Privacy Policy

Last updated: 30 September 2026

This policy describes how KKG Fagerholm Oy (“we”, “us”), a company registered in Finland, processes personal data in connection with Vecks (the “Service”), a profit-and-loss reporting service for e-commerce businesses (“Clients”). The Service reads the sales and advertising data a Client connects and produces financial reporting from it. We act as a processor of the data our Clients connect, and as a controller for the account data of the people who use the Service.

Data we process

• User account data. The email address of each person who administers a Client’s account, and the time they sign in. Sign-in is by emailed link; we store no passwords.
• Advertising platform data. When a Client connects an advertising account (Meta, Google Ads, TikTok Ads), we retrieve aggregated campaign performance through the platform’s official API: campaign names and identifiers, spend, impressions, clicks, delivery country and conversion metrics. This is aggregate business data and does not identify the people who saw or clicked the ads.
• Order data. When a Client connects a store (WooCommerce, Shopify, Amazon), we retrieve orders through the platform’s official API and reduce each order to its financial facts before storing it: order id, dates, currency, amounts, products, quantities, refunds, payment method, and the country the order shipped to. Names, street addresses, phone numbers, email addresses and free-text notes are dropped before storage. For WooCommerce orders we keep a one-way hash of the customer’s email so repeat purchases can be counted and read as new and returning customers and as cohorts (customers acquired in a month, and what they ordered since); the email itself is not stored. For Shopify orders we keep Shopify’s own numeric id for the customer, for the same purpose; their name, email, phone and address are never requested. When Shopify asks us to erase a customer, the id is removed from every order it is on.
• Connection credentials. API keys and access tokens a Client grants are stored encrypted (AES-256-GCM) and used only server-side to read the data above.
• Enquiries. When you send the form on vecksapp.com, the name, email address, store address and message you type are sent to our inbox by email. They are not written to the Service’s database; they stay in our mailbox, and you can ask us to delete them.
• Support conversations. Messages a Client’s administrator sends us from inside the Service, and any screenshots attached to them, are stored in our database so the conversation can be continued. A screenshot is whatever was on that person’s screen, so it may contain anything the Service was showing at the time.
• Access log. When a Client’s administrator opens an individual order in the Service, we record who did so and when, so a data subject request can be evidenced. The same record is written when an AI assistant reads an order on their behalf, because both read through the same code.

How we use data obtained from Meta, Google and TikTok

Data retrieved from an advertising platform’s API is used only to provide the Service to the Client whose account it belongs to: computing advertising cost, contribution margin and related financial reporting. We do not sell it, use it for advertising of our own, combine it across Clients, or share it with anyone other than the subprocessors listed below. Meta data is processed in accordance with the Meta Platform Terms. Vecks’ use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. A Client can revoke our access at any time in the Service or at the platform (for Google, at myaccount.google.com/permissions).

Artificial intelligence features

The Service includes an assistant that answers questions about a Client’s figures and proposes changes to their cost model, a nightly check of their setup, and a reader that turns a pasted rate card, spreadsheet or supplier invoice into cost rules. These features send the relevant part of the Client’s data, and the text or image the Client supplies, to Google’s Gemini API, which processes it and returns an answer. What is sent is the financial data described above and whatever the Client chooses to paste or upload; the connectors have already dropped customer names, addresses and contact details before any of it is stored, so those do not reach it. Nothing is sent to Gemini unless a Client uses one of these features, and no proposed change is ever applied without a person approving it.

A Client can also connect their own AI client (for example Claude) to the Service with an access token they issue and can revoke. Their data then flows to whichever service they chose, on their instruction; every read is recorded in the access log and no change can be applied without a preview they approve.

Legal bases

We process user account data to perform our contract with the Client (GDPR Art. 6(1)(b)). We process connected platform data on the Client’s documented instructions as their processor; the Client is the controller of that data.

Where data is stored and who can access it

The database is hosted by Supabase and the application by Vercel, both in London, United Kingdom. Email is sent through Resend, and the assistant and document readers send data to Google’s Gemini API as described above; both process it in the United States. Transfers outside the EEA are made on the safeguards Chapter V of the GDPR requires. These four are our subprocessors; we use no others, and we will tell Clients before we add one. Access within KKG Fagerholm Oy is limited to personnel who operate the Service. Aggregated dashboards can be shared by the Client through an unlisted link the Client controls and can replace at any time; those dashboards show financial aggregates, never individual customers.

Cookies and analytics

The administration interface uses only the cookies needed to keep you signed in and to remember which company you are working in. The shared dashboards set no cookies; they keep the two display choices you make there, the refund timing and whether figures are shown in thousands, in your own browser so the page opens the way you left it. Neither identifies you and neither is sent anywhere.

We count page views on the marketing pages ourselves, without cookies, and this does not wait for your answer to the banner because there is nothing to consent to: nothing is stored on your device and nothing identifies you. We record the page, the site that linked to you, any campaign tags in the address, your country and whether you are on a phone, tablet or computer. We do not keep your IP address or your browser identification, and we create no visitor or session identifier, so two visits by the same person are two rows we cannot connect. The data stays with us and is never sent anywhere else.

The marketing pages at vecksapp.com ask first. Google Tag Manager and the analytics tag it carries are not loaded until you accept, so nothing is stored on your device before you have chosen. If you accept, Google sets its own cookies (names beginning _ga) to count visits. You can change your mind at any time from the link in the footer of these pages, which switches the tag off and clears those cookies. The dashboards and the administration interface never load it.

If you accept, the marketing pages also load the Meta pixel, which sets advertising cookies in your browser and tells Meta which of those pages you opened. We use it to measure our advertising and to show our advertising to people who have visited this site. It waits for the same answer the analytics tag does, it runs on the marketing pages only, and declining leaves it unloaded.

When you send the contact form on vecksapp.com, we also report that request to Meta from our server, so we can tell which advertising leads to enquiries. That report contains your email address and name in an irreversible hashed form, your IP address and your browser identification, and, if you accepted the banner earlier, the identifiers Meta’s own cookies hold. It is sent once, when the message reaches us. If you would rather not be included, write to us at the address below instead of using the form.

Retention and deletion

Connected platform data is retained for as long as the Client uses the Service, so reporting can cover past periods. A Client’s administrator can remove a connection at any time: the stored credentials are deleted immediately, and the imported data is deleted on the same action when the administrator chooses so. When a Client terminates the Service, all of its data is deleted within 30 days except where retention is required by law. See Data deletion for how to request deletion.

Your rights

Under the GDPR you have the right to access, rectify and erase your personal data, to restrict or object to its processing, and to data portability. If you are a customer of one of our Clients, please direct requests to that Client, who controls your data; we will assist them in fulfilling it. You also have the right to lodge a complaint with a supervisory authority: in Finland, the Office of the Data Protection Ombudsman (tietosuoja.fi).

Contact

KKG Fagerholm Oy, Finland. Email: privacy@kkgconsulting.fi

We may update this policy as the Service evolves; the date above shows the latest revision.