Website Privacy Policy

This section applies to the Buli website operated by Buli Fitness Oy (Business ID 3601232-9): website visits, pages, forms, and the password-reset and email-verification pages that Buli app emails link to. It does not replace or override the app-specific privacy rules shown in the App rules tab.

We use PostHog analytics to understand traffic and improve pages. Analytics works without cookies: PostHog stores no cookies or other identifiers on your device, and the website records no sessions. To tell same-day visits apart, PostHog computes a hash on its servers from your IP address, your browser and operating system details, and the site address, using a random value that changes daily and is deleted once that day's events are processed. Visits on different days therefore cannot be linked, and your IP address is not stored with analytics data.

• We record page views, clicks on links and buttons, form submissions without anything you type into the form, website errors, and the referral source and campaign tags (such as utm parameters).
• We never link analytics to your name, email address, or Buli account.
• If your browser sends a Do Not Track or Global Privacy Control signal, the website sends no analytics.
• Apart from one event recording whether a password reset succeeded or failed, we send no analytics from the password-reset and email-verification pages. One-time codes and similar values in page addresses are masked before analytics data leaves your browser.
• The website itself stores only your chosen theme and animation setting on your device. They are never sent to us.

• Visits: Netlify, our hosting provider, processes your IP address, browser details, and the pages you request in order to deliver and protect the site.
• Analytics: page paths, device and browser information, referral source, campaign tags, and interactions. PostHog uses your IP address only to compute the daily hash (section 2).
• Newsletter and waitlist: your email address, the form and page you used, and the time. We keep a server-side record of the submission and process your IP address for rate limiting and abuse prevention.
• Support form: your name, email address, and message, delivered to us through Netlify Forms.
• Password reset and email verification: these pages send the one-time code from your email link, and on the reset page your new password, directly to Google Firebase Authentication, which runs Buli app accounts. The website does not store them.

We share this data only with providers acting on our behalf: Netlify (hosting and forms), PostHog (analytics), Resend (email delivery and mailing lists), Google Firebase (app account sign-in), and hCaptcha (spam protection, when enabled on a form).

• Delivering and securing the website, rate limiting, and spam protection: our legitimate interest in a safe, working website (GDPR Art. 6(1)(f)).
• Website analytics: our legitimate interest in understanding how the website is used and improving it (Art. 6(1)(f)). Analytics stores nothing on your device and is never linked to you.
• Newsletter and waitlist emails: your consent, given when you sign up (Art. 6(1)(a)).
• Answering support requests: our legitimate interest in helping you (Art. 6(1)(f)), or our contract with you when the request concerns your Buli account or subscription (Art. 6(1)(b)).
• Password reset and email verification: our contract with you for your Buli account (Art. 6(1)(b)).

• Analytics events: up to 1 year.
• Newsletter and waitlist details, including the submission record: until you unsubscribe or ask us to delete them.
• Support messages: 12 months after your request is resolved, then deleted.
• Hosting and security logs: for the short period set by Netlify.
• Rate-limiting data: only temporarily.

We delete or anonymize data once it is no longer needed, unless the law requires us to keep it longer.

You can object to website analytics by turning on Do Not Track or Global Privacy Control in your browser; the website then sends no analytics. Under the GDPR you have the right to access, correct, delete, restrict, or object to processing of your personal data, and the right to data portability. You can exercise these rights or request deletion via support@bulifitness.fi. Some of our providers (Netlify, PostHog, Resend, Google, and hCaptcha) may process data outside the EU/EEA; where they do, we rely on appropriate safeguards such as the EU Standard Contractual Clauses. The controller is Buli Fitness Oy (Business ID 3601232-9), support@bulifitness.fi. You also have the right to lodge a complaint with the Finnish Data Protection Ombudsman (tietosuojavaltuutettu, www.tietosuoja.fi) or another competent supervisory authority.