Privacy Policy

Effective date: 4 July 2026
Last updated: 4 July 2026
Contact: blog@minipasila.eu

This Privacy Policy explains how Mini's Blog (blog.minipasila.eu) collects, uses, stores, and protects your personal data when you use our blog and comment system.

1. Data Controller

The data controller for the personal data collected on this blog is the operator of blog.minipasila.eu. For any privacy-related inquiries, data subject requests, or questions about this policy, please contact us at blog@minipasila.eu.

2. Information We Collect

We collect only the personal data necessary for the operation of the blog and comment system. The categories of data we collect are:

2.1 Account Information (when you register)

Data	Purpose	Legal Basis
Username	Identify you in comments and on the platform	Contract performance (Art. 6(1)(b) GDPR)
Email address	Account verification, password recovery, and communication	Contract performance (Art. 6(1)(b) GDPR)
Password (hashed)	Secure authentication — we never store your plain-text password	Contract performance (Art. 6(1)(b) GDPR)
Account creation date	Record-keeping and account management	Legitimate interest (Art. 6(1)(f) GDPR)

2.2 Comment Data (when you post a comment)

Data	Purpose	Legal Basis
Username	Display with your comment	Contract performance (Art. 6(1)(b) GDPR)
Comment content	Display on the blog post	Contract performance (Art. 6(1)(b) GDPR)
IP address	Security, abuse prevention, and moderation	Legitimate interest (Art. 6(1)(f) GDPR)
Timestamp	Display when the comment was posted	Contract performance (Art. 6(1)(b) GDPR)

2.3 View Tracking (automatic, no account needed)

When you visit a blog post, we record anonymous view statistics:

Data	Purpose	Legal Basis
IP address hash (SHA-256)	Deduplicate views from the same visitor per day — the raw IP is never stored	Legitimate interest (Art. 6(1)(f) GDPR)
Country code	Aggregate statistics on reader geography	Legitimate interest (Art. 6(1)(f) GDPR)
Post slug	Track which posts are viewed	Legitimate interest (Art. 6(1)(f) GDPR)
Date	Limit counting to one view per visitor per day	Legitimate interest (Art. 6(1)(f) GDPR)

2.4 Login Attempt Tracking

To protect accounts from brute-force attacks, we track failed login attempts:

Data	Purpose	Legal Basis
Lowercased login identifier	Associate attempts with the target account	Legitimate interest — security (Art. 6(1)(f) GDPR)
Attempt count, timestamps	Enforce lockout after repeated failures	Legitimate interest — security (Art. 6(1)(f) GDPR)

2.5 Session Data

When you are logged in, a server-side PHP session is maintained. The session stores your user ID and admin status. No session data is persisted after your session expires or you log out.

3. How We Use Your Information

Account management: Creating, verifying, and managing your account.
Commenting: Publishing your comments on blog posts.
Security: Protecting accounts from unauthorized access (brute-force lockout, CAPTCHA).
Analytics: Tracking post view counts and reader geography (anonymized).
Communication: Sending verification emails and password reset links.
Moderation: Reviewing and managing comments and user accounts.

4. Data Retention

We retain your personal data for as long as necessary to provide our services:

Account data: Retained while your account is active. Deleted immediately when you delete your account.
Comments: Retained indefinitely unless you delete your account (which removes all your comments) or an administrator removes them.
View tracking data: Retained indefinitely in anonymized form (IP hash + country code only).
Login attempt data: Retained until successful login or until the lockout window expires (maximum 1 hour).
Verification and reset tokens: Expire after use or after a set time period.

5. Your Rights Under GDPR

As a data subject, you have the following rights under the EU General Data Protection Regulation (GDPR):

Right of access (Art. 15): Request a copy of the personal data we hold about you.
Right to rectification (Art. 16): Request correction of inaccurate data.
Right to erasure (Art. 17): Request deletion of your personal data ("right to be forgotten").
Right to restriction of processing (Art. 18): Request that we limit how we process your data.
Right to data portability (Art. 20): Request your data in a machine-readable format.
Right to object (Art. 21): Object to processing based on legitimate interest.
Right to withdraw consent: Withdraw any consent you have given at any time.

To exercise any of these rights, contact us at blog@minipasila.eu. We will respond within 30 days as required by law.

6. How to Delete Your Data

6.1 Self-Service Account Deletion

You can delete your account and all associated data at any time by visiting the Account Management page and using the "Delete Account" option. This will permanently remove:

Your account record (username, email, password hash)
All comments you have posted (including stored IP addresses)

This action is irreversible.

6.2 Email Request

If you cannot access your account, or if you wish to request deletion of view tracking data, send an email to blog@minipasila.eu with your username and/or email address. We will process your request promptly.

6.3 View Tracking Data

View tracking data is anonymized (only an IP hash and country code are stored). If you wish to have your view tracking data deleted, please contact us at blog@minipasila.eu and we will remove the relevant records.

7. Hosting Infrastructure

This blog is hosted on OVHcloud infrastructure. OVHcloud acts as a data processor on our behalf and processes personal data only under our instructions in accordance with their Data Processing Agreement and applicable law.

OVHcloud's data centers are secured with industry-standard physical and technical safeguards. For more information about OVHcloud's handling of personal data, please refer to:

8. Cookies and Tracking

This blog uses a PHP session cookie to maintain your login state. No third-party analytics, advertising cookies, or tracking pixels are used. The session cookie is deleted when you log out or when your session expires.

9. Data Transfers

Your data is stored on OVHcloud servers located in the European Union. We do not transfer personal data outside the EU/EEA.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. Significant changes may be communicated via the blog.

By using this blog, you acknowledge that you have read this Privacy Policy and agree to the collection and processing of your personal data as described herein.

11. Contact

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us at:

Email: blog@minipasila.eu