/or the EU Standard Contractual Clauses. You can ask us for a copy of these safeguards. Each provider except Google (Gmail) works for us under a data processing agreement. We never sell your data or use it for advertising.

6. How long we keep it

Case data and uploads: 60 days after we deliver your pack. If we never deliver a pack (you don't buy, or we decline your case), 60 days after you sent the form.
Emails with us, and our internal notes about your case: deleted from our case system 60 days after delivery (or after you sent the form, if we never deliver); copies in our mailbox are deleted after 12 months.
Proof of the contract (case reference, name, email, your consents and choices with date, time, IP address and browser type, the date your pack was opened, the terms version, any withdrawal, and the pack we delivered): 3 years after the end of the year of your order.
Accounting record of your payment (reference, date, amount, currency, country, payment ID; no case details): 6 years after the end of the financial year, as Finnish accounting law requires.
Backups of our server are kept for at most 14 days.

7. Your rights

You can ask for a copy of your data, and to correct, delete, restrict or object to its use, or receive it in a portable format. Where we rely on our legitimate interests (section 3), you can object at any time for reasons relating to your situation. Email [email protected]. You can complain to the Finnish Data Protection Ombudsman (tietosuoja.fi) or the data protection authority where you live or work.

8. Cookies and browser storage

We set no cookies of our own. While you browse, your browser keeps the first page you visited and the site you came from in its session storage, so we can see which pages bring cases; it is sent only if you send the case form, and deleted when you close the tab. Our security provider Cloudflare may set a strictly necessary security cookie. We use no analytics, advertising or tracking cookies. Our fonts are served from our own server.