Privacy Policy & Data Protection
Last Updated: October 25, 2026 • Controller: Omega Orionis Oy (Finland)
🔒 Confidential Engineering Data Stays in Your Browser
All thermodynamic simulations, CAPEX/OPEX inputs, project names, and PDF report generations are executed 100% locally inside your web browser (via JavaScript and browser localStorage). Your confidential project financial parameters are never transmitted to or stored on Omega Orionis Oy servers.
1. Data Controller
Omega Orionis Oy
Business ID (Y-tunnus): 3360075-8 | VAT ID: FI33600758
Domicile: Tampere, Finland
Contact Email: info@omegaorionis.com
2. Personal and Corporate Data We Collect
We process only the minimum data necessary to authenticate B2B user accounts and verify active software licenses:
- Authentication Data: Work email address and encrypted authentication credentials managed via Google Firebase Authentication (Email/Password or Google Sign-In).
- B2B License & Billing Metadata: Company Name, VAT / Tax Registration ID, subscription status, license expiration timestamp, and Paddle Customer/Subscription reference IDs stored in Google Cloud Firestore (`lisenssit_wasteheat`).
- Payment Card Details: Omega Orionis Oy never sees, collects, or stores your credit card numbers. All payment instrument data is processed directly by our Merchant of Record, Paddle.com, in compliance with PCI-DSS Level 1 standards.
3. Legal Basis & Purpose of Processing (GDPR Art. 6)
Processing is based on performance of a B2B contract (providing access to licensed software features), legal obligation (statutory tax and accounting retention laws in Finland and the EU), and legitimate interest (maintaining information security and preventing unauthorized license sharing).
4. Sub-processors & International Data Transfers
We rely on enterprise infrastructure providers to deliver the Service:
- Google Cloud Platform / Firebase: Hosting, authentication, and Cloud Run backend execution (primary backend region:
europe-north1, Finland). - Paddle.com Market Limited: Global Merchant of Record for payment processing, tax compliance, and subscription management.
- Google Ads / Analytics (gtag.js): Used solely for aggregated conversion measurement upon completed checkouts.
Where data is transferred outside the EU/EEA by sub-processors, transfers are safeguarded by the EU-U.S. Data Privacy Framework and European Commission Standard Contractual Clauses (SCCs).
5. Data Retention & Your GDPR Rights
Account and license records are retained for the duration of the active customer relationship and subsequently for the statutory accounting retention period required under the Finnish Accounting Act (6 years).
Under the GDPR, you have the right to request access to, rectification of, or erasure of your personal account data, as well as the right to lodge a complaint with the Office of the Data Protection Ombudsman in Finland (Tietosuojavaltuutetun toimisto). To exercise your rights, contact info@omegaorionis.com.