Sulle

Privacy Policy

Last updated: August 20, 2026

1. Data Controller

Puida Oy (Business ID: 2918901-1)
Ruopankatu 2 B 5
15100 Lahti, Finland
Email: hello@puida.com
Website: sulle.fi

2. Collected Personal Data

Sulle collects and processes as little personal data as possible. Collected data:

  • Phone number — your account's unique identifier and used for finding contacts. Your number is stored securely and used to prevent abuse.
  • Profile name — the name visible to other users, which you can choose freely.
  • Profile picture — an optional picture, which is stored in an encrypted file storage in Finland.
  • Device data — device ID and public encryption keys for establishing sessions. We do not collect the device model, operating system, or other technical information.
  • Encryption keys — public keys to enable device-to-device encryption of messages.

3. Data We Do Not Collect

Sulle does not collect or process the following data:

  • Message content — all messages, images, videos, and audio files are encrypted device-to-device. The server only processes encrypted data, which it cannot read.
  • Call content — audio and video calls are encrypted device-to-device.
  • Location data
  • Contact lists in plaintext — finding contacts is done using a privacy-preserving method.
  • Advertising identifiers or tracking data
  • Usage analytics or telemetry data

4. Purpose and Basis for Processing Personal Data

We process personal data for the following purposes:

  • Providing the service — creating your account, routing messages, and enabling calls. Basis for processing: performance of a contract (GDPR Art. 6(1)(b)).
  • Security — preventing abuse and protecting the service. Basis for processing: legitimate interest (GDPR Art. 6(1)(f)).

We do not process your personal data for advertising, profiling, or other purposes.

5. Device-to-Device Encryption

Sulle uses a secure protocol (X3DH key agreement and the Double Ratchet algorithm) to encrypt all messages. The purpose is that only the sender and the recipient can read the content of the messages. Puida Oy does not manage the encryption keys and cannot decrypt the messages.

Media files (images, videos, files) are encrypted with the AES-GCM algorithm on the device before sending. The server only processes the encrypted file, and the encryption key is never sent to the server.

6. Data Retention and Location

All server-side data is stored on servers located in Finland. Data is not transferred outside the EU/EEA.

  • Encrypted messages are stored on the server until the recipient's device has fetched them, after which they are deleted from the server.
  • Your account data (phone number, profile name, encryption keys) is stored for as long as your account is active.
  • A local copy of your messages is stored only on your own device in an encrypted SQLite database. Puida Oy has no access to your device's local database.

7. Disclosure of Data

We do not sell, rent, or disclose your personal data to third parties for marketing purposes.

We may disclose information only if required by Finnish law under a decision by a competent authority. Because messages are encrypted device-to-device, we cannot disclose the content of messages even based on an official request.

8. Your Rights

Under the EU General Data Protection Regulation (GDPR), you have the following rights:

  • Right of access to your data — you can request a copy of the data stored about you.
  • Right to rectification — you can update your profile information directly in the application.
  • Right to erasure — you can delete your account, in which case all server-side data is permanently deleted.
  • Right to restriction of processing
  • Right to data portability
  • Right to object to processing

You can exercise your rights by contacting hello@puida.com. We will respond to your request within 30 days.

You also have the right to lodge a complaint with the Data Protection Ombudsman: tietosuoja.fi.

9. Data Security

We protect personal data with appropriate technical and organizational measures. These include, among others:

  • Device-to-device encryption in all communication
  • Encrypted data traffic to the server (TLS)
  • Local database encryption on the device
  • Encryption key management on the users' own devices — the server does not manage private keys

10. Contact Form

The information you send through the contact form on sulle.fi — name (optional), email address, subject (optional) and the message itself — is processed solely to answer your enquiry. The basis for processing is legitimate interest (GDPR Art. 6(1)(f)): we reply to the messages sent to us.

Messages are processed on Puida Oy's own Tiuha service and are deleted automatically after 90 days. We do not use the information for marketing, and we do not link it to your Sulle account.

To prevent abuse, submissions pass through an automated human-verification check (Torjua Verify, Puida Oy's own service), which keeps a hashed form of the IP address for at most 30 days and sets no cookies. The form also limits how many messages can be sent from one IP address. The form does not accept file attachments.

11. Waitlist

You can leave your email address on the waitlist to be notified when Sulle arrives in the app stores. We store your address, the consent you gave, and which app store you were interested in.

The basis for processing is your consent (GDPR Art. 6(1)(a)). Signing up is confirmed by a separate confirmation email, so your address is not added to the list unless you confirm it yourself. You can unsubscribe at any time using the link in every message, which removes your address from the list.

The list is maintained on Puida Oy's own Tiuha service, and signing up passes through the same automated human-verification check as the contact form. We do not use the address for anything other than this notification, and we do not disclose it to third parties.

12. Cookies and Tracking

The Sulle website and application do not use cookies for tracking or advertising. We do not use third-party analytics tools.

13. Children's Privacy

Sulle is not directed at children under 16 years of age. We do not knowingly collect personal data from children under 16. If you notice that a minor has created an account, please contact us at hello@puida.com, and we will delete the account.

14. Changes to the Privacy Policy

We may update this privacy policy from time to time. Significant changes will be announced in the application. By continuing to use the service after the changes, you accept the updated privacy policy.

15. Contact Information

For questions regarding privacy, please contact:
Puida Oy
Email: hello@puida.com
Website: sulle.fi