Privacy Policy

Last updated: October 11, 2026

This Privacy Policy explains what personal data IceCube collects through its website, why we collect it, who processes it on our behalf, how long we keep it and what rights you have. It describes what the site actually does today, not what we intend it to do later.

1. Controller and Contact Details

Controller: Icecube Levi Oy
Business ID: 1940127-7
Postal address: Rautatienkatu 19 A 33, 15110 Lahti, Finland
E-mail: info@icecube.club (also for privacy requests)

We have not appointed a data protection officer; we are not required to.

2. Which Pages This Policy Covers

This policy covers the pages under icecube.club. They behave differently, so the sections below say which page they apply to:

• Front page (icecube.club): a coming-soon page with a waitlist form and a contact form.
• Preview of the full site (icecube.club/preview/ and icecube.club/preview-02/): reachable only with a password while the site is being reviewed. It contains the membership request form and the Contact page. It records no visit statistics and does not ask for analytics consent.
• Preview of a one-page version (icecube.club/preview-03/): reachable only with a password while it is being reviewed. It contains a contact form. It records no visit statistics and does not ask for analytics consent.
• This page.

3. What We Collect, Why, and On What Legal Basis

3.1 Membership requests (Membership page of the preview)

• Data: your name, telephone number with country code, e-mail address (optional), the free-text message you write, the country you select, your preferred contact language, the request type and a timestamp.
• Why: to assess your request and to contact you about it.
• Where it goes: the request is saved in our database, a copy of it is e-mailed to our team so that we notice it, and if you gave an e-mail address you receive an automatic confirmation message.
• Legal basis: steps taken at your request prior to entering into a contract (GDPR Art. 6(1)(b)).

3.2 Contact form and e-mails you send us

• Data: your name, e-mail address and message, and on the one-page preview also your telephone number if you give it, whether you use a contact form (on the front page or the one-page preview) or write to us directly. Contact-form messages are delivered to our mailbox as e-mails and are not stored in our database.
• Why: to read and answer your message.
• Legal basis: our legitimate interest in handling incoming messages (GDPR Art. 6(1)(f)).

3.3 Waitlist (front page)

• Data: your e-mail address, the name of the form it came from, a timestamp and a subscription status flag.
• Why: to e-mail you when we launch.
• Legal basis: your consent (GDPR Art. 6(1)(a)), given by ticking the consent box before submitting. You can withdraw it at any time, see sections 8 and 9.

3.4 Visit statistics (all public pages, no consent)

• Data: one record per page view: which page you viewed (its address without any query parameters), the domain of the site whose link brought you here (only the domain; or that you came directly or from another page of this site), the campaign tags of that link if it had any (utm_source, utm_medium and utm_campaign; for a Google ad link only the fact that it was one, not its click identifier), the country derived from your IP address by our database provider when the record arrives, your device type (mobile, tablet or desktop), the family of your browser and operating system (for example Safari on iOS), your browser's preferred language and the time. When you send a form, a record states which form it was (waitlist, contact or membership request) but nothing you entered; when you make a choice in Privacy settings (section 3.5), a record states whether you accepted or declined. These two records carry the same page, country, device, browser, operating-system, language and time details as a page view. We store neither your IP address nor your browser's full identification string; for the request logs of our database provider, see section 3.7.
• No cookies, no identifiers: nothing is stored in your browser for these statistics and the records contain no identifier. We use them only to count; we do not use them to recognise you when you come back, to tell whether two page views came from the same person or to single out any visitor. Only if you accept analytics (section 3.5) do the page-view and form records also carry your random IDs; the record of your Privacy settings choice never does.
• What is left out: page views by recognisable bots and automated browsers are not recorded. If you choose Decline in Privacy settings, or your browser sends a Global Privacy Control or Do Not Track signal, these statistics stop on that device: apart from the single record of your choice, nothing more is sent. Either is how you object to them.
• Why: to know how many page views the site gets, where visitors come from, which pages they view and whether the forms are used.
• Legal basis: our legitimate interest in basic visitor statistics kept without cookies or identifiers (GDPR Art. 6(1)(f)).
• Retention: 13 months, after which the records are deleted automatically.

