Last updated: 17 October 2026
1. Controller
Strandfors Oy (Kernwatch)
Teollisuuskatu 6
64260 Kaskinen, Finland
Email: info@kernwatch.com
2. What we process and why
Visiting this website
When you open a page, our server processes your IP address, the date and time, the page requested, your browser's user agent and the referring page. We need this to deliver the website and to keep it secure (legal basis: Art. 6(1)(f) GDPR, our legitimate interest in a secure and working website). Server logs are deleted after 7 days.
This website uses no tracking or advertising cookies, no analytics tools and no third-party fonts or embeds.
Your Kernwatch account
When you create an account we store your email address, your name, your company (the name of your workspace), the plan you chose, your password (only as a one-way hash), your IP address and time zone, and a one-time code we email to confirm your address (only as a salted hash, deleted once used or after 15 minutes). We use this to provide your account and the service you signed up for (legal basis: Art. 6(1)(b) GDPR, contract). If you were invited, the workspace's administrators see your name and email address. We keep account data for as long as the account exists and for 7 days after the account is closed.
If you choose a paid plan and pay by card, the payment is processed by Stripe Payments Europe, Limited (Ireland). Kernwatch does not receive or store your card number; we keep the plan, the subscription status and the payment references Stripe returns.
Data in a customer's workspace
Personal data that a customer stores in its Kernwatch workspace - for example its users, its customer contacts and the vulnerability reports it receives through its disclosure page - is processed by Strandfors Oy on the customer's behalf as a processor under the Data Processing Agreement. The customer is the controller of this data; to exercise your rights, please contact the customer concerned.
Early-access waitlist
When you join the waitlist we store your work email, company, role, country, the answers you choose in the form, your message, the page and language you used, campaign parameters in the page address (utm_source, utm_medium, utm_campaign), your IP address and the time of your consent. We use this to contact you about early access to Kernwatch and to understand demand (legal basis: Art. 6(1)(a) GDPR, your consent). You can withdraw your consent at any time with effect for the future, for example by email to info@kernwatch.com.
We delete your waitlist entry when you withdraw your consent, when you become a customer and a contract replaces it, or at the latest 12 months after your last contact with us.
3. Recipients
The website, the waitlist and the Kernwatch service are operated by Kernwatch (Strandfors Oy) itself in Finland. Emails from Kernwatch (sign-up codes, invitations, notifications) are sent through Google Workspace (Google). Card payments are processed by Stripe Payments Europe, Limited (Ireland) as described above. We do not sell personal data. Where Google or Stripe process personal data outside the European Economic Area, this happens, where applicable, on the basis of the European Commission's standard contractual clauses or an adequacy decision.
4. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You also have the right to lodge a complaint with a supervisory authority, in particular in the member state of your residence or workplace. Our competent authority is the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto), Finland, tietosuoja.fi.
5. Contact
Questions about this policy: info@kernwatch.com.