Privacy Policy

Introduction

OÜ Mevedy teenused (hereinafter "Ohutu Toit", "we" or "us") is committed to protecting your personal data. This privacy policy explains what data we collect, how we use it and what rights you have regarding your data.

The data controller is OÜ Mevedy teenused, registry code 14144814. Contact: info@ohututoit.ee.

Last updated: 13 September 2026

What data we collect

We collect the following personal data when you use our website:

How we use the data

Data sharing

We do not sell or rent your personal data to third parties. We use the following service providers who may process your data:

• Vercel – web hosting, server infrastructure and web analytics (EU)
• PostHog – web analytics, only with your consent (EU)
• Supabase – database hosting for FAQ questions (EU)
• Resend – sending emails; message content is stored in the United States
• Sentry – error monitoring (EU); the browser-side part only with your consent
• Proton – hosting for the mailbox that contact form enquiries arrive in (Switzerland)

All service providers process data in accordance with the European Union General Data Protection Regulation (GDPR). Analytics, database and error-monitoring data is held on servers in the European Union. Where a provider also processes data outside the European Economic Area, we rely on the standard contractual clauses approved by the European Commission.

Cookies

Before you give consent we set no analytics cookies, start no browser-side error monitoring, and create no tracking identifier on your device. When a page loads, the analytics tool writes only a few test values to your device, which contain no identifier, and deletes them at once — this is how it checks what your browser supports. It also downloads part of its own program code from PostHog through our domain; that request carries no identifier, and nothing you do on the page is sent to PostHog until you give consent. Without consent the only entries kept in your browser are: your answer to the cookie notice (haccapp.consent, kept until you withdraw it), which is what stops the notice appearing again; the language cookie NEXT_LOCALE, a session cookie that records the language of the page you are viewing and is deleted when you close the browser (our server sets it on your very first visit whenever your browser's language preference differs from the language being served, and it is updated when you switch language; the site does not use it to choose the language, which follows the page address); and, if you decline, PostHog's opt-out flag __ph_opt_in_out_[project] in local storage (where [project] stands for our PostHog project key), which tells the analytics tool not to collect anything, contains no identifier and is deleted if you change your choice with the "Cookie settings" button. None of these entries can be used to track you elsewhere on the internet. Server-side error monitoring and spam protection run on a legitimate-interest basis even without consent and store nothing on your device. Our server never sends Sentry your IP address, browser details, the referring page, your language preference or location, your cookies or the content of forms. When a request fails on our server, the error report contains the fault description together with the affected lines of our own program code, the request method, the requested page's address without the domain but with any query string (such as utm_source), a random request identifier, and technical details about our server and the other services it called while handling the request. For performance measurement the server also records, for every request, the same address, the response status, how long each processing step took and which other services it called.

If you give consent, analytics and browser-side error monitoring are switched on. PostHog then keeps the following on your device: the cookie ph_[project]_posthog, valid only on ohututoit.ee and not sent to our other subdomains, which holds a random identifier, your current session's identifier and timing, the page that first referred you and the address you first landed on, and expires 365 days after your last visit; the same data plus a few technical settings in local storage under ph_[project]_posthog, together with PostHog's record of your consent, __ph_opt_in_out_[project], both kept until you withdraw consent or clear the site's data; and, only while the tab is open, session-storage entries holding an identifier for the tab and the session's referring page and campaign parameters (ad click identifiers are stored only in masked form). PostHog records the pages you view, how long you stay on each and how far you scroll, clicks on links and buttons (the element's visible text and the link address, never what you type; nothing inside forms is captured), the referring page and campaign parameters such as utm_source, whether the contact form was sent with the topic and reply method you chose (never your name, contact details or message), and errors that occur in your browser, along with your browser, operating system, device type, screen size, language and time zone. PostHog also records your IP address and the approximate location worked out from it (country, region, city and approximate coordinates). PostHog creates no person profile, and we never link this data to your name or contact details. The data travels through our own domain to PostHog servers in the European Union. PostHog session recording is switched off, and in the signed-in applications so is automatic capture of clicks and page content. Sentry records errors that occur in your browser and, for about one page view in ten, measures how quickly the page loads. It keeps a session identifier (sentryReplaySession) in this tab's session storage, reused by every page you open in the tab, and records the page as a session replay: for about one session in ten the recording is uploaded continuously; for everyone else it is kept only in a temporary buffer in the browser, and if an error occurs up to the preceding 60 seconds are uploaded, after which recording continues and is uploaded for the rest of that session — until 15 minutes pass without activity, and for at most 60 minutes, across the pages you open in the same tab. Text, typed values and media are masked in the replay by default. Vercel Web Analytics and Speed Insights measure visits and page speed without using cookies.

You can withdraw your consent at any time: use the "Cookie settings" button in the footer. It deletes your stored choice, stops analytics and browser-side error monitoring, and shows the consent notice again. Withdrawal does not affect the lawfulness of processing carried out beforehand. You can also delete cookies in your browser settings.

How long we keep data

We keep data for as long as the purpose requires. "Automatic" means the system deletes it on its own; "manual" means we do.

Your rights

Under the European Union General Data Protection Regulation (GDPR), you have the following rights:

• Right of access – to receive a copy of your personal data
• Right to rectification – to request correction of inaccurate data
• Right to erasure – to request deletion of your data
• Right to data portability – to receive your data in a structured format
• Right to withdraw consent – at any time, without retroactive effect
• Right to restriction of processing – to have processing paused while a dispute about your data is resolved
• Right to object – to object to processing that rests on our legitimate interest

To exercise your rights, contact us at info@ohututoit.ee. We will respond to your request within 30 days. If our answer does not satisfy you, you have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, info@aki.ee, aki.ee).

Contact

If you have questions about the privacy policy or your data, contact us:

Email: info@ohututoit.ee

Changes

We may update this privacy policy at any time. Changes are published on this page and the date below is updated. We do not send a separate notice, so we recommend reviewing the policy from time to time.

Last updated: 13 September 2026