3.5 Analytics with your consent (all public pages)

• When: only if you choose Accept in the Privacy settings panel. The panel appears on your first visit and offers Decline and Accept as equal choices; the site works the same either way. Nothing described here is collected or stored before you accept. If your browser sends a Global Privacy Control or Do Not Track signal, the panel is not shown and nothing is collected.
• Data: a random visitor ID and a random session ID, kept in your browser's local storage (section 4) and attached to the records of section 3.4. With them we also record how long each page was visible on your screen, whether you scrolled to near the end of a page, clicks on links to other sites (only the site's domain), on e-mail and telephone links (only which kind it was, not the address or number) and on buttons leading to other pages of this site, which form you started filling in and whether sending it failed (not what you entered), whether you chose to show the map, and that a script error occurred on our pages (without its details). These records carry only the random IDs, which contain nothing about you, not your name or contact details.
• Why: to see how many different people visit, how often they return and how they use the site, so that we can improve it.
• Legal basis: your consent (GDPR Art. 6(1)(a) and section 205 of the Finnish Act on Electronic Communications Services). You can withdraw it at any time with the Privacy settings button in section 4; the IDs are then removed from your browser immediately and nothing more is recorded with them. Withdrawal does not affect processing already carried out.
• Identification: we do not link the random IDs, or the records that carry them, to your name, e-mail address, telephone number or anything else you send us, and we do not try to find out whose they are. To find your analytics records we therefore need your visitor ID; section 9 explains where to find it.
• Retention: 13 months, after which the records are deleted automatically.

3.6 Map on the Contact page (preview)

• Data: the map is provided by Google Maps and is not loaded until you choose to show it. When you do, your browser contacts Google, which receives your IP address and browser details and may set its own cookies.
• Why: to show where IceCube is.
• Legal basis: your consent (GDPR Art. 6(1)(a)), given by choosing to show the map. Google processes this data under its own privacy policy.

3.7 IP addresses and server logs

We do not store IP addresses in any of our own records; for the visit statistics, our database provider derives only the country from your IP address (section 3.4). However, every request your browser makes reveals your IP address to the server that answers it. Our hosting provider GitHub logs visitors' IP addresses for security purposes, and Supabase keeps request logs, which can contain IP addresses, for about one day. All pages serve their fonts, scripts, images and videos from our own site, so no other third party receives your IP address when a page opens.

4. Cookies and Local Storage

The website sets no cookies, and we run no advertising or cross-site tracking. It stores only the following in your browser:

• icecube_consent (local storage, strictly necessary): your choice in Privacy settings (accepted or declined) and the date you made it, so that you are not asked on every page. It is written only when you make a choice and is valid for 12 months, after which you are asked again.
• icecube_vid (local storage, analytics, only with your consent): a random visitor ID and the time it was created. It is kept only while your consent is valid, so it is also removed on your first visit after your consent has expired (12 months). No ID is used for longer than 13 months, even if you renew your consent.
• icecube_exclude (local storage, strictly necessary): set only if you open a special link that we give to our own team; it keeps that browser out of the statistics. It stays until removed.
• icecube_sid (local storage, analytics, only with your consent): a random session ID and the time of your latest activity on the site. The session ends after 30 minutes of inactivity, and your next visit starts a new one.
• Preview password (session storage, strictly necessary, preview only): the password you type, so that you are not asked again on every page; it is discarded when you close the tab.

When you decline or withdraw your consent, icecube_vid and icecube_sid are removed immediately. You can see and change your choice here at any time:

Privacy settings

If you choose to show the Google Maps map on the Contact page, Google may set cookies; see section 3.6.

5. Who Processes Your Data

We use the following service providers. They process personal data only for us and only for the purposes above, except GitHub and Google, which process the data described below as independent controllers under their own terms.

• Supabase (Supabase Pte. Ltd, Singapore) - database that stores the membership requests, the waitlist addresses and the visit statistics (sections 3.4 and 3.5). When a statistics record arrives, it derives the country, device type, browser and operating-system family and language from the request and does not store your IP address. The database runs on Amazon Web Services in the EU (Stockholm, Sweden).
• EmailJS (EmailJS Pte. Ltd., Singapore) - delivers membership requests and contact-form messages to our team by e-mail and sends the automatic confirmation e-mail to an applicant who gave an e-mail address. It receives the details of the request or message. Its servers are in the USA.
• Microsoft 365 (Microsoft) - hosts the icecube.club mailbox in which your messages and our correspondence with you are stored. The mailbox data is stored in the EU (Microsoft 365 data location: Finland, within the EU Data Boundary).
• GitHub Pages (GitHub, Inc., USA) - hosts and serves the website files. It receives your IP address and the usual request details when you load a page, and logs IP addresses for security purposes.
• Google Maps (Google Ireland Limited) - the map on the Contact page, loaded only if you choose to show it (section 3.6).

Beyond these providers, we do not sell your data, we do not share it with advertisers and we do not use it for anything other than the purposes stated in section 3. We disclose data to authorities only where law obliges us to.

