Privacy policy.
What we collect, where it comes from and what we do with it, whether you contacted us or we contacted you.
Last updated: October 21, 2026
This policy explains how Avernora (“we”, “us”) handles personal information when you visit this website, request a free website review (“teardown”), receive an email from us, talk to us on a call or work with us.
Who we are
Avernora is operated by ST Consulting, a sole proprietorship of Samu Timonen registered in Finland (Business ID 3618254-7, Kerava, Finland). ST Consulting is the controller of your personal information.
Contact: samu@avernora.com
We are a one-person business, so there is no separate data protection officer. Samu handles every privacy request personally.
Summary
- We email small and medium-sized US service businesses about their websites, using business contact details that the business has published itself.
- We send at most three emails per business. If you reply “No, thank you,” or ask us to stop in any other way, we stop, and we stop contacting your company.
- We don’t use cookies, analytics or tracking on this website, and we don’t sell personal information.
What we collect and where it comes from
When you contact us or request a teardown
- What you enter in the teardown form: your name, email, company, website address, phone number if you add it, how new clients usually reach you and any details you write.
- Emails you send us, and what you tell us on a call or during a project.
When we contact your business first
We research businesses that may benefit from a better website. For each business we may record:
- The business name, website, location, services and similar public business details.
- A business email address that the business has published, and the name and role of the owner or a contact person when they are publicly listed. We don’t guess email addresses and we don’t buy contact lists.
- Our notes on the public website, such as whether the call button works or whether the contact form is easy to find, together with screenshots of the public pages.
- Where each detail came from and when we checked it.
Our sources are public: the business’s own website, its Google Business Profile, state contractor license registries and public business directories (for example Houzz or the Better Business Bureau). When needed, we also use Hunter.io to check whether a published business email address can receive mail, or to find a business email address that has been published publicly.
When you visit this website
- Our hosting provider automatically records basic technical logs (IP address, browser type and the pages requested) to deliver the site and keep it secure. We don’t use these logs to identify or profile visitors.
What we don’t collect
We don’t collect sensitive information (such as health or financial data) through outreach, and we don’t use social media accounts to contact people.
How we use it and our legal bases
Because we are based in Finland, the EU General Data Protection Regulation (GDPR) applies to everything we do, including our work with US businesses.
| Purpose | Legal basis (GDPR) |
|---|---|
| Researching businesses and sending them a short, relevant email about their website (at most three emails per business) | Our legitimate interests (Art. 6(1)(f)) |
| Preparing and sending a free website review you asked for, and replying to your messages | Steps you ask for before a contract (Art. 6(1)(b)) and our legitimate interest in answering inquiries |
| Sales calls, quotes and delivering a project | Steps before a contract and performance of the contract (Art. 6(1)(b)) |
| Keeping a suppression list so we never contact you or your company again after you opt out | Our legitimate interests (Art. 6(1)(f)), including respecting your request and complying with the US CAN-SPAM Act |
| Keeping the website secure and working | Our legitimate interests (Art. 6(1)(f)) |
| Accounting, tax and other legal obligations | Legal obligation (Art. 6(1)(c)) |
Our legitimate-interest assessment, in short. Our interest is to offer a relevant service to businesses that may need it. We limit ourselves to business contact details the business has published for exactly this kind of contact. We only write when we have looked at the business’s website and have something specific to say. We send a small number of emails, and stopping them takes a two-word reply. We don’t add you to newsletters or share your details with anyone for their marketing. On that basis we believe the impact on you is low and that a business would reasonably expect this kind of contact. You can object at any time, and we will stop.
AI tools and human review. We use AI assistant tools to help research public business information and draft emails and reviews. A person reads and approves every email before it is sent. We don’t make decisions about you based solely on automated processing.
Emails we send to businesses
Our outreach emails are commercial messages. They are sent personally by Samu Timonen from an Avernora address, identify Avernora and include our postal address. We follow the US CAN-SPAM Act, and every email tells you how to opt out.
- How to opt out: reply “No, thank you,” or email samu@avernora.com at any time. You don’t need to give a reason.
