This Privacy Policy explains how Mini's Blog (blog.minipasila.eu) collects, uses, stores, and protects your personal data when you use our blog and comment system.
The data controller for the personal data collected on this blog is the operator of blog.minipasila.eu. For any privacy-related inquiries, data subject requests, or questions about this policy, please contact us at blog@minipasila.eu.
We collect only the personal data necessary for the operation of the blog and comment system. The categories of data we collect are:
| Data | Purpose | Legal Basis |
|---|---|---|
| Username | Identify you in comments and on the platform | Contract performance (Art. 6(1)(b) GDPR) |
| Email address | Account verification, password recovery, and communication | Contract performance (Art. 6(1)(b) GDPR) |
| Password (hashed) | Secure authentication — we never store your plain-text password | Contract performance (Art. 6(1)(b) GDPR) |
| Account creation date | Record-keeping and account management | Legitimate interest (Art. 6(1)(f) GDPR) |
| Data | Purpose | Legal Basis |
|---|---|---|
| Username | Display with your comment | Contract performance (Art. 6(1)(b) GDPR) |
| Comment content | Display on the blog post | Contract performance (Art. 6(1)(b) GDPR) |
| IP address | Security, abuse prevention, and moderation | Legitimate interest (Art. 6(1)(f) GDPR) |
| Timestamp | Display when the comment was posted | Contract performance (Art. 6(1)(b) GDPR) |
When you visit a blog post, we record anonymous view statistics. The raw visitor IP is used only in-memory to resolve the country code and is never persisted:
| Data | Purpose | Legal Basis |
|---|---|---|
| IP address hash (salted SHA-256) | Deduplicate views from the same visitor per day — the raw IP is never stored | Legitimate interest (Art. 6(1)(f) GDPR) |
| Country code | Aggregate statistics on reader geography | Legitimate interest (Art. 6(1)(f) GDPR) |
| Post slug | Track which posts are viewed | Legitimate interest (Art. 6(1)(f) GDPR) |
| Date and timestamp | Limit counting to one view per visitor per day | Legitimate interest (Art. 6(1)(f) GDPR) |
Requests identified as bots or crawlers (via the User-Agent string) are counted separately from human views and never inflate post view counts:
| Data | Purpose | Legal Basis |
|---|---|---|
| Bot name (from User-Agent) | Identify which crawler accessed a post | Legitimate interest (Art. 6(1)(f) GDPR) |
| IP address hash (salted SHA-256) | Deduplicate bot views per day — the raw IP is never stored | Legitimate interest (Art. 6(1)(f) GDPR) |
| Post slug, date and timestamp | Admin statistics on crawler activity | Legitimate interest (Art. 6(1)(f) GDPR) |
To protect accounts from brute-force attacks, we track failed login attempts:
| Data | Purpose | Legal Basis |
|---|---|---|
| Lowercased login identifier | Associate attempts with the target account | Legitimate interest — security (Art. 6(1)(f) GDPR) |
| Attempt count, timestamps | Enforce lockout after repeated failures | Legitimate interest — security (Art. 6(1)(f) GDPR) |
Login attempt data is automatically cleared when you successfully log in.
When you are logged in, a server-side PHP session is maintained. To keep you logged in reliably on shared hosting, sessions are stored in our database (not in ephemeral files) along with an explicit expiry timestamp. The session record stores your user ID and admin status and is automatically deleted when it expires or when you log out.
When you like or dislike a blog post or a comment, we record your reaction. Reaction counts are public and visible to everyone; which reaction you gave is visible only to you and to administrators.
| Data | Purpose | Legal Basis |
|---|---|---|
| User ID | Enforce one reaction per user per post/comment and display your active reaction to you | Contract performance (Art. 6(1)(b) GDPR) |
| Post slug or comment ID | Associate the reaction with the item | Contract performance (Art. 6(1)(b) GDPR) |
| Reaction type (like / dislike) | Display aggregate counts and your own reaction | Contract performance (Art. 6(1)(b) GDPR) |
| Timestamp | Record-keeping | Legitimate interest (Art. 6(1)(f) GDPR) |
To protect the platform from abuse, administrators can ban IP addresses (or CIDR ranges) and user accounts:
| Data | Purpose | Legal Basis |
|---|---|---|
| Banned IP / CIDR ranges | Block abusive visitors from commenting or interacting | Legitimate interest — security (Art. 6(1)(f) GDPR) |
| Account ban flag | Prevent banned users from logging in or interacting | Legitimate interest — security (Art. 6(1)(f) GDPR) |
When an administrator sends an email broadcast (e.g. an announcement) to users, an audit record is kept:
| Data | Purpose | Legal Basis |
|---|---|---|
| Subject, body, recipient count, send/fail counts, sender, timestamp | Audit trail of mass communications sent from the platform | Legitimate interest (Art. 6(1)(f) GDPR) |
The audit log stores aggregate counts, not the list of individual recipients.
We retain your personal data for as long as necessary to provide our services:
As a data subject, you have the following rights under the EU General Data Protection Regulation (GDPR):
To exercise any of these rights, contact us at blog@minipasila.eu. We will respond within 30 days as required by law.
You can delete your account at any time by visiting the Account Management page and using the "Delete Account" option. This will permanently remove:
Not removed automatically: your past likes/dislikes on posts and comments are not deleted by self-service account deletion (they are not linked to your username once the account is gone, only to your user ID). If you want your reactions removed as well, please email us (see 6.2) and we will delete them for you.
This action is irreversible.
If you cannot access your account, or if you wish to request deletion of view tracking data, bot tracking data, or your past reactions, send an email to blog@minipasila.eu with your username and/or email address. We will process your request promptly.
Human and bot view tracking data is anonymized (only a salted IP hash, country code, and/or bot name are stored — the raw IP is never persisted). If you wish to have your view tracking data deleted, please contact us at blog@minipasila.eu and we will remove the relevant records.
This blog is hosted on OVHcloud infrastructure. OVHcloud acts as a data processor on our behalf and processes personal data only under our instructions in accordance with their Data Processing Agreement and applicable law.
OVHcloud's data centers are secured with industry-standard physical and technical safeguards. For more information about OVHcloud's handling of personal data, please refer to:
This blog uses a single PHP session cookie (PHPSESSID) to maintain your login state. The corresponding session data is stored server-side in our database (not in browser cookies or third-party services). No third-party analytics, advertising cookies, or tracking pixels are used. The session cookie is deleted from your browser when you log out or when it expires; the server-side session record is deleted at the same time.
Your data is stored on OVHcloud servers located in the European Union. We do not transfer personal data outside the EU/EEA.
We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. Significant changes may be communicated via the blog.
By using this blog, you acknowledge that you have read this Privacy Policy and agree to the collection and processing of your personal data as described herein.
If you have any questions about this Privacy Policy or how we handle your personal data, please contact us at:
Email: blog@minipasila.eu
© 2026 minipasila. All rights reserved.