Privacy

This page explains which data we process when you visit this website, use the Roots Check, use your account or hire us, and which rights you have. We are a business in the European Union, so the EU General Data Protection Regulation (GDPR) applies to everything we do with your data, wherever you live.

1. Who is responsible

Valtsuri, owner Valentin Sattinger
Mustarinne 11, 02770 Espoo, Finland
E-mail: [email protected]

Foreborn (foreborn.com) and Ahnenfaden (ahnenfaden.de) are brands of Valtsuri.

We have no data protection officer because we are not required to. For any question about your data, write to the address above.

2. Information about people who have died

Family research is mostly about people who are no longer alive. Information about the dead is not personal data under the GDPR. We still treat it as confidential and use it only for your case. Your own data and information about living relatives, on the other hand, are personal data, and everything on this page applies to them.

3. When you visit the website

The website is hosted by Cloudflare (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA). So that the pages reach you and are protected against attacks, Cloudflare processes technical data with every request: your IP address, date and time, the address requested, the page you came from, and details of your browser and operating system.

• The legal basis is our legitimate interest in a secure website that can be reached (Art. 6(1)(f) GDPR).
• Cloudflare works on our behalf under a data processing agreement. The data may be transferred to the USA. Cloudflare is certified under the EU-US Data Privacy Framework, for which the European Commission has found an adequate level of data protection (Art. 45 GDPR).
• Cloudflare uses this data only for operation and security. What we count ourselves is described in the next section.

Counting visits

To know how many people visit the website and how they find us, we count page views ourselves. We use no analytics service and no script in your browser for this. For each page view we store in our database at Cloudflare in the EU:

• the page opened, the date and the time,
• the name of the website you came from (such as linkedin.com), and a campaign tag from the link if it has one (such as utm_source),
• the country derived from your IP address, and whether you use a phone, a tablet or a computer,
• a daily key, so that several page views on the same day count as one visit. It is calculated from your IP address, your browser's identification and a random number. The random number is created anew every day and deleted the next day. After that, the key can no longer be linked to anyone, not even by us.

We do not store your IP address itself. Nothing is stored on or read from your device for this; we use only what your browser sends with every page request anyway. If you have switched on “Do Not Track” or “Global Privacy Control” in your browser, we do not count you. We also do not count requests from the networks of cloud and hosting providers, because they almost always come from programs. To tell, we look up which network your IP address belongs to when the page is requested; we do not store that either.

• The legal basis is our legitimate interest in learning how our service is found and used, and in improving it (Art. 6(1)(f) GDPR). You can object to this at any time (section 7).
• We delete the counted page views after 13 months.

Cookies and browser storage

We use no analytics or advertising services and only one cookie: the one for logging in to your account (section 5, “Your account”). While you fill in the Roots Check, the page saves your entries so far in your browser's storage (local storage), so nothing is lost if you reload the page. This draft stays on your device until you send it and is deleted then. You can delete it yourself at any time by clearing the site data for foreborn.com in your browser. This storage is needed for the function you are using and therefore needs no consent (Art. 5(3) of the ePrivacy Directive).

4. Roots Check

For the free Roots Check we ask for:

• what you would like to find out (a question about one ancestor, a line with its last name, or the whole family), and what you want to tell us about it,
• the person the search starts with, or the four grandparents: names, relationship, places, the year or date of birth, when the family came over and where it settled, the religion of the ancestors, the documents you have and, if you give it, the link to your family tree online,
• your first name and your e-mail address, and which offer you clicked, if any.

We use this information to judge what can be found in the records and to send you the result and, where it fits, an offer. The legal basis is taking steps at your request before a contract (Art. 6(1)(b) GDPR). We ask for the religion of the ancestors because it decides which church books come into question. Giving it is voluntary. We open the link to your family tree only to see how far you have got; we copy nothing about living people from it. If you name relatives who are still alive, such as grandparents, we use this information only for your Roots Check (legitimate interest, Art. 6(1)(f) GDPR).

The information is stored in a database at Cloudflare located in the EU and sent to us by e-mail. Cloudflare works on our behalf (see section 3). We also store which campaign or website brought you to us, as far as the address shows it (only the campaign tag such as utm_source or the name of the referring website, nothing else from the link), so we can see which channels work, and the language of the page you used, so we answer you in it. We do not store your IP address. If no order follows from the Roots Check, we delete the information twelve months after it at the latest.

5. When you hire us

For an order we process your contact and order details (name, postal address, e-mail address, the offer chosen, payment status) and the material for the research: what you tell us about your family, documents you send us, and our results.

• The legal basis is the performance of the contract (Art. 6(1)(b) GDPR), and for invoices and accounting records our legal obligation to keep them (Art. 6(1)(c) GDPR).
• We use information about living relatives that you give us only as far as your order needs it. We search for living relatives only when your order includes it (see “Searching for living relatives”). The legal basis is the legitimate interest in researching one's own family history (Art. 6(1)(f) GDPR).
• If you give us information that reveals the religion, ethnic origin or health of living people, we process it only with your explicit consent (Art. 9(2)(a) GDPR), which we ask for when you order.