- What happens next: we stop all follow-ups and process your request within 2 business days. We add your email address and your company’s web domain to our suppression list, so nobody at your company receives further outreach from us.
Free website reviews and calls
If you ask for a free website review, we send it by email, usually with screenshots of your public website. If you’d like to talk, we set up a call on Google Meet. We don’t record or transcribe calls.
Who we share it with
We use a small number of service providers. They process information on our behalf and only for the purposes above:
- Google (Google Workspace): our email (Gmail), the spreadsheet where we keep business contacts and outreach status (Google Sheets), and video calls (Google Meet).
- Web3Forms: forwards the teardown form to our inbox.
- Vercel: hosts this website.
- Cloudflare: provides DNS for our domains and redirects our second domain, getavernora.com, to this website.
- Hunter.io: used when needed to check email deliverability or to find published business email addresses.
- AI assistant providers: help us research public business information and draft emails and reviews.
We may also share information with professional advisers, or with authorities when the law requires it or to protect our rights, and with a buyer or successor if the business is sold or transferred.
We don’t sell personal information, and we don’t share it with others for their advertising.
International transfers
We are in Finland and work with US businesses, so some of our providers process information outside the European Economic Area (EEA). When information leaves the EEA, it is protected as follows:
- Google, Vercel and Cloudflare are certified under the EU–US Data Privacy Framework, and transfers to them rely on that framework.
- Web3Forms, which is operated from India, and Hunter.io, whose main processing takes place in the EU but which uses some US-based sub-processors, use the European Commission’s Standard Contractual Clauses under their data processing terms.
- Our AI assistant providers process information under appropriate safeguards, such as the Standard Contractual Clauses or the EU–US Data Privacy Framework.
You can ask us for more information about these safeguards at samu@avernora.com.
How long we keep it
- Outreach contacts who don’t reply, or who reply that they’re not interested: deleted 12 months after our last email.
- Suppression list (opt-outs): kept for as long as we do outreach, limited to the email address, company domain, date and reason. This is the minimum we need to make sure we never contact you again.
- Teardown and website review emails, and related messages: up to two years after our last contact, unless we start working together.
- Project, quote and invoicing records: as long as Finnish accounting law requires, up to ten years.
- Hosting logs: the short periods set by our hosting provider.
Your rights
Wherever you live, you can ask us to:
- tell you what information we hold about you and where it came from, and give you a copy;
- correct it;
- delete it, unless we have to keep it (for example for accounting). If you ask us to delete your details, we still keep your email address and domain on our suppression list so we don’t contact you again;
- stop using it for outreach (you can object at any time);
- restrict how we use it, or give it to you in a portable format.
To make a request, email samu@avernora.com, ideally from the address we contacted or that you used with us. An authorized agent can make a request with your written permission. We respond within one month. If a request is complex we may need up to two more months, and we’ll tell you if so. If we decline a request, we explain why, and you can appeal by replying to our answer. We won’t treat you differently for using your rights.
US residents. Some US states, including California, give residents privacy rights. We honor the rights above for everyone regardless of where you live. We don’t sell or “share” personal information as California law defines those terms, and we don’t use sensitive personal information.
Complaints. If you’re unhappy with how we handle your information, please tell us first. You also have the right to complain to the Finnish Data Protection Ombudsman (tietosuoja.fi) or to the data protection authority where you live or work.
Cookies
This website doesn’t use cookies, analytics, advertising pixels or any other tracking. The site’s fonts and scripts are served from our own domain. When you submit the teardown form, your entry is sent to Web3Forms to be delivered to our inbox.
Security
We use reputable providers, protect our accounts with strong authentication and limit access to what is needed. No method of transmission or storage is completely secure, so we can’t guarantee absolute security.
Children
This website and our outreach are for businesses and aren’t directed to children under 16. We don’t knowingly collect their information.
Changes
We may update this policy. The date at the top shows the latest change. If we make a significant change, we will update the date and the affected sections.
Questions: samu@avernora.com
Samu Timonen, sole trader, Business ID 3618254-7, Kerava, Finland