6. Transfers Outside the EEA

Our database and our mailbox are in the EU. Some providers in section 5 are based outside the EEA or access data from outside it. These transfers are protected as follows:

• Supabase: any access from outside the EEA (for example by Supabase, Inc. in the USA for support) is covered by the European Commission's Standard Contractual Clauses in Supabase's data processing agreement.
• EmailJS: its servers are in the USA; the transfer is covered by the Standard Contractual Clauses in EmailJS's data processing agreement.
• Microsoft 365: mailbox content is stored and processed in the EU under Microsoft's EU Data Boundary; any limited transfers to Microsoft Corporation in the USA are covered by the 2021 Standard Contractual Clauses and Microsoft's certification under the EU-U.S. Data Privacy Framework.
• GitHub: certified under the EU-U.S. Data Privacy Framework and also uses Standard Contractual Clauses.
• Google (only if you load the map): data may be transferred to Google LLC in the USA under the EU-U.S. Data Privacy Framework and Standard Contractual Clauses.

7. How Long We Keep Your Data

• Membership requests: if your request does not lead to membership, it is deleted from our database 12 months after it was submitted. If you become a member, your details are kept for the duration of your membership and for three years after it ends; accounting records are kept as the Accounting Act requires.
• E-mails in our mailbox: kept for as long as the request they concern. Correspondence about a request that does not lead to membership is deleted within 12 months of the last message; we review the mailbox at least once a year. EmailJS keeps a log of the e-mails it has sent for up to 7 days.
• Waitlist e-mail addresses: used only to tell you when the site launches. We delete the list within 30 days of sending the launch e-mail, or earlier if you ask.
• Visit statistics and analytics: each record (sections 3.4 and 3.5) is deleted automatically 13 months after it was made. The per-visit records of our earlier visit counter (time, landing page and referring domain) are likewise deleted 13 months after they were made; its daily totals contain no personal data and are kept as anonymous statistics.
• Entries in your browser: see section 4.

8. Your Rights

Under the GDPR you have the right to:

• Access: get a copy of the personal data we hold about you.
• Rectification: have inaccurate or incomplete data corrected.
• Erasure: have your data deleted, where we have no overriding obligation to keep it.
• Restriction: have our processing restricted while a dispute about it is resolved.
• Objection: object to processing based on our legitimate interest (sections 3.2 and 3.4). Because the visit statistics contain no identifier, the effective way to object to them is to choose Decline in Privacy settings (section 4) or to turn on Global Privacy Control or Do Not Track in your browser; nothing more is then recorded from that device.
• Withdraw consent: withdraw the consent given for the waitlist (section 3.3) or for analytics (section 3.5, with the Privacy settings button in section 4) at any time. Withdrawal does not affect processing already carried out.
• Data portability: receive the data you gave us in a machine-readable format.
• Lodge a complaint: see section 13.

9. How to Request Deletion or Exercise Your Rights

Send an e-mail to info@icecube.club stating what you want done. To let us find your records, please include the e-mail address and, if you sent a membership request, the telephone number you used. We answer within one month of receiving the request, as the GDPR requires, and we may ask you for more information if we cannot otherwise verify who you are.

Analytics records (section 3.5) are linked only to a random ID. If you want us to find them, include your visitor ID: it is the id value of the icecube_vid entry in your browser's local storage for icecube.club, which your browser's developer tools show. The visit statistics of section 3.4 contain no identifier. If you want us to look for your records in them, tell us when you visited which pages and with what kind of device and browser; since other visitors' records look the same, we may not be able to tell yours apart.

To be removed from the waitlist, the same e-mail is enough; we delete the address from the database rather than only flagging it. If a mailing we send contains an unsubscribe link, you can use that instead.

10. Security

All pages and all form submissions are served over encrypted connections (HTTPS/TLS). The database enforces row-level security, and the public key embedded in the pages is used only to add rows: the request, waitlist and statistics tables have no public read permission, so they cannot be downloaded from the website. Through the website, the statistics can be viewed only by the site owner after signing in, and only as totals (for example page views per day); the individual records can be read only by our database administrator in Supabase's management console. The preview is password-protected and served encrypted, so nothing of it is readable without the password. Access to the database and the mailbox is limited to the people who need it.

11. Children

Our service is not intended for children under 16 years of age, and we do not knowingly collect personal data from them.

12. Changes to This Policy

If we change what the sites collect, we update this page and the "Last updated" date at the top. If a change materially affects processing based on your consent, we ask for your consent again.

13. Supervisory Authority

If you believe we handle your personal data unlawfully, you may lodge a complaint with the Finnish supervisory authority, the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto, tietosuoja.fi), or with the authority of your own EEA country of residence.