SELKOTILI — COOKIE POLICY Effective Date: 22.05.2026 Last Updated: 2026-09-24 1. WHAT ARE COOKIES? A cookie is a small text file stored by a website in your browser. It contains no malicious code or viruses. Cookies enable basic site functions such as login. 2. APPLICABLE LAW • EU ePrivacy Directive (2002/58/EC) and its updates • Finnish Act on Electronic Communications Services (917/2014, §205) • EU General Data Protection Regulation (GDPR, 2016/679) • Finnish Data Protection Act (1050/2018) 3. COOKIE TYPES AND LEGAL BASIS SelkoTili uses ONLY strictly necessary cookies. These do not require separate user consent under Finnish Act 917/2014 §205(2). (a) SESSION COOKIE — JWT authentication • Name: session_token (HTTP-only, Secure, SameSite=Lax) • Purpose: Keep the user logged in • Retention: 24 hours or until browser is closed • Type: Essential — required for service operation • Set by: SelkoTili (first-party cookie) (b) LANGUAGE PREFERENCE — localStorage • Name: tilihelppo_lang • Purpose: Remember user's language choice (FI/EN) • Retention: persistent until the user clears browser storage • Type: Essential — required for UI operation (c) COOKIE CONSENT — localStorage • Name: tilihelppo_cookie_consent • Purpose: Remember that the user has accepted the cookie policy • Retention: persistent until the user revokes consent via the footer "Cookie Policy" link • Type: Essential — required to record consent under the ePrivacy Directive (d) CSRF PROTECTION TOKEN (user dashboard only) • Name: csrf_token (HTTP-only) • Purpose: Protection against Cross-Site Request Forgery attacks • Retention: Session • Type: Essential — security 4. COOKIES WE DO NOT USE SelkoTili does not use: • Analytics cookies (Google Analytics, Hotjar, etc.) • Advertising or retargeting cookies • Social-media embed cookies (Facebook Pixel, LinkedIn Insight Tag) • Third-party tracking pixels • Cross-device tracking • Fingerprinting techniques 5. THIRD-PARTY COOKIES The SelkoTili website does not set any third-party cookies. Anthropic, Resend, or other sub-processors do NOT communicate directly with your browser — all data flows through the SelkoTili server. 6. MANAGING COOKIES (a) On site: You may revoke your consent at any time via the footer "Cookie Policy" link. This re-opens the consent banner. (b) In your browser: You may block or delete cookies via your browser settings: • Chrome: Settings → Privacy and security → Cookies • Firefox: Settings → Privacy and security → Cookies • Safari: Settings → Privacy → Cookies • Edge: Settings → Privacy, search, and services → Cookies NOTE: If you block session or CSRF cookies, you will not be able to use the SelkoTili service. 7. CONSENT MECHANISM When you arrive on the site, a COOKIE CONSENT BANNER is displayed, requiring an active choice: • "Accept all" — allows all essential cookies • "Essential only" — same effect (we use only essential cookies, no optional ones) You cannot use the SelkoTili service without consenting to essential cookies (legal requirement for authentication). 8. CHANGES TO THIS COOKIE POLICY If we add analytics or other non-essential cookies in the future, we will request separate, prospective consent, revocable at any time (GDPR Art. 7(3)). 9. CONTACT Cookie questions: support@selkotili.com Selkotili Oy, Business ID 3627806-3, Espoo, Finland