Your account

With your offer we set up an account for you on foreborn.com. There you order, see how your case is going, answer our questions and upload documents. For this we store in our database at Cloudflare in the EU your first name and your e-mail address, the language of your account, at the order your name and postal address, your offer and your order, what you tell us about your family, your answers and the state of your case. Files you upload and our results are kept in storage at Cloudflare in the EU and can be opened only by you and by us. Cloudflare works on our behalf (see section 3).

• You log in with a link we send you by e-mail; there is no password. We store only a check value from which the link cannot be recovered. The link works once.
• While you are logged in, the website sets a cookie by which it recognizes you. It contains only a random number and is deleted when you log out, after 60 days at the latest. It is needed for logging in and therefore needs no consent (Art. 5(3) of the ePrivacy Directive).
• We also send the e-mails about your account (login link, offer, order confirmation, news in your case) through Cloudflare (see section 3). The e-mails are plain text without tracking pixels and without redirected links.
• The legal basis is taking steps before a contract and the performance of the contract (Art. 6(1)(b) GDPR).
• If you do not order, we delete the account with the offer twelve months after the offer at the latest. After an order, the retention period further below applies.

Withdrawal through the website

If you withdraw from a contract through “Withdraw from contract”, we store your name, your e-mail address, the order number, the text of your withdrawal and the time it was received. We send you a confirmation of receipt by e-mail (through Cloudflare, see above) and keep both with the records of the order (Art. 6(1)(b) and (c) GDPR).

Payment

Payment is handled by Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland). After the order we send you to a Stripe payment page and give Stripe your e-mail address, the order number and the amount. Stripe also processes the payment details you enter there under its own responsibility, for example to prevent fraud. We do not see card details. From Stripe we learn only who paid what. More in Stripe's privacy policy.

AI services

For reading old handwriting, searching archive holdings and writing the reports, we use language models from Anthropic (Anthropic, PBC, USA). Anthropic processes the data on our behalf under a data processing agreement and may not use it to train its models. For the transfer to the USA, the European Commission's standard contractual clauses apply (Art. 46(2)(c) GDPR). We pass on only what the research needs.

Searching for living relatives

If an order includes a search for living relatives, for example for descendants of emigrants or for the family that stayed in Europe, we process data of people who did not hire us themselves. If we found you this way, the following applies to you:

• We search only in publicly available sources: death registers, death and funeral notices, censuses and other registers, directories, and information you have published yourself.
• We process only what is needed to establish the relationship and to reach you: your name, life dates, the relationship, where you live and your contact details.
• We tell our clients your name, the relationship and roughly where you live. We pass on your postal address, phone number and e-mail address only with your consent. We pass on nothing about minors.
• At the latest when we pass on information about you, we write to you: who is looking for you, how you are related, where we got your information and whether you would like contact.
• If you do not want contact or you object, we pass on nothing and delete your information except for a note that you do not want contact, so that nobody writes to you again.
• The legal basis is our clients' legitimate interest in finding their family (Art. 6(1)(f) GDPR). You can object at any time (section 7).
• We keep your information with the case and delete it with the case. We keep the note about an objection as long as the case exists.

Archives and authorities

For requests to archives, parishes and registry offices we pass on the details of the person we are looking for. We pass on your name, your address or a power of attorney only if an office requires it and you have agreed to the request beforehand.

How long we keep data

We keep your case data and results for as long as you want access to your case. We delete them at your request. Invoices and accounting records must be kept under Finnish bookkeeping law, depending on their kind for up to ten years.

6. When you write to us

If you send us an e-mail, we process your address and your message to answer you (Art. 6(1)(b) or (f) GDPR). Cloudflare receives e-mails to [email protected] for us and forwards them to our mailbox (see section 3). If you write from the address of your Roots Check or your account, we also store the e-mail with its attachments at Cloudflare in the EU, so that it goes into your case. We likewise store replies from archives and other offices that name an order number in the subject with that case. We delete these copies together with your Roots Check or your case data (see “How long we keep data”). Otherwise we delete e-mails when they are no longer needed for the request and for our record-keeping obligations.

7. Your rights

You have the right to

• access the data we hold about you (Art. 15 GDPR),
• have incorrect data corrected (Art. 16 GDPR),
• have data deleted (Art. 17 GDPR) and its processing restricted (Art. 18 GDPR),
• receive your data in a common format (Art. 20 GDPR),
• object to processing based on our legitimate interest (Art. 21 GDPR),
• withdraw a consent with effect for the future (Art. 7(3) GDPR).

An e-mail to [email protected] is enough.

You can also complain to a data protection supervisory authority. The authority responsible for us is the Finnish Data Protection Ombudsman (Tietosuojavaltuutetun toimisto, tietosuoja.fi). If you live in the EU, you can also turn to the authority in your country.

8. Other

You do not have to give us any data. Without an e-mail address, however, we cannot send you a result, and without information about your family we cannot do research. We make no decisions about you that are based solely on automated processing (Art. 22 GDPR).

Last updated: October 2026